Internal Audit Function

What is internal audit?

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

Internal audit now exists in the education realm in addition to the corporate world. Responsibilities can include evaluating emerging technologies, analyzing opportunities, examining global issues, assessing risks, controls, ethics, quality, economy and efficiency, assuring that controls in place are adequate to mitigate the risks, and communicating information and opinions with clarity and accuracy. Such diversity gives internal auditors a broad perspective on the organization. That, in turn, makes internal auditors a valuable resource to management and boards of directors or education in accomplishing overall goals and objectives, as well as in strengthening internal controls and governance.

What are internal controls?

The Internal Control Mystique (Click here to see Myths vs. Facts about Internal Controls)

Internal control or an internal control system is the integration of the activities, plans, attitudes, policies and efforts of the people of an organization working together to provide reasonable assurance that the organization will achieve its objectives and mission.

This definition establishes that:

  • Internal control impacts every aspect of an organization - all of its people, processes and physical structures;
  • Internal control is a basic element that permeates an organization - not a feature that is added on;
  • Internal control incorporates the qualities of good management;
  • Internal control is dependent upon people and will succeed or fail depending on the attention people give to it;
  • Internal control is effective when all of the people and the surrounding environment work together;
  • Internal control provides a level of comfort to an organization; controls do not guarantee success; and
  • Internal control helps an organization achieve its objectives and mission.

What's the difference between external and internal auditors?

Although they are independent of the activities they audit, internal auditors are integral to the organization and provide ongoing monitoring and assessment of all activities. On the contrary, external auditors are independent of the organization and provide an annual opinion on the financial statements. The work of the internal and external auditors should be coordinated for optimal effectiveness and efficiency.

Internal and external auditors have mutual interests regarding the effectiveness of internal financial controls. Both professions adhere to codes of ethics and professional standards set by their respective professional associations. There are, however, major differences with regard to their relationships to the organization, and to their scope of work and objectives.

The internal auditors are part of the organization. Their objectives are determined by professional standards, the board and management. External auditors are not part of the organization, but are engaged by it. Their objectives are set primarily by statute.

The internal auditors scope of work is comprehensive. It serves the organization by helping it accomplish its objectives, and improving operations, risk management, internal controls, and governance processes. Concerned with all aspects of the organization, both financial and non-financial, the internal auditors focus on future events as a result of their continuous review and evaluation of controls and processes. They also are concerned with the prevention of fraud in any form.

The primary mission of the external auditor is to provide an independent opinion on the organization's financial statements, annually. Their approach is historical in nature, as they assess whether the statements conform to generally accepted accounting principles, whether they fairly present the financial position of the organization, whether the results of operations for a given period of time are accurately represented, and whether the financial statements have been materially affected.

Is internal audit required?

Yes. The Five Point Plan legislation that became law on July 19, 2005 requires that all school districts over a certain size formally establish and put into operation an internal audit function.

Strengthening School Oversight

Working with a coalition of school and professional organizations, the New York State Comptroller's Office developed legislation to strengthen auditing, training and financial oversight by school district officials and boards.

The new law was created with the New York State School Boards Association (NYSSBA), the New York State Society of Certified Public Accountants (NYSSCPA), the New York State Council of School Superintendents (NYSCOSS), the New York State Association of School Business Officials (NYSASBO) and the State Education Department (SED). It includes the following provisions:

  • Requires six hours of training for school board members on their financial oversight responsibilities.
  • Establishes an internal audit function within each school district.
  • Creates audit committees in school districts.
  • Mandates a competitive RFP process for selecting audit firms at least every five years.
  • Improves the effectiveness of annual external audits by requiring direct school board involvement and a formal response to issues raised in the audit.

Elmira City School District Internal Audit

Elmira City School District Internal Audit communicates results and progress to the Board of Education through the Audit Committee, and directly to the Board of Education in some cases.

The initial mandatory Risk Assessment has been completed for The Elmira City School District. The Risk Assessment will be updated on an annual basis as called for by the details of the Five Point Plan. Internal Audit is currently operating on a five-year audit cycle, with a primary focus on the District's higher risk areas. Individual audits containing mandatory detailed testing of District internal controls are in progress.