Internal Audit Charter

It is the policy of Clackamas County to maintain an internal audit department as a means of providing the Board of County Commissioners, the County Administrator and all levels of management with information to assist in the control of operations and in evaluating the overall control over assets and the effectiveness of the system of internal control in achieving its broad objectives.

This charter establishes the general authority and responsibility of the Internal Audit Department and supersedes any other Internal Audit Charter Policy.

Authority

The internal audit function shall have the authority to conduct financial, compliance, operational, performance, and information systems audits for all departments, offices, activities, and programs under the control of the County. Additionally, the internal audit function shall have the authority to perform special reviews and investigate allegations of misuse of County assets and resources.

To properly carry out their responsibilities, internal audit personnel are authorized to have:

Full, free, and unrestricted access to County functions, activities, operations, records, data files, computer programs, property and personnel. In addition, authority is granted to Internal Audit staff to request reasonable assistance from appropriate County personnel in acquiring requested records, documents and files, as well as inspection and entry privileges to all assets owned, leased, or borrowed by the County. It is expected that the Internal Audit staff will exercise discretion in the review of records to ensure the confidentiality of all matters that come to their attention.

Scope of Internal Audit Activities

Internal Audit coverage will encompass, as deemed appropriate by the Internal Audit Director, independent reviews and evaluations of any and all management operations and activities to appraise:

• Measures taken to safeguard assets, including tests of existence and ownership as appropriate.
• The reliability, consistency, and integrity of financial and operating information.
• Compliance with policies, plans, standards, laws, and regulations that could have a significant impact on operations.
• Economy and efficiency in the use of resources.
• Effectiveness in the accomplishment of the mission, objectives, and goals established for the County's operations and projects.

Limitation of Authority and Responsibility

In performing their functions, the Internal Audit Director and Internal Audit Department staff have neither direct authority over, nor responsibility for, any of the activities reviewed. The Internal Audit Department will not develop and install procedures, prepare records, make management decisions, or engage in any other activity that could be reasonably construed to compromise their independence. However, in connection with the complementary objectives of this audit function, the Internal Audit Department will recommend policies and procedures for approval and implementation by appropriate management. Internal audit review and appraisal do not in any way substitute for other activities or relieve other persons in the County of the responsibilities assigned to them.

The Internal Audit Director is appointed by the County Administrator and is granted powers by the Board of County Commissioners. If the Internal Audit Director is not an elected official, they will report to and be accountable to the County Administrator for day to day operations. The Internal Audit Director will also be accountable to the Internal Audit Oversight Committee (IAOC). The IAOC will be comprised of the County Administrator, County Treasurer, County Counsel and a Board of County Commissioner member of the Clackamas County Audit Committee.

The Internal Audit Director is responsible for properly managing the department so that (1) internal audit work fulfills the purposes and responsibilities established herein; (2) resources are efficiently and effectively employed; and (3) internal audit work conforms with all applicable standards.

The Internal Audit Director will report in writing on all internal audits and reviews conducted and will attend the IAOC meetings on a regular basis to report on significant recommendations and the operations of the audit services function.

Generally, the Internal Audit Director will notify the department director or manager ("auditee") that a review is scheduled. This written notification should inform the auditee of when the audit is scheduled, who will be performing the internal audit, and why the internal audit has been planned (regularly scheduled, management or external auditor request, etc.). The notification should also include the objectives and scope of the audit; the expected start date and planned duration of the internal audit; and advance preparation needs.

The director or manager of the department under audit is responsible for:

• Ensuring that a spirit of cooperation prevails throughout the course of the examination.
• Ensuring corrective action is taken if inadequacies are identified in the written internal audit reports.
• Informing the Internal Audit Director of any actual or suspected fraud or illegal acts for independent review.

The IAOC has oversight responsibilities of the internal audit function and activities, including review and approval of the annual internal audit plan and any revisions thereto. The IAOC shall work to ensure maximum coordination between the work of the Internal Audit Director and the needs of the County Administrator and the County Commissioners.

Annual Internal Audit Plan

The Internal Audit Director is required to publish an annual internal audit plan to the IAOC for approval, and perform the systems audits contained within the plan. Unforeseen audit requirements and management requests for investigations into matters of fraud and compliance may create the need for changes in both internal audit programs and the overall plans; therefore, appropriate flexibility should be incorporated into the annual plan. The IAOC must approve significant deviations from the objectives contained within the annual internal audit plan.

Communication of Findings

Upon the completion of audit fieldwork, the Internal Audit Director should discuss the proposed audit findings and recommendations with the auditee at a closing conference. Internal Audit will prepare a report draft with their proposed findings and recommendations along with a space for management's responses. The draft is then forwarded to the appropriate manager to respond and outline corrective actions, if any to be taken. The responses are generally due two (2) weeks after the receipt of the draft report. The auditee's response will include comments, action items, and target dates and will be incorporated in the final report. If a timely response is not received, the County Administrator will be contacted for assistance in resolving the matter.

The final internal audit report will be submitted by the Internal Audit Director to the IAOC for review. Once reviewed the final report will be submitted to the appropriate levels of County management and made available for public review. Any changes requested by the IAOC will be noted and made part of the public record. If relevant, audit findings will also be summarized and reported to the Clackamas County Audit Committee and the Audit Manager.

Subsequent to the issuance of the final report, the Internal Audit Department will schedule a follow up review to ensure that needed actions based on the audit were actually taken. The director or manager of the department is responsible for seeing that corrective action on recommendations are made or deficient conditions reported by Internal Audit are planned and taken. If the proper corrective action is not taken, the Internal Audit Director is responsible for presenting this information to the IAOC.

Independence is essential for effective operation of the internal audit function. It is the policy of the County, therefore, that all internal audit activities shall remain free of influence by any organizational elements. This shall include such matters as scope of audit programs, the frequency and timing of audits, and the content of audit reports. Furthermore, the Internal Audit staff has a responsibility to conduct themselves so that their good faith and integrity are not open to question. Standards of professional behavior are based upon the Code of Ethics issued by the Institute of Internal Auditors.

In general the cost of the internal audit function will be born by the County as a whole. If a department requests a specific engagement, a negotiated fee for the service may be assessed. This funding structure will be evaluated by the IAOC and Board of County Commissioners on a regular basis and is subject to change.

The Internal Audit Director is responsible for developing and maintaining a quality assurance and improvement program. The program should comply with the IIA's International Standards for the Professional Practice of Internal Auditing.

This program should include internal and external reviews which will assess internal audit operations and share an objective perspective of the Internal Audit Department's compliance with professional standards and a comparison to "best practices" of other similar audit organizations. An external assessment should be performed at least every five years in order to maintain conformity with the IIA Standards. The cost of the quality assurance and improvement program shall be a part of the Internal Audit Department's budget.

In an effort to continually improve the internal audit function, Internal Audit staff shall be encouraged to attend continuing education courses and maintain membership in and attend meetings of local, state, and national organizations that serve to promote the modern practice of internal auditing.

Amendments of this charter are subject to the approval of the Internal Audit Oversight Committee, with recommendation to and approval by the Board of County Commissioners.