Internal Auditor ReBlog- Ratings in Audit Reports: Lights or Lightning Rods?

…an audit committee chairman observed that ratings can “shine a light” and help the audit committee quickly focus on the most important findings in a report. However, while ratings may be a “light” for some, they are ultimately a “lightning rod” for others.

Ratings can be a powerful tool, but if management and the audit committee place undue emphasis on them, they tend to have a polarizing effect on line and operating managers whose performance ends up being summarized in a single word: “unsatisfactory.”

Even the most useful tools have their limitations. In this post, IIA CEO Richard Chambers ponders the benefits and drawbacks of the use of ratings systems in internal audits. Read more here.

Accountability and Media Featured

Internal Auditor Repost: Champions of trust

The most effective internal auditors are those with enough fortitude to blow the whistle before trouble ensues. They see troubling issues in the formation stage, raise a concern, and take a stand to ensure things are done right.

But, as I discovered years ago, there has to be a high degree of trust between internal auditors and those whom they are cautioning about pending wrongdoing or calamity. Without trust as a basis for engagement, the conversation can become awkward or even polarizing.

Ethics is an area that plays a significant role in my view of outstanding internal audit performance; so much so that I decided to feature ethical resilience as my first area of focus. I’ve been known to characterize ethics as “table stakes” for those wishing to engage in internal auditing. It’s a strong statement, but I stand by it. Internal auditors can’t accomplish their mission without a diligent, unceasing commitment to ethical behavior.

Richard Chambers outlines an auditor’s need to demonstrate and commit to ethical behavior in this post.

A commitment to ethical behaviors means committing to integrity, honesty, and trustworthiness. Auditors can be flexible around the scope of work done, are willing to engage in continuous learning and professional improvement, but must be able to support, stand behind, and be accountable for the work that they do. At times, that may require a degree of courage. But we as auditors must behave ethically if we are to be trusted, and we must ask the same of others.

Accountability and Media Featured

Talkin’ Shop With: Larry Stafford, Clark County Audit Services Manager

Join us as we talk shop with our neighbor to the North and former OAD performance auditor, Larry Stafford.

About Clark County’s Audit Services

clarkcountylogo

Per county code, internal audit is an independent appraisal activity for the review of operations within the county. The objective is to assist management in the effective discharge of their duties, and to promote efficiency and economy consistent with the public interest.

Clark County government is comprised of several separately elected officials, including the County Auditor.

The Audit Services Department conducts performance audits, internal control reviews, and provides other services to county management. Performance audits are objective and systematic reviews of program quality and the results achieved. Internal control reviews include analytical reviews, interviews, observations, and tests with the intent of evaluating the security of county assets and the accuracy/reliability of financial reports.

The Clark County Auditor

The Clark County Auditor is elected to a four-year term and our current Clark County Auditor is Greg Kimsey. In addition to being the county’s chief financial officer, the auditor also oversees several essential county services: Audits, Auto Licensing, Elections, Marriage Licensing, Financial Services, and Recording. Additionally, the Auditor works with other elected officials, various state agencies, and the state legislature regarding issues that affect these services.

ft-vancouver-clark-county-historical-musuem

Fort Vancouver (image from Clark County Historical Museum)

Working with an elected auditor is interesting because they can bring a different perspective and things to consider. We do debriefs with the auditor throughout our audits, and at the end of the Scoping, Planning, and Fieldwork phases.

Can you describe your role as Audit Services Manager?

stafford

As the Audit Services Manager for Clark County, I serve as the principle auditor and am responsible for the quality of the Audit Services team (2016 Peer review). This includes reviewing audit work and administrative responsibilities such as developing and maintaining policies and procedures, hiring staff, performing the annual quality assessment, and coordinating peer reviews.  I also serve as a liaison between County departments and external auditors, like those from the Washington State Auditor’s office.

When I left OAD, Gary Blackmer, who was the director at the time, told me that I would have to “live with my audits” at the county. He was right. At the state, we would audit an agency and leave. But at the county we see the people we audit every day. We still report to a separately elected Auditor and so we are external to those that we audit, yet we are still internal to county government. We have to build relationships while always being aware of our independence.

What got you into performance auditing?

Luck! I spent ten years in the automation/ engineering field. That was mostly robotics-related work including electrical design, project management, and programming. I also spent some time in the financial services industry.

I wasn’t happy with my work-life balance, so I went to graduate school and earned my MBA as a path to a new career. I attended a job fair with a classmate who went to speak with the Oregon Audits Division about financial auditing. At the booth they also told me about this interesting and challenging field called performance auditing. I’ve always been driven to learn new things and this sounded like just the right fit. I was fortunate to get a position with OAD and to work with some very good auditors.

Larry’s take on performance auditing

One of the most important things I learned at OAD was that performance auditing is about understanding the issues and finding solutions – not placing blame. Also, reporting when you find things are happening the right way is just as important as identifying problems. It provides objectivity to your report and delivers the assurance expected from an audit.

For example, the first audit I worked on at OAD examined if state agencies hired former employees as contractors.  We found some instances, but all of the required procurement processes were followed and the award decisions were appropriate. Saying that in an audit report certainly didn’t get headlines but it did provide assurance.

Working at OAD was really interesting.  I was involved in a lot of issues at different levels, auditing different agencies and topics.

Coordinating with state auditors

clarkcountyThe Washington State Auditor’s office is doing some work around accountability. As part of this work, they are reviewing the financial affairs of municipal governments, state and local laws, and contracts to assess risk and evaluate compliance, mostly looking at internal controls. What I help with is making sure there is no duplication of work, and help facilitate communication and work with Clark County staff. I also help provide context and clear up any confusion, similar to an internal auditor.

Providing training

Internal control failures are common issues identified in our audits. So each fall, we host a half-day seminar on fraud and internal controls for County managers. I’ve found this kind of training is helpful for managers who are often experts in their field but have not been exposed to management tools like the COSO framework or the fraud triangle.

The training doesn’t take a lot of our time, but there is a big pay off. When these fundamental issues are addressed, then our performance audits can focus on higher level issues. The trainings also help to build relationships and credibility, and we get good feedback from managers who attend. They’re very interested in this information and how they can apply it to improve their departments.

How do you choose your audit topics?

We complete a biannual risk assessment and create a schedule of proposed audits. This includes input from elected officials, employees, citizens of Clark County, and our auditors. This proposed schedule is presented to our Audit Oversight Committee, of which the Clark County Auditor is the chair. The committee recommends audit priorities before we finalize our schedule. The County Auditor can approve audit work on issues that emerge between biannual risk assessments.

What are some interesting audits you’ve worked on at Clark County?

An audit I did on economic development was probably the most interesting audit I’ve worked on. Economics has a lot of intertwined theories, so it’s hard to nail down criteria. We wanted tangible criteria because it doesn’t matter what’s happening if you can’t agree on how to measure things. In the end, we also adjusted our conclusions based on the more questionable evidence. This audit received an ALGA Knighton Award as a result of this approach and how we treated the evidence.

Audit of Clark County’s Job Creation- Fee Waiver Program 

“The Clark County Auditor’s Office evaluated an economic development program designed to spur job creation through waiving government fees. The audit found that the fee waiver program cost Clark County approximately $8 million in its first year in forgone revenue and was not cost effective. Objective in its treatment of evidence and sensitive to its policy implications, the audit makes two strong recommendations: 1) either discontinue the program, or 2) implement significant changes to improve the program. The audit won the exemplary award for its scope and methodology, significant impact and for its clear and concise report writing.”

fee-waiver-audit

We’re also completing a series of inventory audits that look at high-risk assets, like ammunition and fuel. These material management audits are more interesting than you’d think! We’ve found opportunities to improve operations while decreasing costs, risk, and liability.

Sheriff’s Office High Risk Equipment and Supplies Management Audit 

“This was an impactful audit that focused on internal controls of high-risk materials utilized by the Sheriff’s Office, taking into account public safety as well as accountability. Findings and conclusions directly tied to objectives. Recommendations when implemented will not only have a cost savings but will increase efficiency and enhance accountability. The report was well organized with effective use of photos and charts.”

What is your favorite part about your job?

When I was a kid, I would research different topics and learn all about them. In doing this work, I have the opportunity to that for a living. It’s also all across a wide spectrum of services — it’s very hard to get bored! My favorite part about this job, though, is getting to work with other auditors. They’re so intelligent and passionate about their work.

Auditors at Work Featured Performance Audit Regional Roundup: Talkin' Shop

Internal Auditor ReBlog: Are auditors dentists in disguise?

“I can’t wait until the next time I am audited” is something you hear about as often as “I can’t wait to go back to the dentist” Why is this the case?: 1) It takes time out of our day; 2) we might get criticized for something we already know (e.g., flossing, adequacy of procedures); and 3) it could end with painful financial, mental, and physical results. Depending on people’s past experiences, some would even say the auditors are the most dreaded people to enter their office.

But are we auditors truly so terrible as all that?

Seth Peterson, internal audit manager at the First National Bank in Sioux Falls, SD, draws out some of the ‘pain points’ that auditors can touch on- and asks how we as auditors can change an experience that can feel like pulling teeth to one that feels like a purposeful collaboration.

Read more here.

Accountability and Media Featured

Talkin’ Shop with: David Givans, Deschutes County Auditor

For nearly 15 years, David Givans has served as Deschutes County’s Internal Auditor. The Internal Audit program independently reviews, evaluates and reports on the financial condition, the accuracy of financial record keeping, compliance with applicable laws, policies, guidelines and procedures, and efficiency and effectiveness of operations. Internal audit reports are given to management and used to provide a dialog for constructive change. 

DAVID GIVANS PICTUREDavid started out his career as a bio-chemist. But, he decided it wasn’t for him, and he went back to school to pursue a career in auditing and accounting. It was through his work at the CPA firm Deloitte & Touche in Los Angeles that he was first exposed to internal auditing. David then moved to Oregon and worked with a small CPA firm doing traditional financial auditing work, business valuations, tax and transactional consulting.

Around 2001-2002, Deschutes County officials started discussing the benefits of having a performance auditor. A County Commissioner and Finance Director had been attending a PSU class taught by Drummond Kahn, current director of Audit Services at the City of Portland Auditor’s Office. Because of what they learned in the class, they were excited about the prospects of adding an internal auditor. Adding to the urgency was the discovery of an embezzlement from the County Sheriff. In 2002, the internal audit program was started through the hiring of David Givans. David is a Certified Public Accountant (CPA) and Certified Internal Auditor (CIA).

Internal reports are publicly available online. So far in 2016, reports have been released on juvenile justice, notary fees, DA transition, and others.

About the Deschutes County Audit Shop

The Internal Audit program independently reviews, evaluates and reports on the financial condition, the accuracy of financial record keeping, compliance with applicable laws, policies, guidelines and procedures, and efficiency and effectiveness of operations. Internal audit reports are given to management and used to provide a dialog for constructive change.

In 2002, Deschutes County started its internal audit program and the Board of Commissioners appointed David to provide performance audits. An Audit Committee was developed to provide independence and oversight to the position. The Audit Committee is comprised of four to six members of the public and three County officials. They identify and approve the direction of audits and meet with County departments on audit findings.

What is it like being a single person audit shop?

It’s a bit like being the chef, cook and bottle washer! I am responsible for all of it. I am particularly proud that I have been able to show that single person audit shops can comply with yellow book standards. I have been successfully peer reviewed four times.

I also advocate for small audit organizations and have interacted witMt.Bachelorh many single person audit shops over the years. I’ve found that for single person audit shops in particular, it is important to make sure the organization is set-up well. This means having strong independence and a clear charter. It is also important to have support from your committee or other budgeting authority because you are going to need training and software to be successful.

I use technology to leverage myself— ACL, AutoAudit (electronic work papers), and Excel. This helps to amp up my processing power. I use ACL on most audits to assess department performance. It’s important for auditors to adapt to new technology and to look for opportunities to use it. For example, using the apps on a smart phone or taking pictures during fieldwork.

Aside from the physical resources, making connections and receiving support from peers in other organizations is really helpful. There is so much opportunity here in Oregon to effectively share information and collaborate across levels of government in auditing. And it goes both ways—I’ve had the OAD auditors reach out to me to connect them to County staff for their audits. There are also topics that we as a state can address that are both local and state issues, such as behavioral and mental health.

How do you choose your audit topics?

There are discussions with County leadership and the Audit Committee. I also attend committee meetings and gather information on the departments, which helps me to create a matrix to assess risk. I also consider what topics are timely and relevant, along with what departments have not been audited in a while.

After weighing the factors for their relative significance, an overall risk factor is computed for each area. I also consider staffing-hours, as I typically do four to five audits a year. Each audit ranges in hours from 140 up to 400 hours and report length can vary from a couple of pages to forty pages. After consideration of the number of audit-hours (staffing level) available for the year, those departments with the greatest assessed risk are recommended to the Audit Committee for inclusion in the audit plan for the year.

There are some reoccurring themes I’ve seen come up over the years that I expect to re-visit. For example, the County is self-insured for health insurance, which means we have more risk than contracting out because we handle all the claims and have an onsite clinic and pharmacy. There have been audits on claims processing and the onsite facilities. I’ve also done several audits of the behavioral health topics, looking at client access, business processes, and ensuring compliance.

What are some recent audits you think are particularly interesting?

Well, I am pleased with the Light Fleet Management audit, which received a 2015 ALGA Knighton Award. The audit looked at opportunities to minimize our fleet. In the audit, I found the County had not established written countywide policies, procedures, and guidelines for management of vehicles. This influenced accounting, decision making and management of vehicle resources.

There is also the 2015 Sheriff’s Office Transition audit, in which I was able to see the impact pretty quickly. As a result of the recommendations, the Sheriff’s Office identified a theft by one of its captains.

The follow-up to the County Fair Food and Beverage audit will be released later this year and should be interesting. I will be looking at whether it has been cost-effective to move food and beverage operations in-house as opposed to contracting them out.

A little bird told me you are the president-elect for the Association of Local Government Auditors (ALGA). What have you been up to in that role?

I have a pretty long history with ALGA. When I first started, I reached out to colleagues such as Debbie Taylor, then Jackson County Auditor, for networking and support. Debbie happened to be a charter member of ALGA and was interested sharing her passion for the organization. I have served on the Peer Review Committee from 2004-2007, Nominating Committee 2008/2009, chaired the Survey Committee from 2011-2013, and was Treasurer from 2013-2015.

For the past year, I’ve been serving as President-Elect and my main duty has been planning the ALGA conference in Austin this May, which is actually sold out (there is a waiting list!). In May, I will become ALGA’s president for 2016-2017. You can follow ALGA on Twitter at @ALGA_Gov and there is also a LinkedIn ALGA group.

It was great talking with you! Any parting thoughts?

I feel very fortunate to have found a career that utilizes my skills, is complex and challenging and provides opportunities to contribute to change in my County. I thank Deschutes County for taking steps to assure that I can do my job effectively and in supporting this position. As a leader within ALGA, I strive to be a voice for the smaller audit shops.dc-100yrs-logo

For prior Talkin’ Shop blog posts, see Shanda Miller, Lane County’s New Performance Auditor and Drummond Kahn, Director of Audit Services at the Portland City Auditor’s Office.

Auditors at Work Featured Regional Roundup: Talkin' Shop

Internal Auditor Magazine Reblog: Shuttered by Audit Findings

A consulting group and state attorney general’s office reached very different conclusions regarding the potential misuse of Medicaid funds by several nonprofit agencies in New Mexico.

Findings from independent audits have resulted in the closure of 15 New Mexico-based nonprofit agencies that provided behavioral health services in that state, according to Nonprofit Quarterly… However, the New Mexico attorney general’s office has disposed of most of the cases and announced that it did not find a pattern of fraud in 10 nonprofits that had been part of PCG’s audits.

So what happened, and who is in the right? According to Art Stewart, two process steps crucial to the accurate completion of the audit were not followed through, which lead to the consulting group erroneously concluding that Medicaid funds were being misused.

The most telling issues arose during the later stages of the audit:

PCG (Public Consulting Group) and HSD (Human Services Division) did not share the audit’s findings with any of the 15 organizations whose Medicaid payments HSD froze. It also is unclear whether HSD did a systematic check itself to make sure claims that were flagged weren’t mistakenly identified as inappropriate. It is critical that auditors present findings to staff of audited organizations to give them an opportunity to refute findings or address misunderstandings. The damage that can be caused by a failure to do so is evident in this story.

This is a good reminder for all of us here in Audit Land to hew to the process and avoid the temptation of shortcuts. For better or (in this case) for worse, our work has real world consequences.

Want to know more? Check the article out here, or check out all that Ia Magazine has to offer here. Interested in checking out the original audit? Click here.

 

Accountability and Media Featured