Internal Audit Oversight Committee - Aug. 5, 2026

Agenda

Next IAOC Meeting: Wednesday, Oct. 14, 2:00 PM to 3:30 PM 

Future Internal Audit Oversight Committee Schedule

Quarterly on the second Wednesday of the month (January, April, June, October)

• Wednesday, October 14, 2026
  2:00 PM to 3:30 PM
  Virtual – Zoom
• Wednesday, January 13, 2027
  2:00 PM to 3:30 PM
  Virtual – Zoom
• Wednesday, April 14, 2027
  2:00 PM to 3:30 PM
  Virtual – Zoom

2025-2030 Strategic Plan
Proposed Draft

2025 External Quality Assessment

• External quality assessment
• Governance structure
• Strategic plan
• Communication tools
• Policies and procedures

Five Years, Four Strategies, 18 Goals

Ethics & Professionalism

• Public internet
• Employee intranet
• Annual disclosures
• Knighton Award submissions

Governance

• County Code
• Oversight Committee composition
• Charters
• Budgetary authority
• Signing authority

Management

• Audit resources
• Assessments
• Performance metrics
• Strategic plan
• Quality assessment

Performance

• Policies and procedures
• Templates
• Recommendation dashboard
• Expanded audit reporting communications

Recommend approval of strategic plan

• April–June 2026
  Solicit Oversight Committee feedback
• June 24, 2026
  Oversight Committee approval of 2025–2030 Strategic Plan

Thank you

Office of County Internal Audit: 2026-2030 Strategic Plan

April 2026
Report by the Clackamas County
Office of County Internal Audit

Jodi Cochran, CPA, CIA, CGMA,
CRMA County Internal Auditor

Kathy Yeung, CPA, CIA
Senior Internal Auditor

Purpose

We strengthen the county's ability to serve the public by providing independent assessment, assurance and advice to the board of county commissioners, management and the public.

Mission
The mission of the Office of County Internal Audit (Office) is to enhance and protect Clackamas County's ability to serve by providing risk-based and objective assurance, advice, and insight. 

Vision 
The Office provides assurance, advisory, and investigative services to the public, employees and departments of Clackamas County so they can feel confident that the public's interests are protected and can engage with an accountable, high performing, and transparent local government. Strategy The Office uses a strategic framework with four areas of focus: 

• Ethics & Professionalism
• Governance 
• Management 
• Performance

Professional standards
The Office of County Internal Audit governs itself by adherence to The Institute of Internal Auditors’ Global Internal Audit Standards. Audit functions are independently evaluated to assess conformance with professional standards.

Authority
The Office is established under the authority provided in County Code Chapter 2.15 County Internal Auditor. The county internal auditor reports functionally to the Clackamas County Internal Audit Oversight Committee and administratively through the Internal Audit Administrator.

Strategy

Ethics & Professionalism

We instill trust in the Office of County Internal Audit and provide the basis for reliance on our work and judgment by behaving in the highest ethical and professional manner.

Goals

• Public internet
  Update website content, appearance, and ease of use to enhance accessibility and build trust.
• Employee intranet
  Develop an intranet site to increase awareness and enhance access to audit services.
• Annual disclosures
  Document the presence or affirm the absence of objectivity impairments or conflicts of interest on an annual basis to demonstrate transparency and accountability.
• Knighton Award submission
  Submit audit reports for Association of Local Government Auditors' Knighton Award consideration to solicit peer feedback and highlight Clackamas County accomplishments.

Management

We establish goals, measure performance and communicate results to achieve long-term success.

Goals

• Audit resources
  Create an internship program and add a principal internal auditor position to enhance audit resource availability, retention, and succession planning.
• Assessments
  Assess the county’s governance, risk management, and control activities biennially to inform leadership of risk and opportunities.
• Performance metrics
  Collect and analyze performance data to improve efficiency and effectiveness
  of the Office of County Internal Audit.
• Strategic plan
  Create and implement the 2026-2030 strategic plan to demonstrate transparency and accountability.
• Quality assessment
  Conduct a self-assessment and obtain an external quality assessment review to comply with Global Internal Audit Standards.

Performance

Through a continuous improvement lens, we plan, execute and communicate results of our services using documented and standardized processes.

Goals

• Policies and procedures
  Address gaps in internal audit policies and procedures to reinforce existing practices and align with industry standards.
• Templates
  Update audit workpaper templates to demonstrate compliance with newly revised Global Internal Audit Standards.
• Recommendations dashboard
  Develop an audit recommendations dashboard to increase efficiency of monitoring activities, enhance accessibility, and promote transparency.
• Expanded audit reporting communications
  Leverage technology and provide audit reports in audio/video format to increase accessibility.

Accountability

To ensure optimal implementation and success, we hold ourselves accountable to the strategic plan. Accountability is demonstrated through quarterly, annual, and external monitoring, including the county's Performance Clackamas plan.

Quarterly
The quality assurance and improvement program is reviewed at the Internal Audit Oversight Committee meetings. This program highlights the status of short-term goals (one to three years).

Annually
The five-year strategic plan is reviewed annually at the Internal Audit Oversight Committee meeting. The progress and status of all goals within the four strategies are shared.

Externally
In five years, an independent assessment team will conduct an external quality assessment review to evaluate compliance with professional standards. Results will support the development of the next strategic plan. 

Performance Clackamas
The Office participates in Performance Clackamas, the county's strategic plan and process focused on measurable goals. Performance metrics are reviewed and reported annually.

About the Office of County Internal Audit

Our team
Jodi Cochran, CPA, CIA, CGMA, CRMA, County Internal Auditor
Kathy Yeung, CPA, CIA, Senior Internal Auditor

Contact us
Office of County Internal Audit
2051 Kaen Road #460
Oregon City, OR 97045
Office: 503-742-5983
ocia@clackamas.us 

Draft Internal Audit Oversight Committee Charter and Bylaws

MISSION

Through oversight of the Office of County Internal Audit (Office) activities, strengthen Clackamas County’s ability to serve and enrich our community by promoting independent, risk-based and objective assurance, advice, and insight.

VISION

By safeguarding its independence, the Office’s assurance, advisory and investigative services:

• enhance the confidence of Clackamas County residents, employees, and departments that the public’s interests are protected
• encourage engagement with an accountable, high performing and transparent local government.

PURPOSE

The Clackamas County Internal Audit Oversight Committee (Oversight Committee) ensures the Office of County Internal Audit’s independence and ability to assess:

• Efficient and effective use of public resources
• Financial and operational reporting
• Information and asset security
• Compliance with laws, regulations, policies and ethics

The Oversight Committee ensures the Office is independent and acts to promote its integrity and effectiveness. Independence is freedom from conditions that impair the Office’s ability to carry out its responsibilities in an unbiased manner.

The Oversight Committee supports the Office in its efforts to bring a systematic, disciplined approach to evaluating and improving the county’s governance, risk management, and control processes.

AUTHORITY

The Oversight Committee is established in County Code Chapter 2.15:County Internal Auditor.

COMPOSITION

The Oversight Committee is comprised of five members - the Board of County Commissioners Chair, a commissioner selected by the Board of County Commissioners, and three members of the community appointed by the Internal Audit Administrator from a list of nominees submitted by the County Internal Auditor. The Oversight Committee membership represents a base of expertise in some or all the following areas: local government, finance, risk, information security, equity and process improvement.

Community members must be Clackamas County residents and avoid conflicts of interest, or the appearance of such conflicts, that would impair independence. Should a conflict arise, members will advise the County Internal Auditor. Community members may serve consecutive two-year terms. The Oversight Committee chair is elected by the Committee from one of the community members.

MEETINGS AND RECORDS

Oversight Committee meetings adhere to Oregon Public Meeting Law. The Oversight Committee determines the frequency of its meetings, meeting at least three times annually. The Oversight Committee may invite guests to provide pertinent information. The Internal Audit Administrator, County Administrator and County Counsel are encouraged to attend and participate in Committee discussions. Meeting agendas and materials are provided in advance. Minutes are documented. A quorum is required for all Oversight Committee actions requiring a vote. The quorum consists of three Oversight Committee members.

The Oversight Committee adheres to Oregon Public Records Law. The Office provides staff resources to the Oversight Committee and maintains all Oversight Committee permanent records. Distribution and retention of all Office and Oversight Committee records is administered through the Office. The Oversight Committee safeguards and maintains the security of unpublished information from unauthorized access.

All public records requests are administered through the Office.

RESPONSIBILITIES

The Oversight Committee has the responsibility to:

Office of County Internal Audit

• Review and approve the Office charter.
• Ensure there are no unjustified restrictions or limitations on the County Internal Auditor.
• Ensure the Office is free from interference when determining scope, performing activities and communicating results.
• Assess the adequacy and effectiveness of the Office activities, resources, organizational structure, including compliance with Global Internal Audit Standards.
• Provide input in the appointment or dismissal of the County Internal Auditor prior to county action.
• Review and approve the internal audit risk-based audit plan and all major changes to the plan.

Internal Control and Compliance

• Receive and review significant internal audit and external review communications, reports, and management letters, as well as management responses and follow-up activities.
• Consider the Office’s assessment of the effectiveness of the county’s governance processes.
• Consider the Office’s assessment of the effectiveness of the county’s risk management processes.
• Consider the Office’s assessment of the effectiveness of the county’s control processes, including information security and fraud detection.
• Consider the Office’s assessment of the effectiveness of the county’s system for monitoring law, rule and policy compliance.
• Review reports summarizing investigations of potentially fraudulent activities. Reporting Responsibilities
• Ensure an open avenue of communication between the Board of County Commissioners, County Administrator, county departments, Office of County Internal Audit, and external auditors.
• Regularly, in coordination with the County Internal Auditor, present to the Board of County Commissioners results of Oversight Committee and County Internal Audit activities.

Other Responsibilities

• Assess the adequacy of the Oversight Committee charter and bylaws at least annually and approve revisions.
• Confirm annually the responsibilities outlined in this charter have been carried out.

COUNTY MANAGEMENT RESPONSIBILITIES

County management is responsible for the county’s governance, risk management, and control processes. The Oversight Committee’s commitment to the review and assessment of these processes does not relieve management of its responsibilities.

Approved this 24th day of June 2026, by Internal Audit Oversight Committee vote.

Draft Office of County Internal Audit Charter

MISSION

Enhance and protect the county’s ability to serve the public by providing risk-based and objective assurance, advice, and insight.

VISION

The Office of County Internal Audit’s (Office’s) assurance, advisory, and investigative services:

• enhance the confidence of Clackamas County residents, employees and departments that the public’s interests are protected
• encourage engagement with an accountable, high performing, and transparent local government

PURPOSE

Through independent and objective assurance, advisory and investigative services, the Office strengthens the county’s ability to serve the public.

The Office uses a systematic, disciplined approach to evaluate the county’s governance, risk management, and control processes, by assessing:

• Efficient and effective use of public resources
• Financial and operational reporting
• Information and asset security
• Compliance with laws, regulations, policies and ethics

AUTHORITY

The Office is established in County Code Chapter 2.15: County Internal Auditor.

The Office is authorized to examine and evaluate the operations and activities of any office, department, political subdivision, or organization which receives appropriations from the Board of County Commissioners, or for which governing bodies are, or are appointed by, the Board of County Commissioners.

The Office is granted full, free and unrestricted timely access to all activities, information, records, property and personnel required to provide assurance, advisory or investigative services. The Office has the authority to request reasonable assistance from county personnel in acquiring records, documents and files, as well as inspection and entry privileges to all assets owned, leased or borrowed by the County. Office internal auditors are held strictly accountable for the safeguard of all materials and the confidentiality of information, when appropriate.

PROFESSIONALISM

The Office governs itself by adherence to The Institute of Internal Auditors’ Global Internal Audit Standards (Standards). The Standards constitute principles of the fundamental requirements for the professional practice of internal auditing and for evaluating the effectiveness of the Office’s performance. The County Internal Auditor annually affirms to the Oversight Committee compliance with the Global Internal Audit Standards.

INDEPENDENCE AND OBJECTIVITY

The County Internal Auditor is the Chief Audit Executive. The County Internal Auditor reports functionally to the Internal Audit Oversight Committee (Oversight Committee) and administratively to the Internal Audit Administrator.

• Functional oversight responsibilities of the Oversight Committee include ensuring the independence of the Office, approving the risk-based audit plan, reviewing audit reports and recommendations, and providing input regarding the appointment or removal of the County Internal Auditor.
• Administrative responsibilities of the Internal Audit Administrator include facilitating Office budgetary processes and administering personnel activities supporting the County Internal Auditor position, including the appointment and removal of the County Internal Auditor with input from the Oversight Committee.

The Office remains free from conditions that may impair the ability of the Office to carry out internal audit responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing and communication form or content.

The Office does not perform, or have authority over, operational responsibilities or non-audit functions or duties subject to periodic internal audit assessments, as this may compromise its independence or objectivity.

Office internal auditors exhibit the highest level of professional objectivity in gathering, evaluating and communicating information about the activity or process being assessed. Office internal auditors make a balanced assessment of all the relevant circumstances and are not unduly influenced by their own interests or by others in forming judgments. Office internal auditors have impartial, unbiased attitudes and avoid any conflicts of interest. Any potential impairment or conflict of interest will be documented within audit files and disclosed to the Oversight Committee.

The County Internal Auditor annually affirms to the Oversight Committee the organizational independence of the internal audit function and the professional objectivity of the internal auditors.

SCOPE OF WORK AND RESPONSIBILITIES

The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the county’s governance, risk management and control process, as well as the quality of performance in carrying out assigned responsibilities to achieve its goals and objectives. The Office provides three types of services – assurance, advisory and investigative.

Assurance services are services through which internal auditors perform objective assessments and provide assurance statements. These statements are intended to increase the level of stakeholders’ confidence about the county’s governance, risk management, and control processes over an issue, condition, subject matter, or activity under review when compared to established criteria. Examples of assurance services include compliance, financial, operational or performance, and technology engagements. The Office may provide limited or reasonable assurance, depending on the nature, timing, and extent of procedures performed.

Advisory services are consultative and include service activities such as counsel, advice, facilitation, training and participation in standing or temporary management committees or project teams. The objective of advisory services is to add value in the development, modification or validation of county processes, procedures and controls to minimize risk, achieve objectives and foster continuous improvement. Advisory services do not provide assurance or assume management responsibilities.

Investigative services are independent special reviews and investigations addressing allegations of fraud, waste, abuse, or misuse of county assets and resources. The Office develops, implements, and manages the county fraud, waste, and abuse hotline program.

QUALITY ASSURANCE AND IMPROVEMENT PROGRAM

The Office maintains a quality assurance and improvement program. The program is an evaluation tool that ensures the internal audit function conforms with the Global Internal Audit Standards, achieves performance objectives, and pursues continuous improvement. The County Internal Auditor reviews program results with the Oversight Committee at least annually.

The County Internal Auditor reviews and assesses the adequacy of this charter with the Oversight Committee at least annually. Revisions are submitted to the Oversight Committee for approval. All approved revisions supersede prior Office of County Internal Audit charters.

COUNTY MANAGEMENT RESPONSIBILITIES

County management is responsible for the county’s governance, risk management, and control processes. The performance of assurance, advisory and investigative services by the Office does not relieve management of any responsibilities.

Approved as revised this 24th day of June 2026 by Internal Audit Oversight Committee vote, and in collaboration with the Internal Audit Administrator and the County Internal Auditor.

Proposed FY27 Audit Plan

FY27 Audit Plan presentation topics

• Roles and responsibilities
• Office of County Internal Audit
• Oversight Committee
• Risk assessment results
• Proposed FY27 engagement activity
• Engagement evaluation criteria
• Recommended Committee action

Office of County Internal Audit role and responsibilities

• Prepare the audit plan
• Execute the audit plan

Internal Audit Oversight Committee role and responsibilities

• Review the audit plan and provide feedback, considering:
  • independence
  • objectivity
  • resources
  • criteria
• Adopt the audit plan
• Monitor progress of audit plan execution

Review of risk assessment results

• Offices, departments and districts* with highest risk scores
• County Administration
• County Clerk’s Office
• District Attorney’s Office
• Transportation and Development
• Finance
• Health, Housing and Human Services 
• Human Resources
• North Clackamas Parks and Recreation District
• Sherrif’s Office
• Water Environment Services

Inherent risk vs Residual risk

Audit engagements assess residual risk

• What controls (best practices, industry standards) should be in place? 
• How much risk are we willing to accept?

Audit engagements assess internal controls

• Are the controls working the way we expect?
• How do we know?

Proposed FY27 Engagement Activity

Activity

• Complete three FY26-approved audits already in progress*
• Start two audits
• Five county departments
• Public safety; federal and state legal compliance; governance and stewardship of public funds

Engagements

• Special Districts: Governance and intergovernmental agreements*
• Finance: Travel and training expenses*
• Juvenile Department: Youth services*
• District Attorney’s Office: Deflection program
• Finance: Financial condition analysis

Audit engagement evaluation criteria

The engagement:

• Is risk-based – Engagements represent high or moderate risk areas based on the annual risk assessment 
• Supports County Strategic Priorities – Engagement supports one of the five county strategic priorities, one of 10 Board of County Commissioners goals, and/or a department’s mission 
• Emphasizes public services and community impact – Engagement supports assessment of the availability, quality and equitable delivery of public services 
• Considers comprehensive coverage of county services and operations – Engagement supports long-term goal of County Internal Audit interaction, assessment and impact within all county departments and divisions 
• Optimizes County Internal Audit resources – County Internal Audit resources are adequate to conduct the engagement in a timely manner. County Internal Audit possesses the skills, knowledge, independence and objectivity to conduct the engagement. 

Proposed FY27 engagement – Special Districts: Governance and intergovernmental agreements

• Risk score: 537 (High)
• Public trust in good government
• Direct public service and community impact; Moderate inherent risks
• Broad impact on multiple districts and county processes
• Staff qualified to apply professional analytics; No resource barriers

Proposed FY27 engagement – Finance: Travel and training expenses

• Risk score: 639 (High)
• Public trust in good government
• Indirect public service impact; Moderate inherent risks 
• Broad impact on multiple district and county processes; Not previously audited
• Staff qualified to apply professional analytics; No resource barriers

Proposed FY27 engagement – Juvenile Department: Youth Services

• Risk score: 381 (Moderate)
• Safe, secure and livable communities; Public trust in good government
• Direct public service and community impact; High inherent risks 
• Potential broad impact on multiple districts and county processes; Not previously audited
• Staff qualified to apply professional analytics; No resource barriers

Proposed FY27 engagement – District Attorney’s Office: Deflection program

• Risk score: 661 (High)
• Safe, secure and livable communities; Public trust in good government
• Direct public service and community impact; High inherent risks 
• Not previously audited
• Staff qualified to apply professional analytics; No resource barriers

Proposed FY27 engagement – Finance: Financial condition analysis

• Risk score: 639 (High)
• Public trust in good government
• Indirect public service impact; direct assessment of county fiscal stability; high inherent risks (economic uncertainties)
• Cyclical review; Most recent fiscal year reviews: 2024, 2022, 2019, 2017
• Staff qualified to apply professional analytics; Internship program alleviating resource barriers

Recommended Internal Audit Oversight Committee action

Adopt updated Audit Plan to include two new audit engagements as proposed

Proposed FY27 Audit Engagements

• Special Districts: Governance and intergovernmental agreements*
• Finance: Travel and training expenses*
• Juvenile Department: Youth services*
• District Attorney’s Office: Deflection program
• Finance: Financial condition analysis

FY27 Audit Plan

August 2026

Proposed by the Clackamas County Office of County Internal Audit with general time estimates

Assurance and advisory engagements (2300 hours)

• Special Districts – Governance and Intergovernmental Agreements¹
• Finance – Travel and Training Expenses¹
• Juvenile Department – Contracted Youth Services¹
• District Attorney – Deflection program¹
• Finance – Financial condition analysis
• Annual audit recommendation monitoring

Advisory activities² (1300 hours)

• Good Government Hotline administration and investigative services
• Annual Risk Assessment
• Governance, Risk Management and Control Processes Assessment
• Management requests (including external audit coordination/facilitation)
• Meetings and team participation

Administrative activities (1300 hours)

• Administration, Training & Quality Assessment and Improvement Program, Implementation of 2025-2030 Strategic Plan
• Reciprocal Quality Assurance Review – PERS October / November 2026
• 2026 PNW ALGA Conference host – October 2026
• 2026 Oregon County and Local Government Auditors AOC meeting host – November 2026

Total planned hours – 4900 

The Office of County Internal Audit is comprised of the County Internal Auditor and one Senior Internal Auditor. The County Internal Auditor reports functionally to the Internal Audit Oversight Committee, responsible for reviewing proposed County Internal Audit projects and jointly establishing priorities for the strategic audit plan. The County Internal Auditor prepares this report for the committee’s review and adoption. 

A total of 4,160 audit hours is available for this plan. The audit plan informs a rolling audit cycle. Thus, estimated planned hours exceed available hours. Not all proposed engagements are expected to be completed in one plan period. Engagements started in one fiscal year will be completed in the following fiscal year. The prioritization of approved engagements not started in FY27 will be considered in the FY28 audit planning.

¹ Engagement adopted in FY26 Audit Plan

² Includes holiday, vacation; sick leave; training; Internal Audit Oversight Committee coordination and training; annual reporting; engagement with national and PNW ALGA, IIA Portland chapter of the Institute of Internal Auditors, and statewide CAE community; and staff management and administration of the audit function. (Estimated at 30% of available time, including 796 earned leave hours and 80 required training hours.) 

FY25-26 Audit Plan

Assurance & Advisory Engagements – Status update Aug. 5, 2026

Quality Assurance and Improvement Plan

Status update Aug. 5, 2026

** Table to be revised to reflect new Global Internal Audit Standards