Internal Audit Oversight Committee Charter and Bylaws

Mission

Through oversight of the Office of County Internal Audit (Office) activities, enhance and protect Clackamas County's organizational value by promoting risk-based and objective assurance, advice, and insight.

Vision

The Office of County Internal Audit assurance and advisory services enhance Clackamas County residents', employees', and departments' confidence that the public's interests are protected and encourage engagement with an accountable, high performing, and transparent local government.

Purpose

The purpose of the Clackamas County Internal Audit Oversight Committee (Committee) is to support, through the Office, the Clackamas County Board of County Commissioners, County Administrator, and County departments in their oversight of the County's system of internal controls, efficient and effective use of public resources, financial and operational reporting, information security, and compliance with laws, regulations, policies and ethics.

The Committee is responsible for enabling the independence of the Office. Independence is the freedom from conditions that impair the Office's ability to carry out its responsibilities in an unbiased manner. The Committee ensures the Office is independent and acts to promote its integrity and effectiveness.

The Committee guides the activities of the Office and is a forum for all internal audit and external review issues affecting the County, including the monitoring and disposition of those issues. The Committee supports the Office in its efforts to bring a systematic, disciplined approach to evaluating and improving the efficacy of governance, risk management, and control processes.

Authority

The Committee is established under the authority provided in County Code Chapter 2.15: County Internal Auditor. The Committee is authorized to review any matters within its scope of responsibility. It may:

• Evaluate management's responses to audit recommendations and noted opportunities for improvement.
• Ensure no unreasonable restrictions are placed on the County Internal Auditor.
• Facilitate transparent communication between the County Internal Auditor, County Administrator, and Board of County Commissioners.
• Monitor Office activities by working with the County Internal Auditor.

Composition

The Committee is comprised of seven members - the Board of County Commissioners Chair, the Board of County Commissioners Vice Chair, the County Counsel, the County Administrator, and three members of the community appointed by the County Treasurer from a list of nominees submitted by the County Internal Auditor. The County Treasurer may serve as a non-voting member. The Committee membership represents a base of expertise in some of or all of the following areas: local government, finance, risk, information security, and process improvement.

Community members must be Clackamas County residents and avoid conflicts of interest, or the appearance of such conflicts, that would impair independence. Should a conflict arise, members willadvise the County Internal Auditor. Community members may serve three consecutive two-year terms. One of the community members serves as the Committee Chairperson and is elected by the Committee.

Meetings and Records

Committee meetings adhere to Oregon Public Meeting Law. The Committee determines the frequency of its meetings, meeting at least three times annually. The Committee may invite guests to provide pertinent information. Meeting agendas and briefing materials are prepared and provided in advance. Written or recorded minutes are prepared and provided to each Committee member. A quorum consists of four voting Committee members, including at least one community member. A quorum is required for all Committee business requiring a vote of the Committee.

The Committee adheres to Oregon Public Records Law. The Office provides staff resources to the Committee and maintains all Committee permanent records. Distribution and retention of all Office and Committee records is administered through the Office. The Committee safeguards and maintains the security of unpublished information from unauthorized access. All public records requests are administered through the Office.

Responsibilities

The Committee has the responsibilities to:

Internal Control and Compliance

• Receive and review all significant internal audit and external review communications, reports, and management letters, as well as management's responses and follow-up activities.
• Consider the Office's assessment of the effectiveness of the County's governance processes.
• Consider the Office's assessment of the effectiveness of the County's risk management processes.
• Consider the Office's assessment of the effectiveness of the County's control processes, including information security and fraud detection.
• Consider the Office's assessment of the effectiveness of the County's system for monitoring law, rule and policy compliance.
• Review the results of management's investigation of any significant noncompliance event.
• Review reports summarizing investigations of potentially fraudulent activities. Office of County Internal Audit
• Review and assess the adequacy and effectiveness of the Office charter, activities, resources, qualifications and organizational structure, including compliance with The Institute of Internal Auditors'

Global Internal Audit Standards.

• Review and approve the Office charter.
• Ensure there are no unjustified restrictions or limitations on the County Internal Auditor.
• Ensure the Office is free from interference when determining its scope, performing engagements and communicating results.
• Review and approve the internal audit risk-based Audit Plan and all major changes to the Plan.
• Review and provide input in the appointment or dismissal of the County Internal Auditor, prior to the County's action.

Reporting Responsibilities

• Ensure an open avenue of communication between the Board of County Commissioners, County Administrator, County departments, Office of County Internal Audit, and external auditors.
• Regularly, in coordination with the County Internal Auditor, present to the Board of County Commissioners results of Committee and County Internal Audit activities.

Other Responsibilities

• Assess the adequacy of Committee charter and bylaws at least annually and approve revisions.
• Confirm annually the responsibilities outlined in this charter have been carried out.

County Management Responsibilities

County management is responsible for the County's governance, risk management, and control processes. The Committee's engagement with the review and assessment of these processes does not relieve management of its responsibilities.

Approved this 20th day of March 2024, by Internal Audit Oversight Committee vote.