DEPARTMENT OF EDUCATION

OFFICE OF INSPECTOR GENERAL

MANAGEMENT REVIEW

Quality Assessment Review of the Internal Audit Activity

Report Number
07/08-02 MR

June 9, 2008
Background
Section 20.055, Florida Statutes, (F.S.), requires that each State agency establish an Office of Inspector General (OIG).  The Statute also requires that internal audits be conducted in accordance with the current International Standards for the Professional Practice of Internal Auditing or, where appropriate, Generally Accepted Government Auditing Standards.  The mission of the OIG is the promotion of integrity, economy, efficiency, and effectiveness of Departmental programs and activities.

The Institute of Internal Auditors’ (IIA) International Standards for the Professional Practice of Internal Auditing (Standards) requires internal audit activities to maintain a quality assurance and improvement program to include internal self-assessments.  Standard 1311 specifies that internal assessments include periodic reviews performed through self-assessment or by other persons within the organization with knowledge of internal audit practices and Standards.  To meet this requirement and identify opportunities for improvement, the Department of Education (DOE), OIG initiated this Quality Assessment Review (QAR) of the internal audit activity. 

The OIG completed eighteen engagements during the period reviewed.  This QAR evaluated three of these engagements and one follow-up, including audit reports, management reviews, and the related working papers for compliance with applicable professional auditing standards. For engagements completed during the review period, the internal audit activity had elected to follow the Standards.  Compliance with specific provisions of Section 20.055, F.S., governing the operation of the OIG and internal audit activities was also reviewed. 

Scope and Objectives
The scope of the review included audit activity during the period of February 1, 2005, through January 31, 2008.  The objectives of this review were to: 
•	Perform an internal assessment of the quality assurance program for the Department’s internal audit activity in compliance with Standard 1300, International Standards for the Professional Practice of Internal Auditing; and 
•	To determine timeliness of the Department’s responses to external audits and follow-up responses to these audits.  

Methodology
We used the methodology presented in The Institute of Internal Auditors’ Quality Assessment Manual, Fourth Edition as a guide during for this review.  To achieve the objectives, the auditor: 
•	Researched and reviewed applicable statutes, rules, manuals, and procedures; 
•	Interviewed appropriate staff; 
•	Reviewed audit work papers; and 
•	Evaluated the timeliness of responses to external audit reports. 

The quality assurance program for the Department’s internal audit activity provided reasonable assurance of conformance to applicable professional auditing standards.  Also, the OIG generally complied with provisions of Section 20.055, F.S.  The internal audit activity can improve its work processes and its compliance with the Standards and Section 20.055, F.S., in the areas discussed below.

Both the Standards and Section 20.055(5)(h), F.S., require the preparation of a risk assessment.  The Standards state that the internal audit activity’s plan of engagements should be based on a risk assessment, undertaken at least annually.  As indicated in the Standards, the risk assessment process should incorporate information from a variety of sources, such as management interviews, opinions of internal auditors, internal auditor reviews of prior audits, and consideration of the effectiveness of internal controls.  Section 20.055(5)(h), F.S., requires the inspector general to develop long-term and annual audit plans based on the findings of periodic risk assessments.

As required by Section 20.055(5)(h), F.S., the OIG prepared a long-term audit plan and an annual audit plan for the 2006-07 and 2007-08 fiscal years.  These plans were developed based on the results of annual risk assessments. 

The Director of Auditing interviewed all members of senior management to solicit their views on risks facing the Department and activities where audits could add value.  Input from the internal audit and investigation staff was also solicited.  This was used along with the results of audits and investigations performed during the current and prior years to identify areas of potential weakness in the Department’s operations.  The OIG has also included time budgets for individual audits in the annual audit plans.  Areas considered for the risk assessment process included:
•	Priorities of the Board of Education; and
•	Whether a unit within the Department has been audited recently and whether prior audit findings have been satisfactorily resolved.

Comment
This risk assessment and audit plans have improved significantly since the internal audit activity was last reviewed.  The OIG is encouraged to continue improving the risk assessment and engagement planning processes by enhancing supporting documentation, and ensuring that major decisions are recorded.

Finding 1 - The Office of Inspector General did not meet the established timeframes for all of the responses to external audit reports.

Section 20.055(5)(g), F.S., provides that the inspector general must monitor the implementation of the State agency’s response to any report on the State agency issued by the Auditor General (AG) or by the Office of Program Policy Analysis and Government Accountability (OPPAGA).  No later than six months after the AG or OPPAGA publishes a report on the State agency, the inspector general shall provide a written response to the agency head on the status of corrective actions taken.  A copy of such response is to be filed with the Legislative Auditing Committee. 

Section 11.51(6), F. S., states that no later than 18 months after the release of a report from OPPAGA, the agencies that are the subject of that report must provide data and other information that describes with specificity what the agencies have done to respond to the recommendations contained in the report. 

The OIG’s timely response to AG and OPPAGA reports is frequently delayed because information is not provided by the DOE auditees as requested.  As a result, the OIG did not meet the established timeframes for 55 (33%) of the 165 external reports issued during the scope of this review.  The OIG is encouraged to continue coordination efforts with external entities to ensure appropriate communication between external auditors, the OIG, and auditees. 

Recommendation
To improve the timeliness of responses to external reports, consider the following: 
•	Send email reminders to the auditees on a weekly basis;
•	Follow–up requests with phone calls to help ensure that auditees respond in a timely manner; and
•	When response is not received by the time requested, copy a higher authority than the auditee.

Management Response
The methods recommended to improve to the timeliness of responses to external reports will be considered.  

Finding 2 - Working papers are not adequately prepared for some audits.

The Standards require engagements to be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed.  Additionally, Standard 2300 – Performing the Engagement requires the internal auditors to identify, analyze, evaluate, and record sufficient information to achieve the engagement’s objectives. 

Working papers for one audit did not include adequate documentation to evidence compliance with the current Standards and did not include sufficient documentation to evidence all testing performed.  We also noted that some procedures in the OIG Policies and Procedures Manual (PPM) were not followed, specifically:
•	A Summary of Findings was not prepared;
•	Entrance and exit conferences were not adequately documented;
•	Working papers were not prepared in the format required by the OIG;
•	The follow-up was conducted 10 months after the report was issued; and
•	Project budget hours and actual hours spent on the project were not included in the working papers.

The working papers for another engagement did not include an audit plan and a statement of independence.  These working papers also did not have sufficient documentation to support some of the conclusions reached by the auditor. 

Standard 2010 – Policies and Procedures requires that policies and procedures be established to guide the internal audit activity.  They should be consistently followed to help the internal audit activity add value, improve the organization’s operations, and provide assurance that audits are performed in conformity with the Standards.  Not following policies and procedures could result in the OIG not accomplishing the audit activity’s purpose and objectives and could compromise the reliability of audit findings. 

Recommendation
To ensure working papers adequately document audits conducted in accordance with the Standards, consider the following:
•	Document entrance and exit conferences for all audits, including dates; 
•	Document planned scope and objectives for the engagement entrance conference notes;
•	Monitor working papers during the audit to ensure that they are prepared as required by the PPM and Standards;
•	Conduct follow-ups in a timely manner;
•	Include project budget hours and actual hours in the working papers; and
•	Prepare a summary of findings for all audits. 

Management Response
We will ensure that future working papers sufficiently document audits conducted by continuing to require that audit staff comply with established policies and procedures.  More timely monitoring of working papers will be performed to verify compliance.

Finding 3– Project time recording and productivity of Internal Audit Activity can be improved.  

We reviewed the information recorded on the auditors’ monthly Timesheet Summary to evaluate their productivity, and noted the issues discussed below. 

There was a discrepancy in the number of hours recorded for two audits in FY 2005-06.  The auditor’s project timesheets for one audit recorded 907.5 hours from September 2005 to October 2006.  However, the Timesheet Summary prepared by the Administrative Assistant for FY 2005-06 does not show any hours from September 2005 though February 2006, and recorded only 338.5 hours for FY 2005-06.  For the other engagement, the Timesheet Summary shows 250 hours while the auditor’s project timesheets reflect 359 hours.  This appears to be the result of erroneously entering the hours for another project.  It is essential that time spent on each activity is properly recorded as this information is used to determine the productivity of the internal audit activity.

The review determined that direct time allocated to projects was 63.16% of total hours for FY 2005-06 and 65.26% for FY 2006-07.  This percentage was affected primarily by the number of administrative hours charged to activities.  According to the IIA Quality Assessment Manual, an efficient internal audit activity should have 75-80 percent as direct time.  As the hours charged to administrative activities increase, the total direct time allocated to engagements decreases.  The following table illustrates direct time to total hours for FYs 2005-07. 
 	FY 2005-2006 	FY 2006-2007	
Category	Hours 	Percent	Hours 	Percent	
Total available time 	6086.00	 	5872.55	 	
Less: Vacation/holidays 	769.75	12.65%	763.30	13.00%	
Sick leave	203.00	3.34%	259.75	4.42%	
Training 	290.75	4.78%	145.75	2.48%	
Other indirect	978.75	16.08%	871.50	14.84%	
Total indirect 	2242.25	36.85%	2040.30	34.74%	
Total direct time	3843.75	63.16%	3832.25	65.26%	

Recommendation
The Director of Auditing should ensure that Timesheet Summaries properly reflect the hours recorded on the auditors’ project timesheets.  The audit staff should consider what changes can be made to the amount of administrative hours charged.

Management Response
Steps will be performed to determine the reason(s) for noted discrepancies in the hours reported for the two FY 2005-06 audit assignments.  To ensure accuracy, additional care will be taken when hours from the monthly auditor project timesheets are added to the Timesheet Summaries. 

Indirect audit time during the review period included annual leave, holidays, sick leave, and training.  Holidays and leave time are employee benefits provided by the State.  Training is essential for auditors to maintain their professional proficiency, and is required for those with professional certifications.  We will continue to monitor the indirect time to ensure amounts charged are reasonable and appropriate.