S.B. 93 Enrolled

1

INTERNAL AUDIT AMENDMENTS
2 2014 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Howard A. Stephenson
5 House Sponsor: Steve Eliason
6
7 LONG TITLE
8 General Description:
9 This bill amends and enacts provisions related to the auditing of state agencies and local
10 education agencies.
11 Highlighted Provisions:
12 This bill:
13 . requires a local school board or charter school governing board to establish an audit
14 committee;
15 . requires a school audit committee to establish an internal audit program;
16 . defines terms;
17 . directs certain state agencies to establish internal audit programs;
18 . amends the powers and duties of an audit committee;
19 . amends the powers and duties of an agency internal audit director; and
20 . makes technical corrections.
21 Money Appropriated in this Bill:
22 None
23 Other Special Clauses:
24 None
25 Utah Code Sections Affected:
26 AMENDS:
27 63I-5-102 , as renumbered and amended by Laws of Utah 2008, Chapter 382
28 63I-5-301 , as renumbered and amended by Laws of Utah 2008, Chapter 382
29 63I-5-401 , as renumbered and amended by Laws of Utah 2008, Chapter 382

30 ENACTS:
31 53A-30-101 , Utah Code Annotated 1953
32 53A-30-102 , Utah Code Annotated 1953
33 53A-30-103 , Utah Code Annotated 1953
34 REPEALS AND REENACTS:
35 63I-5-201 , as last amended by Laws of Utah 2012, Chapters 212 and 365
36 63I-5-302 , as renumbered and amended by Laws of Utah 2008, Chapter 382
37
38 Be it enacted by the Legislature of the state of Utah:
39 Section 1. Section 53A-30-101 is enacted to read:
40 CHAPTER 30. INTERNAL AUDITS
41 53A-30-101. Title.
42 This chapter is known as "Internal Audits."
43 Section 2. Section 53A-30-102 is enacted to read:
44 53A-30-102. Definitions.
45 As used in this part:
46 (1) "Audit committee" means a standing committee:
47 (a) appointed by the local school board or charter school governing board with the
48 following number of members as applicable to the local school board or charter school
49 governing board:
50 (i) for a board of a local education agency that consists of seven or more members,
51 three members of that board; or
52 (ii) for a board of a local education agency that consists of six or fewer members, two
53 members of that board; and
54 (b) composed of people who are not administrators or employees of the local education
55 agency.
56 (2) "Audit director" means the person who directs the internal audit program.
57 (3) "Audit plan" means a prioritized list of audits to be performed by an internal audit

58 program within a specified period of time.
59 (4) "Internal audit" means an independent appraisal activity established within a local
60 education agency as a control system to examine and evaluate the adequacy and effectiveness
61 of other internal control systems within the local education agency.
62 (5) "Internal audit program" means an audit function that:
63 (a) is conducted by a local school board or charter school governing board independent
64 of the local education agency offices or other operations;
65 (b) objectively evaluates the effectiveness of the local education agency governance,
66 risk management, internal controls, and the efficiency of operations; and
67 (c) is conducted in accordance with the current:
68 (i) International Standards for the Professional Practice of Internal Auditing; or
69 (ii) The Government Auditing Standards, issued by the Comptroller General of the
70 United States.
71 (6) "Local education agency" means a school district or charter school.
72 Section 3. Section 53A-30-103 is enacted to read:
73 53A-30-103. Internal auditing program -- Audit committee -- Powers and duties.
74 (1) A local school board or charter school governing board shall establish an audit
75 committee.
76 (2) (a) The audit committee shall establish an internal audit program that provides
77 internal audit services for the programs administered by the local education agency.
78 (b) A local education agency that has fewer than 10,000 students is not subject to
79 Subsection (2)(a).
80 (3) (a) A local school board or charter school governing board shall appoint the audit
81 director, with the advisement of the audit committee, if the local school board or charter school
82 governing board hires an audit director.
83 (b) If the local school board or charter school governing board has not appointed an
84 audit director and the school board or governing board contracts directly for internal audit
85 services, the local school board or charter school governing board shall approve a contract for

86 internal audit services, with the advisement of the audit committee.
87 (4) The audit committee shall ensure that copies of all reports of audit findings issued
88 by the internal auditors are available, upon request, to the audit director of the State Board of
89 Education, the Office of the State Auditor, and the Office of Legislative Auditor General.
90 (5) The audit committee shall ensure that significant audit matters that cannot be
91 appropriately addressed by the local education agency internal auditors are referred to either the
92 audit director of the State Board of Education, the Office of the State Auditor, or the Office of
93 Legislative Auditor General.
94 (6) The audit director may contract with a consultant to assist with an audit.
95 (7) The audit director of the State Board of Education and the Office of the State
96 Auditor may contract to provide internal audit services.
97 Section 4. Section 63I-5-102 is amended to read:
98 63I-5-102. Definitions.
99 As used in this chapter:
100 [(6)] (1) "Agency governing board" is any board or commission that has policy making
101 and oversight responsibility over the agency, including the authority to appoint and remove the
102 agency director.
103 [(1)] (2) "Agency head" means a cabinet officer, an elected official, an executive
104 director, or a board or commission vested with responsibility to administer or make policy for a
105 state agency.
106 [(2)] (3) "Agency internal audit director" or "audit director" means the person
107 [appointed by the agency head, with the approval of the audit committee if one has been
108 established, to direct the internal audit function for the state agency.] who:
109 (a) directs the internal audit program for the state agency; and
110 (b) is appointed by the audit committee or, if no audit committee has been established,
111 by the agency head.
112 [(3)] (4) "Appointing authority" means:
113 (a) the governor, for state agencies other than the State Tax Commission;

114 (b) the Judicial Council, for judicial branch agencies;
115 (c) the Board of Regents, for higher education entities; [and]
116 (d) the State Board of Education, for the State Office of Education[.]; and
117 (e) the four tax commissioners, for the State Tax Commission.
118 [(4)] (5) "Audit committee" means a standing committee [whose] composed of
119 members who:
120 (a) are appointed by an appointing authority[:];
121 [(a) from members of the agency governing board; and]
122 (b) (i) [from individuals who] do not have administrative responsibilities within the
123 agency [who]; and
124 (ii) are not an agency contractor or other service provider; and
125 (c) have the expertise to provide effective oversight of and advice about internal audit
126 activities and services.
127 [(5)] (6) "Audit plan" means a prioritized list of audits to be performed by [the] an
128 internal audit [organization] program within a specified period of time.
129 (7) "Higher education entity" means the board of regents, the institutional councils of
130 each higher education institution, and each higher education institution.
131 (8) "Internal audit" means an independent appraisal activity established within a state
132 agency as a control system to examine and evaluate the adequacy and effectiveness of other
133 internal control systems within the agency.
134 (9) "Internal audit program" means an audit function that:
135 (a) is conducted by an agency, division, bureau, or office, independent of the agency,
136 division, bureau, or office operations;
137 (b) objectively evaluates the effectiveness of agency, division, bureau, or office
138 governance, risk management, internal controls, and the efficiency of operations; and
139 (c) is conducted in accordance with the current:
140 (i) International Standards for the Professional Practice of Internal Auditing; or
141 (ii) The Government Auditing Standards, issued by the Comptroller General of the

142 United States.
143 [(9)] (10) "Judicial branch agency" means each administrative entity of the judicial
144 branch.
145 [(10)] (11) (a) "State agency" means:
146 (i) each department, commission, board, council, agency, institution, officer,
147 corporation, fund, division, office, committee, authority, laboratory, library, unit, bureau, panel,
148 or other administrative unit of the state; and
149 (ii) each state public education entity.
150 (b) "State agency" does not mean:
151 (i) a legislative branch agency;
152 (ii) an independent state agency as defined in Section 63E-1-102 ;
153 (iii) a county, municipality, school district, local district, or special service district; or
154 (iv) any administrative subdivision of a county, municipality, school district, local
155 district, or special service district.
156 Section 5. Section 63I-5-201 is repealed and reenacted to read:
157 63I-5-201. Internal auditing programs -- State agencies.
158 (1) (a) The departments of Administrative Services, Agriculture, Commerce, Heritage
159 and Arts, Corrections, Workforce Services, Environmental Quality, Health, Human Services,
160 Natural Resources, Public Safety, and Transportation, and the State Tax Commission shall
161 conduct various types of auditing procedures as determined by the agency head or governor.
162 (b) The governor may, by executive order, require a state agency not described in
163 Subsection (1)(a) to establish an internal audit program.
164 (c) The governor shall ensure that each state agency that reports to the governor has
165 adequate internal audit coverage.
166 (2) (a) The Office of the Court Administrator shall establish an internal audit program
167 under the direction of the Judicial Council, including auditing procedures for courts not of
168 record.
169 (b) The Judicial Council may, by rule, require other judicial agencies to establish an

170 internal audit program.
171 (3) (a) Dixie State University, the University of Utah, Utah State University, Salt Lake
172 Community College, Southern Utah University, Utah Valley University, Weber State
173 University, and Snow College shall establish an internal audit program under the direction of
174 the Board of Regents.
175 (b) The State Board of Regents may issue policies requiring other higher education
176 entities or programs to establish an internal audit program.
177 (4) The State Office of Education shall establish under the direction of the State Board
178 of Education an internal audit program that provides internal audit services for each program
179 administered by the State Office of Education.
180 (5) Subject to Section 32B-2-302.5 , the internal audit division of the Department of
181 Alcoholic Beverage Control shall establish an internal audit program under the direction of the
182 Alcoholic Beverage Control Commission.
183 Section 6. Section 63I-5-301 is amended to read:
184 63I-5-301. Audit committee -- Powers and duties.
185 (1) (a) Each appointing authority may establish an audit committee to monitor the
186 activities of the agency internal audit [organization] program.
187 (b) An audit committee may serve more than one state agency internal audit program.
188 (2) The appointing authority shall ensure that audit committee members have the
189 expertise to provide effective oversight of and advice about internal audit activities and
190 services.
191 (3) If an audit committee has been established, the audit committee shall:
192 (a) [consent to the appointment or removal of] appoint, evaluate, and, if necessary,
193 remove the agency internal audit director [as proposed by the agency head];
194 (b) prepare and adopt formal policies that define:
195 (i) the purpose of the agency's internal audit program; and
196 (ii) the authority and responsibility of the agency's internal auditors;
197 (c) ensure that policies adopted under Subsection (3)(b):

198 (i) do not place limitations on the scope of the internal audit program's work; and
199 (ii) clarify that an auditor does not have authority or responsibility for an activity that
200 the auditor audits;
201 (d) ensure that:
202 (i) the audit director employs a sufficient number of professional and support staff to
203 implement an effective internal audit program;
204 (ii) compensation, training, job tenure, and advancement of internal auditing staff is
205 based upon job performance;
206 (iii) the audit director and staff collectively possess the knowledge, skills, and
207 experience essential to the practices of the profession and are proficient in applying internal
208 auditing standards, procedures, and techniques;
209 (iv) the internal audit program has employees who are qualified in disciplines
210 necessary to meet the audit responsibilities, including accounting, business management, public
211 administration, human resource management, economics, finance, statistics, electronic data
212 processing, or engineering;
213 (v) internal audit staff are free of operational and management responsibilities that
214 would impair their ability to make independent audits of any aspects of the agency's operations;
215 (vi) the audit director and the internal audit staff have access to all personnel and
216 records, data, and other agency information that the audit director or staff consider necessary to
217 carry out their assigned duties; and
218 (vii) that the audit director and the director's employees have the necessary access to
219 the agency head, agency management, and agency staff;
220 [(b)] (e) consent to the internal auditing policies proposed by the agency head;
221 [(c)] (f) review and approve the annual internal audit plan, modifications to the internal
222 audit plan, risk assessment, and budget;
223 [(d)] (g) review internal and external audit reports, follow-up reports, and quality
224 assurance reviews of the internal audit office; and
225 [(e)] (h) periodically meet with the agency internal audit director to discuss pertinent

226 matters, including whether there are any restrictions on the scope of audits.
227 Section 7. Section 63I-5-302 is repealed and reenacted to read:
228 63I-5-302. Agency head -- Powers and duties.
229 If an agency has an internal audit program, and the agency's appointing authority has
230 not established an audit committee, the agency head shall assume the audit committee powers
231 and duties described in Subsection 63I-5-303 (3).
232 Section 8. Section 63I-5-401 is amended to read:
233 63I-5-401. Duties and powers of the agency internal audit director.
234 (1) The agency internal audit director [may] shall:
235 (a) furnish independent analyses, appraisals, and recommendations that may,
236 depending upon the audit scope, identify:
237 (i) the adequacy of the state agency's systems of internal control;
238 (ii) the efficiency and effectiveness of agency management in carrying out assigned
239 responsibilities; and
240 (iii) the agency's compliance with applicable laws, rules, and regulations;
241 (b) submit audit reports directly to the agency head and to the audit committee, if one
242 has been established;
243 (c) conduct internal audits of state agency programs, activities, and functions that may
244 consist of one or more of the following objectives:
245 (i) to verify the accuracy and reliability of agency records;
246 (ii) to assess compliance with management policies, plans, procedures, and regulations;
247 (iii) to assess compliance with applicable laws, rules, and regulations;
248 (iv) to evaluate the efficient and effective use of agency resources; and
249 (v) to verify the appropriate protection of agency assets;
250 (d) prepare audit reports of findings;
251 (e) review and evaluate internal controls over the state agency's accounting systems,
252 administrative systems, electronic data processing systems, and all other major systems
253 necessary to ensure the fiscal and administrative accountability of the state agency;

254 (f) develop audit plans containing the information required by Subsection (2) to be
255 based on the findings of periodic risk assessments;
256 (g) upon request, make a copy of the approved audit plan available to the state auditor,
257 legislative auditor, or other appropriate external auditor to assist in planning and coordination
258 of any external financial, compliance, electronic data processing, or performance audit;
259 (h) determine the scope and assignment of the audits;
260 (i) perform an audit of a special program, activity, function, or organizational unit at
261 the direction of the agency head or, if one has been established, an audit committee;
262 (j) maintain the classification of any public records consistent with Title 63G, Chapter
263 2, Government Records Access and Management Act;
264 (k) be subject to the same penalties as the custodian of those public records for
265 violating Title 63G, Chapter 2, Government Records Access and Management Act; and
266 (l) identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts
267 of interest.
268 (2) (a) The audit plan required by this section shall:
269 (i) identify the individual audits to be conducted during each year;
270 (ii) identify the related resources to be devoted to each of the respective audits;
271 (iii) ensure that internal controls are reviewed periodically as determined by the agency
272 head or the audit committee, if one has been established; and
273 (iv) ensure that audits that evaluate the efficient and effective use of agency resources
274 are adequately represented in the plan.
275 (b) The agency internal audit director shall submit the audit plan to the agency head
276 and the audit committee, if one has been established, for approval.
277 (3) The agency internal audit director shall ensure that:
278 [(a) audits are conducted in accordance with professional auditing standards such as
279 those published by the Institute of Internal Auditors, Inc., the American Institute of Certified
280 Public Accountants and, when required by other law, regulation, agreement, contract, or policy,
281 in accordance with Government Auditing Standards, issued by the Comptroller General of the

282 United States;]
283 [(b)] (a) all reports of audit findings issued by internal audit staff shall include a
284 statement that the audit was conducted according to the appropriate standards;
285 [(c)] (b) public release of reports of audit findings comply with the conditions specified
286 by the state laws and rules governing the state agency;
287 [(d)] (c) copies of all reports of audit findings issued by the internal audit staff are
288 available, upon written request, to the Offices of the Legislative Auditor General and the Office
289 of the State Auditor [upon request]; and
290 [(e)] (d) significant audit matters that cannot be appropriately addressed by the agency
291 internal audit office are referred to either the Office of Legislative Auditor General or the
292 Office of the State Auditor.
293 (4) The agency internal audit director may contract with consultants to assist with
294 audits.