Loading...
FAS-028 - Internal Audit Charter_2021 1 Title: Internal Audit Charter Subject: Internal AuditCategory: Policy No.:M&C Report No.: Effective Date:2021-07-26Next Review Date: (3 years) Area(s) this policy applies to: Office Responsible for review of this Policy: Financial Services Related Instruments:Policy Sponsor: Document Pages: This document consists of 6 pages. Revision History: Common Clerk's Annotation for Official eRecord Date of Passage of Current Framework:_____2021-07-26_________ I certify that this Policy was adopted by Common Council as indicated above. ___________2021-09-15_______ Common ClerkDate Date Created:Common Council Approval Date:Contact: 2021-07-222021-07-26Commissioner Finance City of Saint John Internal Audit Charter July 22, 2021 1. Purpose and Mission service is to provide independent, objective assurance and consulting services designed to add value and improve the City of Saint John audit is to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight. The internal audit servicehelps the City of Saint John accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. 2. Standards for the Professional Practice of Internal Auditing The internal audit service will govern itself by adherence to the mandatory elements of The Institute of Internal Auditors' International Professional Practices Framework, including the Core Principles for the Professional Practice of Internal Auditing, the Code of Ethics, the International Standards for the Professional Practice of Internal Auditing, and the Definition of Internal Auditing. The senior manager of internal audit will report periodically to senior management and the finance committee regarding internal audit department Ethics and the Standards. 3. Authority The senior manager of internal audit will report functionally to Council through the Finance Committee and administratively (i.e., day-to-day operations) to the Chief Financial Officer. To establish, maintain, and assure that the City of Saint Johnservice has sufficient authority to fulfill its duties, the Finance Committee will: a) Recommend to Common Council to a b) Recommend to Common Council to approve the risk-based internal audit plan, including as appropriate any special tasks or projects requested by Management and Council with the understanding that a portion ulting services to management at their request. c) Receive communications from the senior manager other matters. d) Receive information and decisions regarding the appointment and removal of the senior manager. e) Make appropriate inquiries of management and the senior manager of internal audit to determine whether there is inappropriate scope or resource limitations. Internal audit will have unrestricted access to, and communicate and interact directly with, the Finance Committee, including in private meetings without management present. The determination of a necessity for in private meetings will be limited to fraud investigations or other matters of misconduct that could potentially include management or by request from the Finance Committee under the same limits. It should be noted that it is not the responsibility of internal audit to prevent or detect fraud. The internal audito responsibility is to consider fraud when conducting their audit work in areas susceptible to fraud or misconduct. If notification is made to the internal audit team of a potential fraud or misconduct the following steps by internal audit must be made: - A determination by internal audit in relation to how reliable the source is and if internal audit observed or detected the misconduct directly. 1 - A consideration by internal audit about what additional audit procedures or validation should be conducted by internal audit. - Internal audit to identify their role in the investigation and if an investigation is warranted. - If the information provided to internal audit implies that the behaviour by management could contravene onduct and could have the potential to be significant then the decision to bypass management to the finance committee should be made by internal audit senior manager. The Finance Committee authorizes internal audit to: f) Have full, free, and unrestricted access to all functions, records, property, and personnel pertinent to carrying out any engagement, subject to accountability for confidentiality and safeguarding of records and information. g) Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques required to accomplish audit objectives, and issue reports. h) Obtain assistance from the necessary personnel of the City of Saint John as well as other specialized services from within or outside the City of Saint John, to complete the engagement. i) Perform special engagements with management where internal audit has the appropriate skill set. 4. Independence and Objectivity The senior manager will ensure that the internal audit service remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of audit selection, scope, procedures, frequency, timing, and report content. If the senior manager determines that independence or objectivity may be impaired in fact or appearance, the details of impairment will be disclosed to appropriate parties. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively and in such a manner that they believe in their work product, that no quality compromises are made, and that they do not subordinate their judgment on audit matters to others. Internal auditors will have no direct operational responsibility or authority over any of the activities audited. Where the senior manager of internal audit has or is expected to have roles and/or responsibilities that fall outside of internal auditing, safeguards will be established to limit impairments to independence or objectivity. Internal auditors will: a) Disclose any impairment of independence or objectivity, in fact or appearance, to appropriate parties. b) Exhibit professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. c) Make balanced assessments of all available and relevant facts and circumstances. d) Take necessary precautions to avoid being unduly influenced by their own interests or by others in forming judgments. e) If necessary have the audit work performed by individuals who are independent. Internal audit will confirm to the Finance Committee, at least annually, the organizational independence of the internal audit department. Internal auditwill disclose to the finance committee any interference and related implications in determining the scope of internal auditing, performing work, and/or communicating results. In case of a City emergency, to the extent that redeployment of staff may be necessary to support critical functions, internal audit staff may be required to perform otherwise non-authorized duties. 2 5. Scope of Internal Audit Activities The scope of internal audit activities encompasses, but is not limited to, objective examinations of evidence for the purpose of providing independent assessments to Finance Committee, management, and outside parties on the adequacy and effectiveness of governance, risk management, and control processes for the City of Saint John. All activities of the City of Saint John and their Boards, Authorities and Agencies may be subject to audit where legislatively permissible. If a decision is made to review activities of Boards, Authorities and Agencies that are not legislatively permissible a letter of confirmation must be obtained by the appropriate representative of the auditee party agreeing to the audit, specifically the scope, timing, and reporting process. Internal audit can perform a wide range of audit services for the City. In order to understand the various scopes of work internal audit will categorize the work in two broad categories as follows: Audit services- Audit services will provide an independent evaluation of key processes and controls of the City. Audit services will be comprised of risk based audits that have been included in the approved audit plan. These services will be reported in detail to senior management and a summary report will be provided to the Finance Committee. For the audits performed within this category management action plans will be created and reporting of status will be provided to senior management and the Finance Committee. Consulting and Advisory services- Special requests from management can be accommodated covering various areas affecting operations. The nature and scope of each request will be agreed upon with the area of review and the reporting will be provided to the management of the area. Reporting on status of projects will be provided to senior management. Consideration to support these services will be secondary to the audit services and made based on a City Manager approved work plan that considers the technical expertise requirements, resource and budget availability and collaboration with continuous improvement. If issues are identified that are determined to be beyond the scope of authority of the City Manager this information is to be provided to the Finance Committee. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during engagements. These opportunities will be communicated to the appropriate level of management. Internal audit assessments include evaluating whether: a) identified and managed. b) with the City of Saint J standards. c) The results of operations or programs are consistent with established goals and objectives. d) Operations or programs are being carried out effectively and efficiently. e) Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact the City of Saint John. f) Information and the means used to identify, measure, analyze, classify, and report such information are reliable and have integrity. g) Resources and assets are acquired economically, used efficiently, and protected adequately. The senior manager of internal audit will report periodically to senior management and the Finance Committee regarding: a) Internal audit purpose, authority, and responsibility. b) Internal audit plan and performance relative to its plan. c) Internal audit significant conformance issues. 3 d) Significant risk exposures and control issues, including fraud risks, governance issues, and other matters requiring the attention of, or requested by, the finance committee. e) High level summary of results of audit engagements or other activities. f) Resource requirements. g) Any response to risk by management that may be unacceptable to the City of Saint John. The senior manager of internal audit also coordinates activities, where possible, and considers relying upon the work of other internal and external assurance and consulting service providers as needed. 6. Responsibility The senior manager of internal audit has the responsibility to: a) Submit, at least annually, to senior management and the Finance Committee a risk-based internal audit plan for review and recommendation for approval to Common Council. b) Communicate to senior management and the Finance Committee the impact of resource limitations on the internal audit plan. c) Review and adjust the internal audit plan, as necessary, in response to changes in the City of Saint John business, risks, operations, programs, systems, and controls. d) Communicate to senior management and the Finance Committee any significant interim changes to the internal audit plan. e) Ensure each engagement of the internal audit plan is executed, including the establishment of objectives and scope, the assignment of appropriate and adequately supervised resources, the documentation of work programs and testing results, the understanding of the capabilities of the City to action on observations and the communication of engagement results with applicable conclusions and recommendations to appropriate parties. f) Follow up on engagement findings and corrective actions, and report periodically to senior management and the Finance Committee any corrective actions not effectively implemented. g) Ensure the principles of integrity, objectivity, confidentiality, and competency are applied and upheld. h) Ensure internal audit collectively possesses or obtains the knowledge, skills, and other competencies needed to meet the requirements of the internal audit charter. i) Ensure trends and emerging issues that could impact the City of Saint John are considered and communicated to senior management and the Finance Committee as appropriate. j) Ensure emerging trends and successful practices in internal auditing are considered. k) Establish and ensure adherence to policies and procedures designed to guide the internal audit activities. l) Ensure adherence to the City of Saint John procedures conflict with the internal audit charter. Any such conflicts will be resolved or otherwise communicated to senior management and the Finance Committee. m) Ensure conformance of the internal audit activities with the Standards, with the following qualifications: o If the internal audit activities is prohibited by law or regulation from conformance with certain parts of the Standards, the senior manager of internal audit will ensure appropriate disclosures and will ensure conformance with all other parts of the Standards. o If the Standards are used in conjunction with requirements issued by other authoritative bodies, the senior manager of internal auditwill ensure that the internal audit department conforms with the Standards, even if the internal audit department also conforms with the more restrictive requirements of other authoritative bodies. 7. Quality Assurance and Improvement Program Internal audit will maintain a quality assurance and improvement program that covers all aspects of the activities performedndards and an 4 and effectiveness of internal audit and identify opportunities for improvement. Internal audit will communicate to senior management and the finance committee on the internal auditquality assurance and improvement program, including results of internal assessments (both ongoing and periodic) and external assessments conducted at least once every five years by a qualified, independent assessor or assessment team from outside the City of Saint John. 5