S.B. 93

1

INTERNAL AUDIT AMENDMENTS
2 2014 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Howard A. Stephenson
5 House Sponsor: Steve Eliason
6
7 LONG TITLE
8 General Description:
9 This bill establishes the Governor's Office of Internal Audit Services and amends
10 provisions related to the auditing of state agencies and school districts.
11 Highlighted Provisions:
12 This bill:
13 . defines terms;
14 . establishes the Governor's Office of Internal Audit Services;
15 . describes the powers and duties of the office and the governor's internal audit
16 director;
17 . directs certain state agencies and school districts to establish internal audit
18 programs;
19 . amends the powers and duties of an audit committee;
20 . amends the powers and duties of an agency internal audit director;
21 . enacts provisions related to the compensation of the governor's internal audit
22 director; and
23 . makes technical corrections.
24 Money Appropriated in this Bill:
25 None
26 Other Special Clauses:
27 None

28 Utah Code Sections Affected:
29 AMENDS:
30 63I-5-102 , as renumbered and amended by Laws of Utah 2008, Chapter 382
31 63I-5-301 , as renumbered and amended by Laws of Utah 2008, Chapter 382
32 63I-5-302 , as renumbered and amended by Laws of Utah 2008, Chapter 382
33 63I-5-401 , as renumbered and amended by Laws of Utah 2008, Chapter 382
34 67-22-2 , as last amended by Laws of Utah 2013, Chapters 214 and 310
35 ENACTS:
36 63I-5-202 , Utah Code Annotated 1953
37 63I-5-203 , Utah Code Annotated 1953
38 63I-5-204 , Utah Code Annotated 1953
39 REPEALS AND REENACTS:
40 63I-5-201 , as last amended by Laws of Utah 2012, Chapters 212 and 365
41
42 Be it enacted by the Legislature of the state of Utah:
43 Section 1. Section 63I-5-102 is amended to read:
44 63I-5-102. Definitions.
45 As used in this chapter:
46 [(6)] (1) "Agency governing board" is any board or commission that has policy making
47 and oversight responsibility over the agency, including the authority to appoint and remove the
48 agency director.
49 [(1)] (2) "Agency head" means:
50 (a) a cabinet officer, an elected official, an executive director, or a board or
51 commission vested with responsibility to administer or make policy for a state agency[.]; or
52 (b) for a school district, the local school board.
53 [(2)] (3) "Agency internal audit director" or "audit director" means the person
54 [appointed by the agency head, with the approval of the audit committee if one has been
55 established, to direct the internal audit function for the state agency.] who:
56 (a) directs the internal audit program for the state agency or a school district; and
57 (b) is appointed by:
58 (i) for a state agency, the agency head with approval of the audit committee if one has

59 been established: and
60 (ii) for a school district, the agency head.
61 [(3)] (4) "Appointing authority" means:
62 (a) the governor, for state agencies;
63 (b) the Judicial Council, for judicial branch agencies;
64 (c) the Board of Regents, for higher education entities; [and]
65 (d) the State Board of Education, for the State Office of Education[.]; and
66 (e) the local school board, for a school district.
67 [(4)] (5) "Audit committee" means a standing committee [whose] composed of
68 members who:
69 (a) are appointed by an appointing authority[:];
70 [(a) from members of the agency governing board; and]
71 (b) (i) [from individuals who] do not have administrative responsibilities within the
72 agency [who]; and
73 (ii) are not an agency contractor or other service provider; and
74 (c) have the expertise to provide effective oversight of and advice about internal audit
75 activities and services.
76 [(5)] (6) "Audit plan" means a prioritized list of audits to be performed by [the] an
77 internal audit [organization] program within a specified period of time.
78 (7) "Governor's internal audit director" means the governor's internal audit director
79 appointed in accordance with Section 63I-5-202 .
80 [(7)] (8) "Higher education entity" means the board of regents, the institutional
81 councils of each higher education institution, and each higher education institution.
82 [(8)] (9) "Internal audit" means an independent appraisal activity established within a
83 state agency as a control system to examine and evaluate the adequacy and effectiveness of
84 other control systems within the agency.
85 (10) "Internal audit program" means an audit function that:
86 (a) is conducted by an agency, division, bureau, or office, independent of the agency,
87 division, bureau, or office operations; and
88 (b) objectively evaluates the effectiveness of agency, division, bureau, or office
89 governance, risk management, and controls, and the efficiency of operations.

90 [(9)] (11) "Judicial branch agency" means each administrative entity of the judicial
91 branch.
92 [(10)] (12) (a) "State agency" means:
93 (i) each department, commission, board, council, agency, institution, officer,
94 corporation, fund, division, office, committee, authority, laboratory, library, unit, bureau, panel,
95 or other administrative unit of the state; and
96 (ii) each state public education entity.
97 (b) "State agency" does not mean:
98 (i) a legislative branch agency;
99 (ii) an independent agency;
100 (iii) a county, municipality, school district, local district, or special service district; or
101 (iv) any administrative subdivision of a county, municipality, school district, local
102 district, or special service district.
103 Section 2. Section 63I-5-201 is repealed and reenacted to read:
104 Part 2. Governor's Office of Internal Audit Services - Internal Auditing Programs
105 63I-5-201. Governor's Office of Internal Audit Services -- Creation.
106 There is created within the governor's office the Governor's Office of Internal Audit
107 Services to be administered by the governor's internal audit director.
108 Section 3. Section 63I-5-202 is enacted to read:
109 63I-5-202. Appointment of governor's internal audit director.
110 (1) (a) If an audit committee is appointed by the governor as the appointing authority,
111 the audit committee shall appoint, to serve at the committee's pleasure, the governor's internal
112 audit director of the Governor's Office of Internal Audit services.
113 (b) If no audit committee exists, the governor shall appoint, to serve at the governor's
114 pleasure, the governor's internal audit director of the Governor's Office of Internal Audit
115 Services.
116 (2) If in accordance with Subsection (1) an audit committee or the governor appoints
117 the governor's internal audit director, the audit committee or governor, as applicable, shall
118 establish the director's salary within the salary range fixed by the Legislature in Title 67,
119 Chapter 22, State Officer Compensation.
120 Section 4. Section 63I-5-203 is enacted to read:

121 63I-5-203. Powers and duties of office and director.
122 (1) The Governor's Office of Internal Audit Services shall have sufficient qualified
123 staff and resources to perform internal audit duties.
124 (2) (a) (i) The Governor's Office of Internal Audit Services shall provide an audit
125 program for a state agency or office that does not have an internal audit program and that is
126 under the control of the governor or the lieutenant governor.
127 (ii) An agency or office described in Subsection (2)(a)(i) does not include a legislative
128 branch agency or office, a judicial branch agency or office, the Office of the Attorney General,
129 the Office of the State Treasurer, the Office of the State Auditor, or another agency or office
130 that is not under the control of the governor or the lieutenant governor.
131 (b) (i) The powers and jurisdiction of the Governor's Office of Internal Audit Services
132 and the governor's internal audit director are limited to a state agency or state program other
133 than an agency or program described in Section 63I-5-204 .
134 (ii) Notwithstanding Subsection (2)(b)(i), the Governor's Office of Internal Audit
135 Services and the governor's internal audit director shall conduct an audit of a state agency or
136 state program described in Section 63I-5-204 at the request of the governor or the lieutenant
137 governor.
138 (3) The governor's internal audit director or the director's designee shall:
139 (a) perform various audit functions, including performance audits, financial audits,
140 compliance audits, technology audits, and other audits that add value to an audited state
141 agency's mission;
142 (b) have access to all records, data, and personnel in each state agency;
143 (c) report an audit finding to the governor or, if established, an audit committee;
144 (d) conduct risk-based audits on a state agency that does not have an internal audit
145 program; and
146 (e) coordinate training opportunities and staff sharing with another state agency that
147 has an internal auditor.
148 Section 5. Section 63I-5-204 is enacted to read:
149 63I-5-204. Internal auditing programs -- State agencies -- School districts.
150 (1) (a) If a director of an agency serves in the governor's cabinet, the director or the
151 governor shall establish an internal audit program for the respective agency.

152 (b) The governor may, by executive order, require a state agency not described in
153 Subsection (1)(a) to establish an internal audit program.
154 (c) An audit program established for an agency by the Governor's Office of Internal
155 Audit Services may fulfill the requirements of Subsection (1)(a).
156 (2) (a) The Office of the Court Administrator shall establish an internal audit program
157 under the direction of the Judicial Council, including auditing procedures for courts not of
158 record.
159 (b) The Judicial Council may, by rule, require other judicial agencies to establish an
160 internal audit program.
161 (3) (a) Dixie State University, the University of Utah, Utah State University, Salt Lake
162 Community College, Southern Utah University, Utah Valley University, Weber State
163 University, and Snow College shall establish an internal audit program under the direction of
164 the Board of Regents.
165 (b) The State Board of Regents may issue policies requiring other higher education
166 entities or programs to establish an internal audit program.
167 (4) The State Office of Education shall establish under the direction of the State Board
168 of Education an internal audit program that provides internal audit services for each program
169 administered by the State Office of Education.
170 (5) Subject to Section 32B-2-302.5 , the internal audit division of the Department of
171 Alcoholic Beverage Control shall establish an internal audit program under the direction of the
172 Alcoholic Beverage Control Commission.
173 (6) The local school board of a school district shall establish an internal audit program.
174 Section 6. Section 63I-5-301 is amended to read:
175 63I-5-301. Audit committee -- Powers and duties.
176 (1) (a) Each appointing authority may establish an audit committee to monitor the
177 activities of the agency internal audit [organization] program.
178 (b) An audit committee may serve more than one state agency internal audit program.
179 (c) The appointing authority that establishes an audit committee for a school district
180 shall appoint to the audit committee no fewer than:
181 (i) three members for a seven-member local school board; and
182 (ii) two members for a five-member local school board.

183 (d) An audit committee member described in Subsection (1)(c) may not be a school
184 administrator or employee of the school district.
185 (2) The appointing authority shall ensure that audit committee members have the
186 expertise to provide effective oversight of and advice about internal audit activities and
187 services.
188 (3) If an audit committee has been established, the audit committee shall:
189 (a) [consent to the appointment or removal of] appoint, evaluate, and, if necessary,
190 remove the agency internal audit director [as proposed by the agency head] or governor's
191 internal audit director, as applicable;
192 (b) consent to the internal auditing policies proposed by the agency head;
193 (c) review and approve the annual internal audit plan, modifications to the internal
194 audit plan, risk assessment, and budget;
195 (d) review internal and external audit reports, follow-up reports, and quality assurance
196 reviews of the internal audit office; and
197 (e) periodically meet with the agency internal audit director to discuss pertinent
198 matters, including whether there are any restrictions on the scope of audits.
199 Section 7. Section 63I-5-302 is amended to read:
200 63I-5-302. Agency head -- Powers and duties.
201 (1) For each agency that establishes an internal audit program, the agency head shall:
202 (a) prepare and adopt, or if an audit committee has been established, propose to the
203 audit committee, a formal policy that defines:
204 (i) the purpose of the agency's internal audit program;
205 (ii) the authority and responsibility of the agency's internal auditors; and
206 (b) ensure that the policy:
207 (i) places no limitations on the scope of the internal audit department's work; and
208 (ii) declares that auditors are to have no authority or responsibility for the activities
209 they audit.
210 (2) The agency head of an agency that establishes an internal audit program shall
211 appoint or employ an agency internal audit director:
212 (a) for a state agency, with the consent of the audit committee, if an audit committee
213 has been established[.]; and

214 (b) for a school district, without the consent of the audit committee.
215 (3) The agency head of an agency that establishes an internal audit program shall
216 ensure that:
217 (a) the audit director is allowed to employ a sufficient number of professional and
218 support staff to implement an effective program of internal auditing;
219 (b) compensation, training, job tenure, and advancement of internal auditing staff is
220 based upon job performance;
221 (c) the audit director and staff collectively possess the knowledge, skills, and
222 experience essential to the practices of the profession and are proficient in applying internal
223 auditing standards, procedures, and techniques;
224 (d) the internal audit [organization] program has employees who are qualified in
225 disciplines such as accounting, business management, public administration, human resource
226 management, economics, finance, statistics, electronic data processing, engineering, and law as
227 needed to meet the audit responsibilities;
228 (e) internal audit staff are free of operational and management responsibilities that
229 would impair their ability to make independent audits of any aspects of the agency's operations;
230 (f) the audit director and the internal audit staff have access to all personnel and any
231 records, data, and other information of the [state] agency that they consider necessary to carry
232 out their assigned duties; and
233 (g) the agency internal audit director reports to the agency head and to the audit
234 committee, if one has been established, and has freedom of access to the agency head to ensure
235 that the director is responsive to the agency head's specific requests, directions, and needs.
236 [(4) The agency internal audit director may, within budgetary constraints, contract with
237 consultants to assist with audits.]
238 [(5)] (4) The agency head of an agency that establishes an internal audit program shall
239 either:
240 (a) approve the annual internal audit plan and budget prepared by the agency internal
241 audit director; or
242 (b) if an audit committee has been established, review the plan and budget and submit
243 them to the audit committee for approval.
244 Section 8. Section 63I-5-401 is amended to read:

245 63I-5-401. Duties and powers of the agency internal audit director.
246 (1) The agency internal audit director [may] and the governor's internal audit director
247 shall:
248 (a) furnish independent analyses, appraisals, and recommendations that may,
249 depending upon the audit scope, identify:
250 (i) the adequacy of the state agency's systems of internal control;
251 (ii) the efficiency and effectiveness of agency management in carrying out assigned
252 responsibilities; and
253 (iii) the agency's compliance with applicable laws, rules, and regulations;
254 (b) submit audit reports directly to the agency head and to the audit committee, if one
255 has been established;
256 (c) conduct internal audits of state agency programs, activities, and functions that may
257 consist of one or more of the following objectives:
258 (i) to verify the accuracy and reliability of agency records;
259 (ii) to assess compliance with management policies, plans, procedures, and regulations;
260 (iii) to assess compliance with applicable laws, rules, and regulations;
261 (iv) to evaluate the efficient and effective use of agency resources; and
262 (v) to verify the appropriate protection of agency assets;
263 (d) prepare audit reports of findings;
264 (e) review and evaluate internal controls over the state agency's accounting systems,
265 administrative systems, electronic data processing systems, and all other major systems
266 necessary to ensure the fiscal and administrative accountability of the state agency;
267 (f) develop audit plans containing the information required by Subsection (2) to be
268 based on the findings of periodic risk assessments;
269 (g) upon request, make a copy of the approved audit plan available to the state auditor,
270 legislative auditor, or other appropriate external auditor to assist in planning and coordination
271 of any external financial, compliance, electronic data processing, or performance audit;
272 (h) determine the scope and assignment of the audits;
273 (i) perform an audit of a special program, activity, function, or organizational unit at
274 the direction of the agency head or, if one has been established, an audit committee;
275 (j) maintain the classification of any public records consistent with Title 63G, Chapter

276 2, Government Records Access and Management Act;
277 (k) be subject to the same penalties as the custodian of those public records for
278 violating Title 63G, Chapter 2, Government Records Access and Management Act; and
279 (l) identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts
280 of interest.
281 (2) (a) The audit plan required by this section shall:
282 (i) identify the individual audits to be conducted during each year;
283 (ii) identify the related resources to be devoted to each of the respective audits;
284 (iii) ensure that internal controls are reviewed periodically as determined by the agency
285 head or the audit committee, if one has been established; and
286 (iv) ensure that audits that evaluate the efficient and effective use of agency resources
287 are adequately represented in the plan.
288 (b) The agency internal audit director shall submit the audit plan to the agency head
289 and the audit committee, if one has been established, for approval.
290 (3) The agency internal audit director shall ensure that:
291 (a) audits are conducted in accordance with professional auditing standards such as
292 those published by the Institute of Internal Auditors, Inc., the American Institute of Certified
293 Public Accountants and, when required by other law, regulation, agreement, contract, or policy,
294 in accordance with Government Auditing Standards, issued by the Comptroller General of the
295 United States;
296 (b) all reports of audit findings issued by internal audit staff shall include a statement
297 that the audit was conducted according to the appropriate standards;
298 (c) public release of reports of audit findings comply with the conditions specified by
299 the state laws and rules governing the state agency;
300 (d) copies of all reports of audit findings issued by the internal audit staff are available,
301 upon request, to the Offices of the Legislative Auditor General [and], the Office of the State
302 Auditor [upon request], and the governor's internal audit director; and
303 (e) significant audit matters that cannot be appropriately addressed by the agency
304 internal audit office are referred to either the Office of Legislative Auditor General [or], the
305 Office of the State Auditor, or the Governor's Office of Internal Audit Services.
306 (4) The agency internal audit director may contract with consultants to assist with

307 audits.
308 Section 9. Section 67-22-2 is amended to read:
309 67-22-2. Compensation -- Other state officers.
310 (1) As used in this section:
311 (a) "Appointed executive" means the:
312 (i) Commissioner of the Department of Agriculture and Food;
313 (ii) Commissioner of the Insurance Department;
314 (iii) Commissioner of the Labor Commission;
315 (iv) Director, Department of Alcoholic Beverage Control;
316 (v) Commissioner of the Department of Financial Institutions;
317 (vi) Executive Director, Department of Commerce;
318 (vii) Executive Director, Commission on Criminal and Juvenile Justice;
319 (viii) Adjutant General;
320 (ix) Executive Director, Department of Heritage and Arts;
321 (x) Executive Director, Department of Corrections;
322 (xi) Commissioner, Department of Public Safety;
323 (xii) Executive Director, Department of Natural Resources;
324 (xiii) Executive Director, Governor's Office of Management and Budget;
325 (xiv) Executive Director, Department of Administrative Services;
326 (xv) Executive Director, Department of Human Resource Management;
327 (xvi) Executive Director, Department of Environmental Quality;
328 (xvii) Director, Governor's Office of Economic Development;
329 (xviii) Governor's Internal Audit Director, Governor's Office of Internal Audit
330 Services;
331 [(xviii)] (xix) Executive Director, Utah Science Technology and Research Governing
332 Authority;
333 [(xix)] (xx) Executive Director, Department of Workforce Services;
334 [(xx)] (xxi) Executive Director, Department of Health, Nonphysician;
335 [(xxi)] (xxii) Executive Director, Department of Human Services;
336 [(xxii)] (xxiii) Executive Director, Department of Transportation;
337 [(xxiii)] (xxiv) Executive Director, Department of Technology Services; and

338 [(xxiv)] (xxv) Executive Director, Department of Veterans' and Military Affairs.
339 (b) "Board or commission executive" means:
340 (i) Members, Board of Pardons and Parole;
341 (ii) Chair, State Tax Commission;
342 (iii) Commissioners, State Tax Commission;
343 (iv) Executive Director, State Tax Commission;
344 (v) Chair, Public Service Commission; and
345 (vi) Commissioners, Public Service Commission.
346 (c) "Deputy" means the person who acts as the appointed executive's second in
347 command as determined by the Department of Human Resource Management.
348 (2) (a) The executive director of the Department of Human Resource Management
349 shall:
350 (i) before October 31 of each year, recommend to the governor a compensation plan for
351 the appointed executives and the board or commission executives; and
352 (ii) base those recommendations on market salary studies conducted by the Department
353 of Human Resource Management.
354 (b) (i) The Department of Human Resource Management shall determine the salary
355 range for the appointed executives by:
356 (A) identifying the salary range assigned to the appointed executive's deputy;
357 (B) designating the lowest minimum salary from those deputies' salary ranges as the
358 minimum salary for the appointed executives' salary range; and
359 (C) designating 105% of the highest maximum salary range from those deputies' salary
360 ranges as the maximum salary for the appointed executives' salary range.
361 (ii) If the deputy is a medical doctor, the Department of Human Resource Management
362 may not consider that deputy's salary range in designating the salary range for appointed
363 executives.
364 (c) In establishing the salary ranges for board or commission executives, the
365 Department of Human Resource Management shall set the maximum salary in the salary range
366 for each of those positions at 90% of the salary for district judges as established in the annual
367 appropriation act under Section 67-8-2 .
368 (3) (a) (i) Except as provided in Subsection (3)(a)(ii), the governor shall establish a

369 specific salary for each appointed executive within the range established under Subsection
370 (2)(b).
371 (ii) If the executive director of the Department of Health is a physician, the governor
372 shall establish a salary within the highest physician salary range established by the Department
373 of Human Resource Management.
374 (iii) The governor may provide salary increases for appointed executives within the
375 range established by Subsection (2)(b) and identified in Subsection (3)(a)(ii).
376 (b) The governor shall apply the same overtime regulations applicable to other FLSA
377 exempt positions.
378 (c) The governor may develop standards and criteria for reviewing the appointed
379 executives.
380 (4) Salaries for other Schedule A employees, as defined in Section 67-19-15 , that are
381 not provided for in this chapter, or in Title 67, Chapter 8, Utah Elected Official and Judicial
382 Salary Act, shall be established as provided in Section 67-19-15 .
383 (5) (a) The Legislature fixes benefits for the appointed executives and the board or
384 commission executives as follows:
385 (i) the option of participating in a state retirement system established by Title 49, Utah
386 State Retirement and Insurance Benefit Act, or in a deferred compensation plan administered
387 by the State Retirement Office in accordance with the Internal Revenue Code and its
388 accompanying rules and regulations;
389 (ii) health insurance;
390 (iii) dental insurance;
391 (iv) basic life insurance;
392 (v) unemployment compensation;
393 (vi) workers' compensation;
394 (vii) required employer contribution to Social Security;
395 (viii) long-term disability income insurance;
396 (ix) the same additional state-paid life insurance available to other noncareer service
397 employees;
398 (x) the same severance pay available to other noncareer service employees;
399 (xi) the same leave, holidays, and allowances granted to Schedule B state employees as

400 follows:
401 (A) sick leave;
402 (B) converted sick leave if accrued prior to January 1, 2014;
403 (C) educational allowances;
404 (D) holidays; and
405 (E) annual leave except that annual leave shall be accrued at the maximum rate
406 provided to Schedule B state employees;
407 (xii) the option to convert accumulated sick leave to cash or insurance benefits as
408 provided by law or rule upon resignation or retirement according to the same criteria and
409 procedures applied to Schedule B state employees;
410 (xiii) the option to purchase additional life insurance at group insurance rates according
411 to the same criteria and procedures applied to Schedule B state employees; and
412 (xiv) professional memberships if being a member of the professional organization is a
413 requirement of the position.
414 (b) Each department shall pay the cost of additional state-paid life insurance for its
415 executive director from its existing budget.
416 (6) The Legislature fixes the following additional benefits:
417 (a) for the executive director of the State Tax Commission a vehicle for official and
418 personal use;
419 (b) for the executive director of the Department of Transportation a vehicle for official
420 and personal use;
421 (c) for the executive director of the Department of Natural Resources a vehicle for
422 commute and official use;
423 (d) for the Commissioner of Public Safety:
424 (i) an accidental death insurance policy if POST certified; and
425 (ii) a public safety vehicle for official and personal use;
426 (e) for the executive director of the Department of Corrections:
427 (i) an accidental death insurance policy if POST certified; and
428 (ii) a public safety vehicle for official and personal use;
429 (f) for the Adjutant General a vehicle for official and personal use; and
430 (g) for each member of the Board of Pardons and Parole a vehicle for commute and

431 official use.




Legislative Review Note
as of 2-3-14 8:29 AM

Office of Legislative Research and General Counsel