Building the Internal Audit Function

1. Building the Internal Audit Function Commonwealth of Massachusetts Office of the Comptroller NASC – March 26, 2009 Kathy Sheppard, Deputy Comptroller

2. Agenda

3. Risk Never Sleeps Environmental Internal External

4. Possible Outcomes • Theft of cast iron decorative trim from Longfellow Bridge (September, 2008) • Cheating on time sheets (September, 2008)

5. Managing Risk What we asked … • If you are managing everything • Are You Really Managing Anything?

6. Managing Risk Where we wanted to be… • Effective Controls • Efficient Use of Resources • Empowering People to Manage their Business

7. Managing Risk How we started… • Delegation • Re-deployment of Resources • Enhanced Policies and Training including …

8. Focus on Internal Controls …Internal controls: • Tools that help managers be effective and efficient • Avoid serious problems • Overspending • Operational failures • Violations of law

9. Focus on Internal Control • Help rather than act as barriers. • Make sense within each organization’s unique operating environment. • Day to day responsibilities of managers and staff are not stand-alone practices. • Cost effective

10. Focus on Internal Control PARTNER WITH YOUR PEERS ACTUAL SAO FINDING • Findings: Area Office vs. Central Office • A recent audit of the Central Office disclosed that (they) do not have a complete and updated ICP. Audit of the Area Office found that officials believe that the ICP should be developed and administered by (their) Central Office. • Resolution: • Internal control plan needed improvement. Central Office officials recognized the need to revise and update the ICP and therefore hired an Internal Control Officer • Without a complete ICP in place, there is inadequate assurance that the Department will achieve its missions and objectives efficiently, effectively, and in compliance with applicable state laws and regulations; provide guidance in the event of employee turnover; and properly safeguard its assets against loss, theft, or misuse.

11. Focus on Internal Control The Internal Control Plan • High level summary of risks and controls • Tool to achieve agency objectives • Based on CTR guidelines & COSO model • http://www.mass.gov/osc

12. Focus on Internal Control What’s Not in the Plan … but… • Strategic Plan – refer to • All objectives and risk events • Risk Assessment – detail of each event, its impact, your response, etc. • Policies and Procedures – refer to • Disaster Recovery Plan – refer to

14. QUALITY ASSURANCE BUREAU • Quality Assurance Visits • Internal Controls • Internal Audit Function • Single Audit Liaison

15. QUALITY ASSURANCE BUREAU SUPPORTS • Bureau Advisory • Departments • Education • Continuous Audit

16. QUALITY ASSURANCE BUREAU • Risk Assessment • Site Selection • Scheduling • Data Mining • Desk Review • Site Prep • Site Visit • Reporting

17. InSite is OnSite

18. InSite is OnSite

19. InSite is OnSite

20. InSite is OnSite

21. InSite is OnSite

22. InSite is OnSite

23. InSite is OnSite

24. InSite is OnSite

25. InSite is OnSite

26. Risk Management Workshop • Communications • Information • Training