63I-5 - Utah Internal Audit Act

Title 63I > 63I-5

Sections (6)

General Provisions

63I-5-101 - Title.

This chapter is known as the “Utah Internal Audit Act.”

63I-5-102 - Definitions.

As used in this chapter: 63I-5-102(1) “Agency governing board” is any board or commission that has policy making and oversight responsibility over the agency, including the authority to appoint and remove the agency director. 63I-5-102(2) “Agency head” means a cabinet officer, an elected official, an executive director, or a board or commission vested with responsibility to administer or make policy for a state agency. 63I-5-102(3) “Agency internal audit director” or “audit director” means the person who:

directs the internal audit program for the state agency; and is appointed by the audit committee or, if no audit committee has been established, by the agency head. 63I-5-102(4) “Appointing authority” means:

the governor, for state agencies other than the State Tax Commission; the Judicial Council, for judicial branch agencies; the Utah Board of Higher Education, for higher education entities; the State Board of Education, for entities administered by the State Board of Education; or the four tax commissioners, for the State Tax Commission. 63I-5-102(5) “Audit committee” means a standing committee composed of members who:

are appointed by an appointing authority; do not have administrative responsibilities within the agency; and are not an agency contractor or other service provider; and have the expertise to provide effective oversight of and advice about internal audit activities and services. 63I-5-102(6) “Audit plan” means a prioritized list of audits to be performed by an internal audit program within a specified period of time. 63I-5-102(7) “Higher education entity” means the Utah Board of Higher Education, an institution of higher education board of trustees, or each higher education institution. 63I-5-102(8) “Internal audit” means an independent appraisal activity established within a state agency as a control system to examine and evaluate the adequacy and effectiveness of other internal control systems within the agency. 63I-5-102(9) “Internal audit program” means an audit function that:

is conducted by an agency, division, bureau, or office, independent of the agency, division, bureau, or office operations; objectively evaluates the effectiveness of agency, division, bureau, or office governance, risk management, internal controls, and the efficiency of operations; and is conducted in accordance with the current: International Standards for the Professional Practice of Internal Auditing; or The Government Auditing Standards, issued by the Comptroller General of the United States. 63I-5-102(10) “Judicial branch agency” means each administrative entity of the judicial branch. 63I-5-102(11) “State agency” means: each department, commission, board, council, agency, institution, officer, corporation, fund, division, office, committee, authority, laboratory, library, unit, bureau, panel, or other administrative unit of the state; or each state public education entity. “State agency” does not mean: a legislative branch agency; an independent state agency as defined in Section 63E-1-102; a county, municipality, school district, special district, or special service district; or any administrative subdivision of a county, municipality, school district, special district, or special service district.

Internal Auditing Programs

63I-5-201 - Internal auditing programs — State agencies.

63I-5-201(1) The departments of Government Operations, Agriculture, Commerce, Cultural and Community Engagement, Corrections, Workforce Services, Environmental Quality, Health, Human Services, Natural Resources, Public Safety, and Transportation, and the State Tax Commission shall conduct various types of auditing procedures as determined by the agency head or governor. The governor may, by executive order, require a state agency not described in Subsection (1)(a) to establish an internal audit program. The governor shall ensure that each state agency that reports to the governor has adequate internal audit coverage. 63I-5-201(2) The Administrative Office of the Courts shall establish an internal audit program under the direction of the Judicial Council, including auditing procedures for courts not of record. The Judicial Council may, by rule, require other judicial agencies to establish an internal audit program. 63I-5-201(3) Utah Tech University, the University of Utah, Utah State University, Salt Lake Community College, Southern Utah University, Utah Valley University, Weber State University, and Snow College shall establish an internal audit program under the direction of the Utah Board of Higher Education. The Utah Board of Higher Education may issue policies requiring other higher education entities or programs to establish an internal audit program. 63I-5-201(4) The State Board of Education shall establish an internal audit program that provides internal audit services for each program administered by the State Board of Education. 63I-5-201(5) Subject to Section 32B-2-302.5, the internal audit division of the Department of Alcoholic Beverage Services shall establish an internal audit program under the direction of the Alcoholic Beverage Services Commission.

Audit Committee

63I-5-301 - Audit committee — Powers and duties.

63I-5-301(1) Each appointing authority may establish an audit committee to monitor the activities of the agency internal audit program. An audit committee may serve more than one state agency internal audit program. 63I-5-301(2) The appointing authority shall ensure that audit committee members have the expertise to provide effective oversight of and advice about internal audit activities and services. 63I-5-301(3) Except as provided in Subsection (4), if an audit committee has been established, the audit committee shall:

appoint, evaluate, and, if necessary, remove the agency internal audit director; prepare and adopt formal policies that define: the purpose of the agency’s internal audit program; and the authority and responsibility of the agency’s internal auditors; ensure that policies adopted under Subsection (3)(b): do not place limitations on the scope of the internal audit program’s work; and clarify that an auditor does not have authority or responsibility for an activity that the auditor audits; ensure that: the audit director employs a sufficient number of professional and support staff to implement an effective internal audit program; compensation, training, job tenure, and advancement of internal auditing staff is based upon job performance; the audit director and staff collectively possess the knowledge, skills, and experience essential to the practices of the profession and are proficient in applying internal auditing standards, procedures, and techniques; the internal audit program has staff who are qualified in disciplines necessary to meet the audit responsibilities, including accounting, business management, public administration, human resource management, economics, finance, statistics, electronic data processing, or engineering; internal audit staff are free of operational and management responsibilities that would impair their ability to make independent audits of any aspects of the agency’s operations; the audit director and the internal audit staff have access to all personnel and records, data, and other agency information that the audit director or staff consider necessary to carry out their assigned duties; and the audit director and internal audit staff have the necessary access to the agency head, agency management, and agency staff; approve internal auditing policies proposed by the agency head or audit director; review and approve the annual internal audit plan, modifications to the internal audit plan, risk assessment, and budget; review internal and external audit reports, follow-up reports, and quality assurance reviews of the internal audit office; and periodically meet with the agency internal audit director to discuss pertinent matters, including whether there are any restrictions on the scope of audits. 63I-5-301(4) In relation to an audit committee established by the State Board of Education, the State Board of Education shall:

designate, in writing, the responsibilities and powers described in Subsection (3) that are held by the State Board of Education and the responsibilities and powers described in Subsection (3) that are held by the audit committee; and make rules, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, for selecting the entity to be audited, determining the scope of the audit, and determining the procedures to be used in conducting the audit, including due process procedures.

63I-5-302 - Agency head — Powers and duties.

If an agency has an internal audit program, and the agency’s appointing authority has not established an audit committee, the agency head shall assume the audit committee powers and duties described in Subsection 63I-5-301(3) .

Duties of Director

63I-5-401 - Duties and powers of the agency internal audit director.

63I-5-401(1) The agency internal audit director shall:

furnish independent analyses, appraisals, and recommendations that may, depending upon the audit scope, identify: the adequacy of the state agency’s systems of internal control; the efficiency and effectiveness of agency management in carrying out assigned responsibilities; and the agency’s compliance with applicable laws, rules, and regulations; submit audit reports directly to the agency head and to the audit committee, if one has been established; conduct internal audits of state agency programs, activities, and functions that may consist of one or more of the following objectives: to verify the accuracy and reliability of agency records; to assess compliance with management policies, plans, procedures, and regulations; to assess compliance with applicable laws, rules, and regulations; to evaluate the efficient and effective use of agency resources; and to verify the appropriate protection of agency assets; prepare audit reports of findings; review and evaluate internal controls over the state agency’s accounting systems, administrative systems, electronic data processing systems, and all other major systems necessary to ensure the fiscal and administrative accountability of the state agency; develop audit plans containing the information required by Subsection (2) to be based on the findings of periodic risk assessments; upon request, make a copy of the approved audit plan available to the state auditor, legislative auditor, or other appropriate external auditor to assist in planning and coordination of any external financial, compliance, electronic data processing, or performance audit; determine the scope and assignment of the audits; perform an audit of a special program, activity, function, or organizational unit at the direction of the agency head or, if one has been established, an audit committee; maintain the classification of any public records consistent with Title 63G, Chapter 2, Government Records Access and Management Act; be subject to the same penalties as the custodian of those public records for violating Title 63G, Chapter 2, Government Records Access and Management Act; and identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts of interest. 63I-5-401(2) The audit plan required by this section shall: identify the individual audits to be conducted during each year; identify the related resources to be devoted to each of the respective audits; ensure that internal controls are reviewed periodically as determined by the agency head or the audit committee, if one has been established; and ensure that audits that evaluate the efficient and effective use of agency resources are adequately represented in the plan. The agency internal audit director shall submit the audit plan to the agency head and the audit committee, if one has been established, for approval. 63I-5-401(3) The agency internal audit director shall ensure that: all reports of audit findings issued by internal audit staff shall include a statement that the audit was conducted according to the appropriate standards; public release of reports of audit findings comply with the conditions specified by the state laws and rules governing the state agency; copies of all reports of audit findings issued by the internal audit staff are available, upon written request, to the Offices of the Legislative Auditor General and the Office of the State Auditor; and significant audit matters that cannot be appropriately addressed by the agency internal audit office are referred to either the Office of Legislative Auditor General or the Office of the State Auditor. 63I-5-401(4) The agency internal audit director may contract with consultants to assist with audits.