Audit Finds State Agencies Having Trouble Complying with Internal Audit Requirements

Agencies and university systems required to perform internal audits face challenges in complying with the state law, the Legislative Auditor said in a report released today. Performance auditors examined agency compliance in the wake of legislation passed in 2015 that required all state agencies and postsecondary management boards with appropriations of $30 million or more to have an internal audit function that adheres to professional standards. Before that, the internal audit operation did not have to meet professional standards.

Forty-one state agencies and university systems meet the $30 million threshold. Some of them share internal auditors. As a result only 35 separate internal audit functions were identified.

Auditors found that state law does not specify the reporting structure for internal audits or require the use of an internal audit committee. The international Institute of Internal Auditors recommends that internal auditors have dual reporting relationships by reporting administratively to the highest level of authority and functionally to an audit committee. Performance auditors found that 20 of the 35 internal auditors did not report to an audit committee, which would help provide independent oversight over the internal audit function.

The 35 internal auditors surveyed for the report cited limited budgets as their greatest challenge. Performance auditors found that the internal audit budgets for fiscal year 2017 ranged from $60,000 to $1.8 million and that half of the internal audit operations were staffed with just one auditor.

In addition, auditors found that 26 of the internal audit operations did not have a current quality assurance review as required by professional standards and state law. These reviews can be expensive and time-consuming, but without them, internal auditors cannot assert that their audits follow standards.

Performance auditors also found that helping management better understand the role and value of internal audits could result in more effective and risk-based audits. The survey results showed that 15 of the 35 respondents were required to perform non-internal audit duties, and 11 reported that mandated audits or management requests hindered their ability to produce risk-based audits.