The Office of Internal Audit (Internal Audit) is a vital part of the university and functions in accordance with the policies established by the Chancellor, System Administration, and the Board of Regents. Internal Audit reports to the President and Institutional Internal Audit Committee of his/her respective institution. The organizational status and the support accorded to Internal Audit by executive management are major determinants of the scope and value of the internal audit function to the institution.
Each institution will organize and maintain an institutional internal audit committee. Membership on the institutional internal audit committee shall be determined by the institutional President and should include key members of senior management and at least one external member selected by the President and approved by the System Chief Audit Executive and Executive Vice Chancellor.
The institutional internal audit committees should meet periodically (generally quarterly) as determined by institutional necessity and at the request of the President, and provide for direct communication between the internal audit director and senior management. Essential functions performed by the audit committees shall include approval of the annual internal audit plan, consideration of work schedules and activity reports, and discussion of results of audits, including significant audit findings and recommendations. Evidence of these functions should be reflected in recorded minutes of the meetings.
Internal Audit provides independent, objective assurance, and consulting services designed to add value and improve UT Arlington’s operations. Internal auditing was established within The University of Texas System to evaluate and improve the effectiveness of risk management, control, and governance processes as a service to the Board of Regents, the Chancellor, and management of The University of Texas System to assist them in accomplishing their objectives.
Internal Audit is responsible for providing executive management with information about the adequacy and effectiveness of the institution's system of internal administrative and accounting controls and the quality of operating performance when compared with established standards.
To provide for the independence of Internal Audit, they report directly to the institution's President and internal audit committee and must be free of all operational and management responsibilities that would impair his/her ability to review independently, all aspects of the institution (per the Texas Internal Auditing Act, Section 2102, Government Code). The Internal Audit directors at the institutions have an indirect reporting relationship to The University of Texas System Chief Audit Executive who has responsibility for oversight of the internal auditing activity for the UT System and has the reporting responsibility for all institutions to the Audit, Compliance, and Management Review Committee of the Board of Regents. The Internal Audit directors at the institutions have a direct reporting relationship to The University of Texas System Chief Audit Executive for System-wide audits requested by the Audit, Compliance, and Management Review Committee of the Board of Regents.
Internal Audit must have a high degree of independence and not be assigned duties or engage in any activities that he/she would normally be expected to review or appraise. To accomplish these activities, the Internal Auditor is authorized to have full, free, and unrestricted access to all functions, activities, property, information systems, personnel, and records (including medical). The examination of patient medical records must serve a genuine audit need, and individual patients should not be identified in any audit report.
Internal Audit is not authorized to perform any operational duties, initiate or approve accounting transactions external to the Internal Audit department, or direct the activities of any employee not employed by Internal Audit, except to the extent such employees have been appropriately assigned to auditing teams or to otherwise assist Internal Audit.
SCOPE OF ACTIVITIES
The scope of work of Internal Audit is to determine whether the institution's network of risk management, control, and processes, as designed and represented by management, is adequate and functioning in a manner to help ensure:
- Risks, including strategic risks, are appropriately identified and managed;
- Significant financial, managerial, and operating information is accurate, reliable, and timely;
- Employees' actions are in compliance with policies, standards, procedures, and applicable laws and regulations;
- Resources are acquired economically, used efficiently, and adequately protected;
- Programs, plans, and objectives are achieved; and
- Quality and continuous improvement are fostered in the institution's control process.
Opportunities for improving management control may be identified within Internal Audit's scope of work. These opportunities will be communicated to the appropriate level of management.
Internal Audit has responsibility to:
- Develop a flexible annual work plan using an appropriate risk-based methodology, including any risks or control concerns identified by management, and submit that plan to the institution's President, Institutional Internal Audit Committee, and the Audit, Compliance, and Management Review Committee of the Board of Regents for review and approval as well as periodic updates
- Implement the annual work plan, as approved, including as appropriate any special projects requested by executive management of the institution, UT System officials, or the Board of Regents
- Have and maintain a professional audit staff with sufficient knowledge, skills, experience, and professional certifications to meet the requirements of this charter and the Texas Internal Auditing Act
- Evaluate and assess significant merging/consolidating functions and new or changing services, processes, operations, and control processes coincident with their development, implementation, and/or expansion
- Communicate the results of engagements promptly and to the appropriate individuals
- Issue periodic reports to the President and Institutional Internal Audit Committee summarizing results of audit activities
- Keep the President and Institutional Internal Audit Committee informed of emerging trends and successful practices in internal auditing
- Assist in the investigation of significant issues within the institution and notify appropriate members of executive management of the results
- Conduct special audits and special consultations requested by the Board of Regents, the Chancellor, the Executive Vice Chancellors, Presidents, and the System Administration or Institutional Internal Audit Committee
- Consider the scope of work of the external auditors and regulators, as appropriate, for the purpose of providing optimal audit coverage to the institution
- Ensure that an appropriate internal quality control system is in place and undergo an external peer review of their auditing and attestation engagement practices at least once every 3 years by reviewers independent of the audit organization
- Provide consulting and advisory services as appropriate
- Guide the institution on control self-assessments by assisting managers with risk self-assessments and conducting self-audits
- Manage and direct the implementation of Enterprise Risk Management by assisting in the process of identifying and analyzing risk from an integrated, system-wide/institutional perspective
- Provide information to the UT System Chief Audit Executive as required or requested to fulfill the System-wide audit oversight and reporting responsibilities
- File internal audit reports and related responses or action plans with the UT System Audit Office, the Office of the Governor, the State Auditor's Office, the Sunset Advisory Commission, and the Legislative Budget Board within two weeks after their presentation to the Institutional Internal Audit Committee
- Prepare the annual report required by the Texas Internal Auditing Act (Section 2102, Government Code) and submit the report to the institution's President, UT System Audit Office, the Office of the Governor, the State Auditor's Office, the Sunset Advisory Commission, and the Legislative Budget Board
In order to fulfill the responsibilities for keeping executive management aware of issues at the institution level and following-up to ascertain that appropriate action is taken on findings/recommendations included in internal audit reports, the System Audit Office maintains a series of "System-wide" tracking systems. The tracking systems are described below:
- Significant Findings Tracking System
There are two types of audit findings/recommendations: reportable and significant. A "reportable" audit finding/recommendation should be included in an audit report if it is material to the operation, financial reporting, or legal compliance of the audited activity, and the corrective action has not been fully implemented. "Significant" audit findings/recommendations are reportable audit findings/recommendations that are deemed significant at the institutional level by the institution internal audit committee or their designee. Significant audit findings/recommendations are submitted to and tracked by the System Audit Office. Quarterly, the Chief Business Officers (or their designated institution representative) are asked for the status of implementation. A summary report is provided to the UT System Administration Internal Audit Committee and the Audit, Compliance, and Management Review Committee of the UT System Board of Regents.
- External Audit Findings Tracking System
Quarterly, the Chief Business Officers (or their designated institution representative) are asked for the status of implementation of outstanding recommendations made by the State Auditor's Office, the Comptroller's Office, and other external auditors. A summary report is provided to the UT System Administration Internal Audit Committee and the Audit, Compliance, and Management Review Committee of the UT System Board of Regents.
In order to enhance accountability and ensure recommendations are implemented in a timely manner, clients will be required to request approval from their respective Internal Audit Committee and/or President to extend implementation dates with an explanation of the delay. If necessary, the first extension request must be made in writing; subsequent extensions are required to be made in person at an Internal Audit Committee meeting. The requests, either in writing or in person, must be made by the appropriate party at the director level or above
Note: Each institution is responsible for maintaining a tracking system for "reportable" findings. The institution internal audit department will follow-up on findings for which corrective action has not been accomplished.
In an effort to assist executive management in remaining aware of issues at the institutions and ensure that the System-wide audit plan is completed, the System Audit Office monitors the "fraud" and "audit plan" progress.
- Fraud Monitoring
Institution internal audit directors must provide a status on the frauds reported to the System Audit Office in accordance with UTS 118. The results are communicated to the UT System Administration Internal Audit Committee and the Audit, Compliance, and Management Review Committee of the UT System Board of Regents.
- Audit Plan Monitoring
Institution internal audit directors must provide a status of their progress on their annual audit plan. A summary report is provided to the UT System Administration Internal Audit Committee and the Audit, Compliance, and Management Review Committee of the UT System Board of Regents.
STANDARDS OF AUDIT PRACTICE
The Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing and the Code of Ethics, and Generally Accepted Governmental Auditing Standards of the Government Accountability Office, shall serve as guidelines for internal audit activities as required by the Texas Internal Auditing Act.
Approved by President James D. Spaniolo and the Institutional Audit Committee on March 23, 2012.
Back to top