Internal Audit Guide Task Force Members

1. AASHTO Internal Audit Guide Task ForceChanges to the Internal Audit GuidePresented by the Task Force Co-Chairs Alice S. Wilson, CPA, Executive Director, Office of Audits Kentucky Transportation Cabinet Stephen Kirk, CIA, CGAP, Director Office of Internal Audit, Chief Internal Auditor, Illinois Department of Transportation Presented: August 13, 2014

2. Internal Audit Guide Task Force Members • Alice Wilson, Kentucky, Co-Chair • Stephen Kirk, Illinois, Co-Chair • Sandra Healy, Idaho • Benito Ybarra, Texas • Kristen Burkhart, Wyoming • Wayne Rogers, North Carolina • David Bruce, FHWA • Daryl Splichal, North Dakota • John Cotter, Michigan • Becky Greenway, Georgia • Wayne Cobb, Alabama

3. Agenda • Task Force Composition • Ground Rules • Why Change the Guide? • Areas Covered in the new Internal Audit Guide • Practice Aids • Benefits • Content • Development Plan • Developed • In Progress • Possible List • Feedback and Contact Information

4. Task Force • We have had a very busy year. We spanned 3 Time Zones, which added to the difficulties in scheduling times for 11 extremely busy people to meet. • We have representatives from 10 states and 1 Federal Partner from FHWA. • We represent both small and large Internal Audit shops. • We represent states with both combined as well as separate Internal and External Audit functions. • We represent audit shops that follow GAGAS, IIA Standards or a combination of both. • The Co-Chairs would like to thank the members of the Task Force for their extensive time commitment and contributions to this effort over the last year.

5. Ground Rules • We recognized that audit shops are set up differently at the various State Transportation Departments. Some separate Internal and External Audit work and some utilize the same auditors for both functions. • Regardless of who is conducting the Internal Audit function, we decided to focus exclusively on Internal Audit work. External Audit activities are already addressed in a separate guide and are therefore not covered in this guide.

6. Why Change the Guide? • Many expressed a need to have a reference tool that addressed Internal Auditing for all modes of Transportation. The previous guide focused on Highway Construction. There was also a desire to have more program specific audit information. • In order to better address everyone’s needs, the Task Force changed the composition of the Internal Audit Guide. The Guide itself now covers the basic guidance that cuts across all modes of Transportation, rather than a specific program area. • Program specific audit guidance will now be addressed in individual Practice Aids that will focus on audits of specific programs and activities. Practice Aids will be added over time as they are developed and each Practice Aid can now be updated separately whenever necessary rather than modifying the entire Internal Audit Guide.

7. Areas Covered in the New Internal Audit Guide • Chapter 1: Introduction (Revised); • Chapter 2: Auditing Standards (Revised); • Chapter 3: Types of Engagements (Revised); • Chapter 4: Audit Risk Assessment and Audit Plan (Revised and expanded into a separate chapter); • Chapter 5:Internal Control (Revised and expanded into a separate chapter); • Chapter 6: USDOT Agencies and Descriptions (Added since the original draft last year) • Chapter 7: Stewardship, Oversight, Laws and Regulations (Revised and expanded into a separate chapter added Stewardship since the original draft last year); • Chapter 8: Innovative Financing and Construction Delivery Methods; (Added since the original draft last year); • Chapter 9: General Audit Program (Revised); • Glossary (Revised).

8. Chapter 1: Introduction • Updated the introduction to address the changes to the Guide

9. Chapter 1: Introduction • Sections • Overview • Why a Guide? Provide Internal Auditors a reference tool that addresses the following: • Internal Controls • Risk Assessment • Compliance with Applicable Laws and Regulations • Federal Programs • Innovative Financing • Effective Use of Resources • Auditing Standards • Engagements- Overview of Internal Audit responsibilities.

10. Chapter 2: Auditing Standards • Added a discussion of GAGAS and IIA requirements and included a comparison between the requirements

11. Chapter 2: Auditing Standards • Sections • Generally Accepted Government Auditing Standards (GAGAS) • International Standards for the Professional Practice of Internal Auditing, Institute of Internal Auditors (IIA) • Comparison of GAGAS and IIA Standards

12. Chapter 3: Types of Engagements • Updated the language • Covers descriptions of types of engagements • Added information pertaining to Information Technology related audits • Expanded Non-Audit Services and added Consulting.

13. Chapter 3: Types of Engagements • Sections • Types of Engagements Overview • Types of Engagements- Financial, Performance, Program Effectiveness and Results, Internal Control, Compliance, Information Technology, Follow-Up • Attestation Engagements- Examination, Review, Agreed Upon Procedures • Non-Audit or Consulting Services

14. Chapter 4- Risk Assessment and Development of an Audit Plan • Risk Assessment was made into its own Chapter • previously part of an Appendix and the content was expanded to cover the whole risk assessment process through the development of a work plan.

15. Chapter 4- Risk Assessment and Development of an Audit Plan • Sections • Agency Risk Assessment Overview • Identify Audit Universe or Auditable Units • Benefits of Auditable Units • Permanent Files • Risk Assessment • Risk Assessment Criteria • Consideration of Internal Controls and Common Threats • Internal Control Weaknesses • Analysis of Internal Audit Resources • Developing The Audit Work Plan

16. Chapter 5: Internal Control • Updated to reflect the 2013 COSO changes and expanded the discussion. • Added Information Technology Related Controls with a focus on Control Objectives for Information and Related Technology (COBIT) Standards.

17. Chapter 5: Internal Control • Sections • Internal Control Overview • COSO Categories • Five Components of COSO • COBIT Framework and COBIT Domains • Understanding an Auditee’s Internal Controls • Documenting Internal Controls • Internal Controls Over Financial Reporting • Evaluation of Internal Controls • Classifying Internal Control Weaknesses

18. Chapter 6 USDOT Agencies • Sections • USDOT Agencies and Descriptions General Overview • Office of the Secretary • Federal Aviation Administration • Federal Highway Administration • Federal Motor Carrier Safety Administration • Federal Railroad Administration • Federal Transit Administration • Maritime Administration • National Highway Traffic Safety Administration • Office of Inspector General • Pipeline and Hazardous Materials Safety Administration • Research and Innovative Technology Administration • Saint Lawrence Seaway Development Corporation • Surface Transportation Board

19. Chapter 7: Stewardship, Oversight, Laws and Regulations • Made this a separate chapter. • Previously part of an “Essentials” chapter. • Expanded the chapter and listings. • Added Stewardship and Oversight.

20. Chapter 7: Stewardship, Oversight, Laws and Regulations • Stewardship and Oversight Agreement between the FHWA and State Transportation Agencies • Hierarchy • Federal Requirements (2 CFR 200) • Audit Requirements (Part of 2 CFR 200) • Catalog of Federal Domestic Assistance (CFDA) • State Law

21. Chapter 8: Innovative Financing and Construction Delivery Methods • Sections • Grant Anticipation Revenue Vehicle (GARVEE) • Transportation Infrastructure Finance Innovation Act (TIFIA) • Section 129 Loans (23 U.S.C. 129 (A) (7) • Tax Increment Financing (TIF) • Private Activity Bonds (PABS) • Public-Private Partnerships (P3s) • Design- Build (DB) • Construction Manager/General Contractor (CMGC)

22. Chapter 9: General Audit and Attestation Programs • Expanded the previous General Audit Program to include more detailed steps • Added a General Attestation Audit Program

23. Chapter 9: General Audit Program • Sections • Audit Program Purpose and Scope • Phases • A. Preliminary Survey (Planning) Phase • B. Execution (Fieldwork) Phase • C. Closing (Reporting) Phase • Attestation Program Purpose and Scope

24. Glossary: • The glossary was expanded to address additional terms.

25. Benefits of Practice Aids • Only an individual Practice Aid has to be amended rather than the whole Internal Audit Guide if there are changes made to a specific program. • When there is a new program, a new Practice Aid addressing that program can be developed without amending the whole Internal Audit Guide. • Having separate Practice Aids by subject provides easier use. Each Practice Aid will focus exclusively on one program or activity. • Allowed the Task Force to break this project into manageable pieces through various projects rather than take on one huge project at once. Therefore, allowing us to provide usable products to AASHTO members more quickly. • To expedite this process, we would like to suggest having members submit audit programs to the Task Force for review and approval to be added to the site.

26. Practice Aid Content • Program Description; • Statutes and Regulations; • Catalog of Federal Domestic Assistance (CFDA#) (if applicable); • Audit Scope and Objectives; • Audit Program.

27. Practice Aid Development Plan • The Internal Audit Task Force will have ongoing responsibilities to develop Practice Aids. As you will see from the list we began to develop, there is an extensive number of topics. Therefore, we need your assistance in providing drafts so the project can move forward more effectively. Please take the time to look at the various audits you have conducted. If you have an existing Audit Program for one of the areas or one you think should be included, please provide it for review by the Task Force. Working on this project together we will be able to accomplish more and arrive at a better product.

28. Completed Practice Aids • Disadvantaged Business Enterprise (DBE) Initial Certification Process • Metropolitan Planning Organizations (MPOs)

29. Practice Aids Currently Under Development • Federal Aid Billing • Procurement Cards • Materials • Highway Planning and Construction (CFDA 20.205) • Professional Services Consultants • Airport Improvement Program, (CFDA #20.106) • Transit Grants • Subrecipient Monitoring

30. Possible Practice Aids • Disadvantage Business Enterprise (DBE) Labor & Workforce Utilization Monitoring • Value Engineering • Liquidated Damages • Recreational Trails Program • Ferry Boat Program • Congestion Mitigation and Air Quality Program (CMAQ)

31. Possible Practice Aids Continued • Bridge Inspection Program • Bridge Project Design & Review • Bridge Analysis and Load Capacity Determinations • Bridge Maintenance & Repair • Oversize Overweight Permits • Outdoor Advertising (Billboards) • Motor Pool and Vehicle Fleet Operations • Federal Funding Accountability & Transparency Act (FFATA) Reporting

32. Possible Practice Aids • Land Acquisition • Highway Construction Project Funds Management • Highway Construction Project Cost Estimation • Highway Construction Project Planning and Preconstruction Activities • Highway Construction Public Involvement • Highway Construction Procurement- Bidding & Awarding Construction Contracts • Highway Construction Contractor Payments

33. Proposed Practice Aids Continued • Highway Construction Contractor Change Orders • Highway Construction Site Audits • Highway Construction Contract Administration and Closeout • Highway Construction Consultant Selection • Highway Construction Consultant Contract Modifications • Highway Construction Consultant Payments • Highway Safety Improvement Program • Highway Rail Crossing Safety Program

34. Possible Practice Aids Continued • Operational Safety Inspections of Airports • Operational Safety Inspections of Heliports • Aircraft and Pilot Registration • Aircraft Maintenance of State Fleet • Airport Construction Project Funds Management • Airport Construction Project Cost Estimation • Airport Construction Project Planning and Preconstruction Activities

35. Possible Practice Aids Continued • Airport Construction Procurement- Bidding & Awarding Construction Contracts • Airport Construction Contractor Payments • Airport Construction Contractor Change Orders • Airport Construction Site Audits • Airport Construction Contract Administration and Closeout • Airport Construction Consultant Selection • Airport Construction Consultant Contract Modifications • Airport Construction Consultant Payments

36. Proposed Practice Aids Continued • Capital Assistance Program for Elderly Persons with Disabilities (CFDA#20.513) • Transit Capital Investment Grants (CFDA#20.500) • Transit Formula Grants (CFDA#20.507) • Formula Grants for Other than Urbanized Areas, (CFDA#20.509) • Transit State Planning & Research (CFDA#20.515)

37. Possible Practice Aids Continued • Motor Carrier Safety (CFDA#20.218)- Truck and Charter Bus Inspections; • Motor Carrier Safety (CFDA#20.218)- Truck and Charter Bus Compliance Reviews of New Entrants; • Motor Carrier Safety (CFDA#20.218)- Safety Audits of Trucking and Charter Bus Companies; • State Traffic Safety Improvement Grants (CFDA#20.600). • National Priority Safety Programs (CFDA#20.616). • High-Speed Rail Corridors and Intercity Passenger Rail Service – Capital Assistance Grants (CFDA#20.319)Railroad Agreements;

38. Feedback- The Task Force Needs Your Input • Provide ideas for Practice Aids • Submit Audit Programs to the Task Force pertaining to the various topics for screening and formatting into Practice Aids by the Task Force

39. Where do I send my Feedback? • Alice Wilson, CPA- Co-Chair (Kentucky) Alice.Wilson@ky.gov (502) 782-4041 • Stephen Kirk, CIA, CGAP- Co-Chair (Illinois) Stephen.Kirk@Illinois.gov (217)557-1258