 |
|
Audit Buzz Newsletter
March 2024
|
Engagement and Office Updates
In this issue of the Audit Buzz, we explain the risk assessment and audit plan process, discuss “What is Risk” in the Knowledge Hive; and promote the upcoming Internal Audit Awareness Month. There is no meeting with the Audit Committee in March.
Prior editions of Audit Buzz are archived here on Office of Auditor General's (OAG) website.
As always, we appreciate the cooperation and courtesies extended to our staff by Fairfax County Public Schools (FCPS) management and staff during all past, current, and future audit engagements.
OAG's Annual Risk Assessment and Audit Plan
Every year, OAG conducts an independent risk assessment which considers the financial, operational, and reputational risks faced by FCPS. OAG develops its annual audit plan based upon the risk assessment results. Currently OAG is conducting the risk assessment process for the fiscal year 2025 (FY25) audit plan.
The risk assessment and annual audit plan prioritize areas by evaluating the associated risks (see the “What is Risk” article below).
OAG then determines the FY25 audit plan to include secondary and long-term priorities.
Knowledge Hive
What is Risk?
We all know the answer to this intuitively; we probably form our first understanding of risk growing up, with statements such as “Don’t run with scissors. You will put your eye out!” or “Put your coat on before you go outside. You will catch cold!”
How do auditors view risk?
Risk is defined by the Institute of Internal Auditors (IIA) as “the possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.” Would that include the events listed above? Absolutely. But so much more. What if inadequate employee training results in erroneous data being recorded in the school’s information systems? What if poor cash management controls result in several months of unreconciled bank statements? Is that a risk?
What if these events have not actually happened but could happen because of the weak or non-existent controls. The vast majority of us never poked our eyes out from running with scissors either, but it could have happened. And if it did, the effect on our lives could be devastating.
Internal auditors must also take risk into account when developing the specific tasks performed in an engagement. For example, perhaps an engagement was selected because of the appearance of weak cash controls. In deciding what tasks to perform, the auditor must determine first if controls even exist. If they do not exist at all, there is significant risk that the data may be erroneous. A large number of records may need to be reviewed to come to a conclusion about the validity of the attribute being tested or the balance being confirmed. If controls exist but are thought to be weak, the auditor will need to test a sample of records in order to gauge the risk of errors in the entire record population. Based on the results of that sample, the auditor may conclude that even though the controls are weak, they appear to be working. Or the auditor may decide, due to errors identified in the sample records reviewed, to enlarge the selected sample of records and then come to a conclusion regarding the record population as a whole. The goal is to gather sufficient evidence from the review of records to conclude whether the perceived risk is sufficient to impact the achievement of management’s objectives and to report such to management with appropriate recommendations.
How do OAG identify risk in FCPS department/office?
OAG conducts an independent risk assessment on an annual basis, regarding the financial, operational and reputational risks faced by FCPS system. OAG sends a risk assessment survey and collects feedback from FCPS Leadership Team, the Audit Committee, and the School Board. Based upon the risk assessment results, OAG develops its annual audit plan.
The risk assessment and annual audit plan prioritize the areas being considered for audit by evaluating the risks associated with each area. The risk factors used to assess each area include:
- The financial impact of the audit area
- The potential reputational and operational risks driven by:
- The quality of internal controls and the likelihood of errors
- The complexity of the audit area
- Turnover of key personnel and stability in management
- Inputs received from the School Board and FCPS leadership
- Relevant risks faced by other public-school systems
- The frequency and results of prior audits and reviews conducted by OAG or other external agencies
- Opportunity for improvement
What to do if OAG identifies risk at FCPS department/office?
When OAG cites your department/office for weak controls, it is not because we are looking for that ‘gotcha’ moment. Weak controls adversely impact FCPS’s ability to reach its goals. We will discuss with the stakeholders the risk that we have identified and will work with the stakeholders to develop appropriate remedial measures. The best remedial measure is to implement a control that will avoid the risk altogether. Some risks cannot be completely avoided. In those cases, a control that identifies the risk event when it occurs and minimizes its impact is the next best thing.
Don’t wait
If FCPS employees become aware of risks, invite OAG to come and help you make an assessment and work with you to identify appropriate controls. “An ounce of prevention is worth a pound of cure!”
Did you Know?
Internal Audit Awareness Month
To raise awareness and recognize the Office of Auditor General (OAG), May has been designated as the Internal Audit Awareness Month by the Institute of Internal Auditors.
OAG serves and operates at the direction of the School Board. The School Board Audit Committee serves to promote the independence and objectivity of OAG by ensuring broad audit coverage, adequate consideration of audit reports, and appropriate action on recommendations. OAG has an important purpose within FCPS, as our internal auditors, and it provides a variety of roles and responsibilities. These duties can include:
PROVIDE INSIGHT AND ASSESS CONTROLS –– Through their expertise, knowledge, and broad perspective of FCPS, OAG can evaluate efficiency and effectiveness, and provide management and the School Board with assurance that the adequate controls are in place to respond to the risks that may threaten the organization.
EVALUATE RISKS – Risks can be everywhere (reputation, inefficient operations, fraud, lawsuits, policy violations, regulatory compliance, theft, etc.). OAG assesses the significance of the organization’s many risks and the effectiveness of risk management efforts, communicate these to management and the School Board, and develop recommendations to improve risk management.
IMPROVE OPERATIONS – With a solid understanding of the organization’s objectives, OAG can examine operations to determine whether they are efficient and effective.
PROMOTE ETHICS – Professional internal auditors abide by a Code of Ethics that upholds the principles of integrity, objectivity, confidentiality, and competency. They raise red flags when they discover improper conduct.
MONITOR COMPLIANCE – OAG assesses the organization’s compliance with applicable laws, regulations, and contracts to ensure that management is addressing these requirements adequately. They also offer insight into the impact that noncompliance would have on an organization and inform senior management and the School Board of noncompliance.
INVESTIGATE FRAUD – Because fraud can affect any level of the organization, OAG is provided access to all records as well as the authority to conduct audits and investigate possible fraudulent behavior throughout the organization.
COMMUNICATE RESULTS – After conducting thorough audits, OAG reports its findings and recommend appropriate courses of action to strengthen organizational success.
FCPS employees please join OAG to celebrate Internal Audit Awareness Month on May 22 (Wednesday) in the Gatehouse Cafe from 11:00 am to 12:30 pm. Of course, in true OAG fashion, there will be chances to win prizes!
Upcoming Events
Next Audit Committee Meeting
The next Audit Committee meeting is scheduled for April 30, 2024 at 3:00 PM. Please refer to BoardDocs for meeting information once it becomes available.
Fraud, Waste, and Abuse Hotline:
(571) 423-1333 (anonymous voicemail)
InternalAudit@fcps.edu (email is not anonymous)
Online Submission Form
|
