 |
|
Audit Buzz Newsletter
May 2023
|
In this issue of the Audit Buzz, we summarize the status of current engagements; provide an understanding of risk in the Knowledge Hive; and celebrate Internal Audit Awareness month as well as the passing of peer review. Stay up to date with Office of Auditor General's (OAG) current and future work by subscribing to Audit Buzz.
Prior editions of Audit Buzz are archived here on OAG's website.
As always, we appreciate the cooperation and courtesies extended to our staff by Fairfax County Public Schools (FCPS) management and staff during all past, current, and future audit engagements.
Engagement and Office Updates
Current Engagement Update
- At the May 10 Audit Committee meeting, we presented the following agenda items:
- In addition to the ongoing Continuous Monitoring, we are currently conducting the IT Cybersecurity and Employee Evaluation Process audits.
Knowledge Hive
Understanding Risk?
What is Risk?
We all know the answer to this intuitively; we probably form our first understanding of risk growing up, with statements such as “Don’t run with scissors. You will put your eye out!” or “Put your coat on before you go outside. You will catch cold!”
How do auditors view risk?
Risk is defined by the Institute of Internal Auditors (IIA) as “the possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.” Would that include the events listed above? Absolutely. But so much more. What if inadequate employee training results in erroneous data being recorded in the school’s information systems? What if poor cash management controls result in several months of unreconciled bank statements? Is that risk?
What if these events have not actually happened but could happen because of the weak or non-existent controls. The vast majority of us never poked our eyes out from running with scissors either, but it could have happened. And if it did, the effect on our lives could be devastating?
Internal auditors must also take risk into account when developing the specific tasks performed in an engagement. For example, perhaps an engagement was selected because of the appearance of weak cash controls. In deciding what tasks to perform, the auditor must determine first if controls even exist. If they do not exist at all, there is significant risk that the data may be erroneous. A large number of records may need to be reviewed to come to a conclusion about the validity of the attribute being tested or the balance being confirmed. If controls exist but are thought to be weak, the auditor will need to test a sample of records in order to gauge the risk of errors in the entire record population. Based on the results of that sample, the auditor may conclude that even though the controls are weak, they appear to be working. The auditor may also decide, due to errors identified in the sample records reviewed, to enlarge the selected sample of records and then come to a conclusion regarding the record population as a whole. The goal is to gather sufficient evidence from the review of records to conclude whether the perceived risk is sufficient to impact the achievement of management’s objectives and to report such to management with appropriate recommendations.
How do OAG identify risk in your department/office?
OAG conducts an independent risk assessment on an annual basis, regarding the financial, operational and reputational risks faced by FCPS. OAG sends a risk assessment survey and collects feedback from FCPS Leadership Team, the Audit Committee, and the School Board. Based upon the risk assessment results, OAG develops its annual audit plan.
The risk assessment and annual audit plan prioritize the areas being considered for audit by evaluating the risks associated with each area. The risk factors used to assess each area include:
- The financial impact of the audit area
- The potential reputational and operational risks driven by:
- The quality of internal controls and the likelihood of errors
- The complexity of the audit area
- Turnover of key personnel and stability in management
- Inputs received from the School Board and FCPS leadership
- Relevant risks faced by other public school systems
- The frequency and results of prior audits and reviews conducted by OAG or other external agencies
- Opportunity for improvement
What to do if OAG identifies risk at your department/office?
When OAG cites your department/office for weak controls, it is not because we are looking for that ‘gotcha’ moment. Weak controls could adversely impact FCPS’ ability to reach its goals. We will discuss the risk and will work with you to develop appropriate remedial measures. The best remedial measure is to implement a control that will avoid the risk altogether. Some risks cannot be completely avoided. In those cases, a control that identifies the risk event when it occurs and minimizes its impact is the next best thing.
Don’t wait
If you are aware of any risks in your department/office, be sure to discuss with management and help to identify appropriate controls. “An ounce of prevention is worth a pound of cure!”
Did you Know?
Internal Audit Awareness Month
The month of May has been designated as the Internal Audit Awareness Month by the Institute of Internal Auditors. OAG was recognized with a proclamation for internal audit contributions to FCPS during the School Board Meeting on April 27, 2023.
OAG Peer Review
As promulgated by Generally Accepted Government Auditing Standards, OAG obtained an external peer review that was conducted by a peer review team that is independent of the audit organization. The peer review team reviewed OAG ‘s system of quality control is suitably designed and whether OAG is complying with the quality control system for reasonable assurance that OAG is performing and reporting in conformity with professional standards and applicable legal and regulatory requirements. OAG is happy to report that we received a rating of a pass.
 Picture with peer reviewers: Andrea Addis, Director of Internal Audit for Knox County, Tennessee and Richard Walls, Senior Auditor for City of Chattanooga, Tennessee
Upcoming Events
Next Audit Committee Meeting
The next Audit Committee meeting is scheduled for June 21, 2023 at 4:30 PM. Please refer to BoardDocs for meeting information once it becomes available.
Fraud, Waste, and Abuse Hotline:
(571) 423-1333 (anonymous voicemail)
InternalAudit@fcps.edu (email is not anonymous)
|
