First Substitute S.B. 93

Senator Howard A. Stephenson proposes the following substitute bill:

1 INTERNAL AUDIT AMENDMENTS
2 2014 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Howard A. Stephenson
5 House Sponsor: Steve Eliason
6
7 LONG TITLE
8 General Description:
9 This bill establishes the Governor's Office of Internal Audit Services and amends and
10 enacts provisions related to the auditing of state agencies and school districts.
11 Highlighted Provisions:
12 This bill:
13 . requires a local school board to establish an audit committee;
14 . requires a school audit committee to establish an internal audit program;
15 . defines terms;
16 . establishes the Governor's Office of Internal Audit Services;
17 . describes the powers and duties of the office and the governor's internal audit
18 director;
19 . directs certain state agencies to establish internal audit programs;
20 . amends the powers and duties of an audit committee;
21 . amends the powers and duties of an agency internal audit director;
22 . enacts provisions related to the compensation of the governor's internal audit
23 director; and
24 . makes technical corrections.
25 Money Appropriated in this Bill:

26 None
27 Other Special Clauses:
28 None
29 Utah Code Sections Affected:
30 AMENDS:
31 63I-5-102 , as renumbered and amended by Laws of Utah 2008, Chapter 382
32 63I-5-301 , as renumbered and amended by Laws of Utah 2008, Chapter 382
33 63I-5-401 , as renumbered and amended by Laws of Utah 2008, Chapter 382
34 67-22-2 , as last amended by Laws of Utah 2013, Chapters 214 and 310
35 ENACTS:
36 53A-3-801 , Utah Code Annotated 1953
37 53A-3-802 , Utah Code Annotated 1953
38 53A-3-803 , Utah Code Annotated 1953
39 63I-5-202 , Utah Code Annotated 1953
40 63I-5-203 , Utah Code Annotated 1953
41 63I-5-204 , Utah Code Annotated 1953
42 REPEALS AND REENACTS:
43 63I-5-201 , as last amended by Laws of Utah 2012, Chapters 212 and 365
44 63I-5-302 , as renumbered and amended by Laws of Utah 2008, Chapter 382
45
46 Be it enacted by the Legislature of the state of Utah:
47 Section 1. Section 53A-3-801 is enacted to read:
48 Part 8. Internal Audits
49 53A-3-801. Title.
50 This part is known as "Internal Audits."
51 Section 2. Section 53A-3-802 is enacted to read:
52 53A-3-802. Definitions.
53 As used in this part:
54 (1) "Audit committee" means a standing committee:
55 (a) appointed by the local school board with the following number of members:
56 (i) three members of a seven-member local school board; or

57 (ii) two members of a five-member local school board; and
58 (b) composed of people who are not administrators or employees of the school district.
59 (2) "Audit director" means the person who directs the internal audit program.
60 (3) "Audit plan" means a prioritized list of audits to be performed by an internal audit
61 program within a specified period of time.
62 (4) "Internal audit" means an independent appraisal activity established within a school
63 district as a control system to examine and evaluate the adequacy and effectiveness of other
64 internal control systems within the school district.
65 (5) "Internal audit program" means an audit function that:
66 (a) is conducted by a local school board independent of the school district offices or
67 other operations; and
68 (b) objectively evaluates the effectiveness of the school district governance, risk
69 management, internal controls, and the efficiency of operations.
70 Section 3. Section 53A-3-803 is enacted to read:
71 53A-3-803. Internal auditing program -- Audit committee -- Powers and duties.
72 (1) A local school board shall establish an audit committee.
73 (2) The audit committee shall establish an internal audit program that provides internal
74 audit services for the programs administered by the school district.
75 (3) (a) A local school board shall appoint the audit director, with the advisement of the
76 audit committee, if the school board hires an audit director.
77 (b) If the school board has not appointed an audit director and the school board
78 contracts directly for internal audit services, the local school board shall approve a contract for
79 internal audit services, with the advisement of the audit committee.
80 (4) The audit committee shall ensure that copies of all reports of audit findings issued
81 by the internal auditors are available, upon request, to the audit director of the State Board of
82 Education, the Office of the State Auditor, and the Offices of the Legislative Auditor General.
83 (5) The audit committee shall ensure that significant audit matters that cannot be
84 appropriately addressed by the school district internal auditors are referred to either the audit
85 director of the State Board of Education, the Office of the State Auditor, or the Offices of the
86 Legislative Auditor General.
87 (6) The audit director may contract with a consultant to assist with an audit.

88 Section 4. Section 63I-5-102 is amended to read:
89 63I-5-102. Definitions.
90 As used in this chapter:
91 [(6)] (1) "Agency governing board" is any board or commission that has policy making
92 and oversight responsibility over the agency, including the authority to appoint and remove the
93 agency director.
94 [(1)] (2) "Agency head" means a cabinet officer, an elected official, an executive
95 director, or a board or commission vested with responsibility to administer or make policy for a
96 state agency.
97 [(2)] (3) "Agency internal audit director" or "audit director" means the person
98 [appointed by the agency head, with the approval of the audit committee if one has been
99 established, to direct the internal audit function for the state agency.] who:
100 (a) directs the internal audit program for the state agency; and
101 (b) is appointed by the agency head with approval of the audit committee if one has
102 been established.
103 [(3)] (4) "Appointing authority" means:
104 (a) the governor, for state agencies;
105 (b) the Judicial Council, for judicial branch agencies;
106 (c) the Board of Regents, for higher education entities; and
107 (d) the State Board of Education, for the State Office of Education.
108 [(4)] (5) "Audit committee" means a standing committee [whose] composed of
109 members who:
110 (a) are appointed by an appointing authority[:];
111 [(a) from members of the agency governing board; and]
112 (b) (i) [from individuals who] do not have administrative responsibilities within the
113 agency [who]; and
114 (ii) are not an agency contractor or other service provider; and
115 (c) have the expertise to provide effective oversight of and advice about internal audit
116 activities and services.
117 [(5)] (6) "Audit plan" means a prioritized list of audits to be performed by [the] an
118 internal audit [organization] program within a specified period of time.

119 (7) "Governor's internal audit director" means the governor's internal audit director
120 appointed in accordance with Section 63I-5-202 .
121 [(7)] (8) "Higher education entity" means the board of regents, the institutional
122 councils of each higher education institution, and each higher education institution.
123 [(8)] (9) "Internal audit" means an independent appraisal activity established within a
124 state agency as a control system to examine and evaluate the adequacy and effectiveness of
125 other internal control systems within the agency.
126 (10) "Internal audit program" means an audit function that:
127 (a) is conducted by an agency, division, bureau, or office, independent of the agency,
128 division, bureau, or office operations; and
129 (b) objectively evaluates the effectiveness of agency, division, bureau, or office
130 governance, risk management, internal controls, and the efficiency of operations.
131 [(9)] (11) "Judicial branch agency" means each administrative entity of the judicial
132 branch.
133 [(10)] (12) (a) "State agency" means:
134 (i) each department, commission, board, council, agency, institution, officer,
135 corporation, fund, division, office, committee, authority, laboratory, library, unit, bureau, panel,
136 or other administrative unit of the state; and
137 (ii) each state public education entity.
138 (b) "State agency" does not mean:
139 (i) a legislative branch agency;
140 (ii) an independent agency;
141 (iii) a county, municipality, school district, local district, or special service district; or
142 (iv) any administrative subdivision of a county, municipality, school district, local
143 district, or special service district.
144 Section 5. Section 63I-5-201 is repealed and reenacted to read:
145 Part 2. Governor's Office of Internal Audit Services - Internal Auditing Programs
146 63I-5-201. Governor's Office of Internal Audit Services -- Creation.
147 There is created within the governor's office the Governor's Office of Internal Audit
148 Services to be administered by the governor's internal audit director.
149 Section 6. Section 63I-5-202 is enacted to read:

150 63I-5-202. Appointment of governor's internal audit director.
151 (1) (a) If an audit committee is appointed by the governor as the appointing authority,
152 the audit committee shall appoint, to serve at the committee's pleasure, the governor's internal
153 audit director of the Governor's Office of Internal Audit Services.
154 (b) If no audit committee exists, the governor shall appoint, to serve at the governor's
155 pleasure, the governor's internal audit director of the Governor's Office of Internal Audit
156 Services.
157 (2) If in accordance with Subsection (1) an audit committee or the governor appoints
158 the governor's internal audit director, the audit committee or governor, as applicable, shall
159 establish the director's salary within the salary range fixed by the Legislature in Title 67,
160 Chapter 22, State Officer Compensation.
161 Section 7. Section 63I-5-203 is enacted to read:
162 63I-5-203. Powers and duties of office and director.
163 (1) The Governor's Office of Internal Audit Services shall have sufficient qualified
164 staff and resources to perform internal audit duties.
165 (2) (a) (i) The Governor's Office of Internal Audit Services shall provide an audit
166 program for a state agency or office that does not have an internal audit program and that is
167 under the control of the governor or the lieutenant governor.
168 (ii) An agency or office described in Subsection (2)(a)(i) does not include a legislative
169 branch agency or office, a judicial branch agency or office, the Office of the Attorney General,
170 the Office of the State Treasurer, the Office of the State Auditor, or another agency or office
171 that is not under the control of the governor or the lieutenant governor.
172 (b) (i) The powers and jurisdiction of the Governor's Office of Internal Audit Services
173 and the governor's internal audit director are limited to a state agency or state program other
174 than an agency or program described in Section 63I-5-204 .
175 (ii) Notwithstanding Subsection (2)(b)(i), the Governor's Office of Internal Audit
176 Services and the governor's internal audit director shall conduct an audit of a state agency or
177 state program described in Section 63I-5-204 at the request of the governor or the lieutenant
178 governor.
179 (3) The governor's internal audit director or the director's designee shall:
180 (a) perform various audit functions, including performance audits, financial audits,

181 compliance audits, technology audits, and other audits that add value to an audited state
182 agency's mission;
183 (b) have access to all records, data, and personnel in each state agency;
184 (c) report an audit finding to the governor or, if established, an audit committee;
185 (d) conduct risk-based audits on a state agency that does not have an internal audit
186 program; and
187 (e) coordinate training opportunities and staff sharing with another state agency that
188 has an internal auditor.
189 Section 8. Section 63I-5-204 is enacted to read:
190 63I-5-204. Internal auditing programs -- State agencies.
191 (1) (a) If a director of an agency serves in the governor's cabinet, the director or the
192 governor shall establish an internal audit program for the respective agency.
193 (b) The governor may, by executive order, require a state agency not described in
194 Subsection (1)(a) to establish an internal audit program.
195 (c) An audit program established for an agency by the Governor's Office of Internal
196 Audit Services may fulfill the requirements of Subsection (1)(a).
197 (2) (a) The Office of the Court Administrator shall establish an internal audit program
198 under the direction of the Judicial Council, including auditing procedures for courts not of
199 record.
200 (b) The Judicial Council may, by rule, require other judicial agencies to establish an
201 internal audit program.
202 (3) (a) Dixie State University, the University of Utah, Utah State University, Salt Lake
203 Community College, Southern Utah University, Utah Valley University, Weber State
204 University, and Snow College shall establish an internal audit program under the direction of
205 the Board of Regents.
206 (b) The State Board of Regents may issue policies requiring other higher education
207 entities or programs to establish an internal audit program.
208 (4) The State Office of Education shall establish under the direction of the State Board
209 of Education an internal audit program that provides internal audit services for each program
210 administered by the State Office of Education.
211 (5) Subject to Section 32B-2-302.5 , the internal audit division of the Department of

212 Alcoholic Beverage Control shall establish an internal audit program under the direction of the
213 Alcoholic Beverage Control Commission.
214 Section 9. Section 63I-5-301 is amended to read:
215 63I-5-301. Audit committee -- Powers and duties.
216 (1) (a) Each appointing authority may establish an audit committee to monitor the
217 activities of the agency internal audit [organization] program.
218 (b) An audit committee may serve more than one state agency internal audit program.
219 (2) The appointing authority shall ensure that audit committee members have the
220 expertise to provide effective oversight of and advice about internal audit activities and
221 services.
222 (3) If an audit committee has been established, the audit committee shall:
223 (a) [consent to the appointment or removal of] appoint, evaluate, and, if necessary,
224 remove the agency internal audit director [as proposed by the agency head] or governor's
225 internal audit director, as applicable;
226 (b) prepare and adopt formal policies that define:
227 (i) the purpose of the agency's internal audit program; and
228 (ii) the authority and responsibility of the agency's internal auditors;
229 (c) ensure that policies adopted under Subsection (3)(b):
230 (i) do not place limitations on the scope of the internal audit program's work; and
231 (ii) clarify that an auditor does not have authority or responsibility for an activity that
232 the auditor audits;
233 (d) ensure that:
234 (i) the audit director employs a sufficient number of professional and support staff to
235 implement an effective internal audit program;
236 (ii) compensation, training, job tenure, and advancement of internal auditing staff is
237 based upon job performance;
238 (iii) the audit director and staff collectively possess the knowledge, skills, and
239 experience essential to the practices of the profession and are proficient in applying internal
240 auditing standards, procedures, and techniques;
241 (iv) the internal audit program has employees who are qualified in disciplines
242 necessary to meet the audit responsibilities, including accounting, business management, public

243 administration, human resource management, economics, finance, statistics, electronic data
244 processing, or engineering;
245 (v) internal audit staff are free of operational and management responsibilities that
246 would impair their ability to make independent audits of any aspects of the agency's operations;
247 (vi) the audit director and the internal audit staff have access to all personnel and
248 records, data, and other agency information that the audit director or staff consider necessary to
249 carry out their assigned duties; and
250 (vii) that the audit director and the director's employees have the necessary access to
251 the agency head, agency management, and agency staff;
252 [(b)] (e) consent to the internal auditing policies proposed by the agency head;
253 [(c)] (f) review and approve the annual internal audit plan, modifications to the internal
254 audit plan, risk assessment, and budget;
255 [(d)] (g) review internal and external audit reports, follow-up reports, and quality
256 assurance reviews of the internal audit office; and
257 [(e)] (h) periodically meet with the agency internal audit director to discuss pertinent
258 matters, including whether there are any restrictions on the scope of audits.
259 Section 10. Section 63I-5-302 is repealed and reenacted to read:
260 63I-5-302. Agency head -- Powers and duties.
261 If an agency has an internal audit program, and the agency's appointing authority has
262 not established an audit committee, the agency head shall assume the audit committee powers
263 and duties described in Subsection 63I-5-303 (3).
264 Section 11. Section 63I-5-401 is amended to read:
265 63I-5-401. Duties and powers of the agency internal audit director.
266 (1) The agency internal audit director [may] and the governor's internal audit director
267 shall:
268 (a) furnish independent analyses, appraisals, and recommendations that may,
269 depending upon the audit scope, identify:
270 (i) the adequacy of the state agency's systems of internal control;
271 (ii) the efficiency and effectiveness of agency management in carrying out assigned
272 responsibilities; and
273 (iii) the agency's compliance with applicable laws, rules, and regulations;

274 (b) submit audit reports directly to the agency head and to the audit committee, if one
275 has been established;
276 (c) conduct internal audits of state agency programs, activities, and functions that may
277 consist of one or more of the following objectives:
278 (i) to verify the accuracy and reliability of agency records;
279 (ii) to assess compliance with management policies, plans, procedures, and regulations;
280 (iii) to assess compliance with applicable laws, rules, and regulations;
281 (iv) to evaluate the efficient and effective use of agency resources; and
282 (v) to verify the appropriate protection of agency assets;
283 (d) prepare audit reports of findings;
284 (e) review and evaluate internal controls over the state agency's accounting systems,
285 administrative systems, electronic data processing systems, and all other major systems
286 necessary to ensure the fiscal and administrative accountability of the state agency;
287 (f) develop audit plans containing the information required by Subsection (2) to be
288 based on the findings of periodic risk assessments;
289 (g) upon request, make a copy of the approved audit plan available to the state auditor,
290 legislative auditor, or other appropriate external auditor to assist in planning and coordination
291 of any external financial, compliance, electronic data processing, or performance audit;
292 (h) determine the scope and assignment of the audits;
293 (i) perform an audit of a special program, activity, function, or organizational unit at
294 the direction of the agency head or, if one has been established, an audit committee;
295 (j) maintain the classification of any public records consistent with Title 63G, Chapter
296 2, Government Records Access and Management Act;
297 (k) be subject to the same penalties as the custodian of those public records for
298 violating Title 63G, Chapter 2, Government Records Access and Management Act; and
299 (l) identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts
300 of interest.
301 (2) (a) The audit plan required by this section shall:
302 (i) identify the individual audits to be conducted during each year;
303 (ii) identify the related resources to be devoted to each of the respective audits;
304 (iii) ensure that internal controls are reviewed periodically as determined by the agency

305 head or the audit committee, if one has been established; and
306 (iv) ensure that audits that evaluate the efficient and effective use of agency resources
307 are adequately represented in the plan.
308 (b) The agency internal audit director shall submit the audit plan to the agency head
309 and the audit committee, if one has been established, for approval.
310 (3) The agency internal audit director shall ensure that:
311 (a) audits are conducted in accordance with professional auditing standards such as
312 those published by the Institute of Internal Auditors, Inc., the American Institute of Certified
313 Public Accountants and, when required by other law, regulation, agreement, contract, or policy,
314 in accordance with Government Auditing Standards, issued by the Comptroller General of the
315 United States;
316 (b) all reports of audit findings issued by internal audit staff shall include a statement
317 that the audit was conducted according to the appropriate standards;
318 (c) public release of reports of audit findings comply with the conditions specified by
319 the state laws and rules governing the state agency;
320 (d) copies of all reports of audit findings issued by the internal audit staff are available,
321 upon written request, to the Offices of the Legislative Auditor General [and], the Office of the
322 State Auditor [upon request], and the governor's internal audit director; and
323 (e) significant audit matters that cannot be appropriately addressed by the agency
324 internal audit office are referred to either the Office of Legislative Auditor General [or], the
325 Office of the State Auditor, or the Governor's Office of Internal Audit Services.
326 (4) The agency internal audit director may contract with consultants to assist with
327 audits.
328 Section 12. Section 67-22-2 is amended to read:
329 67-22-2. Compensation -- Other state officers.
330 (1) As used in this section:
331 (a) "Appointed executive" means the:
332 (i) Commissioner of the Department of Agriculture and Food;
333 (ii) Commissioner of the Insurance Department;
334 (iii) Commissioner of the Labor Commission;
335 (iv) Director, Department of Alcoholic Beverage Control;

336 (v) Commissioner of the Department of Financial Institutions;
337 (vi) Executive Director, Department of Commerce;
338 (vii) Executive Director, Commission on Criminal and Juvenile Justice;
339 (viii) Adjutant General;
340 (ix) Executive Director, Department of Heritage and Arts;
341 (x) Executive Director, Department of Corrections;
342 (xi) Commissioner, Department of Public Safety;
343 (xii) Executive Director, Department of Natural Resources;
344 (xiii) Executive Director, Governor's Office of Management and Budget;
345 (xiv) Executive Director, Department of Administrative Services;
346 (xv) Executive Director, Department of Human Resource Management;
347 (xvi) Executive Director, Department of Environmental Quality;
348 (xvii) Director, Governor's Office of Economic Development;
349 (xviii) Governor's Internal Audit Director, Governor's Office of Internal Audit
350 Services;
351 [(xviii)] (xix) Executive Director, Utah Science Technology and Research Governing
352 Authority;
353 [(xix)] (xx) Executive Director, Department of Workforce Services;
354 [(xx)] (xxi) Executive Director, Department of Health, Nonphysician;
355 [(xxi)] (xxii) Executive Director, Department of Human Services;
356 [(xxii)] (xxiii) Executive Director, Department of Transportation;
357 [(xxiii)] (xxiv) Executive Director, Department of Technology Services; and
358 [(xxiv)] (xxv) Executive Director, Department of Veterans' and Military Affairs.
359 (b) "Board or commission executive" means:
360 (i) Members, Board of Pardons and Parole;
361 (ii) Chair, State Tax Commission;
362 (iii) Commissioners, State Tax Commission;
363 (iv) Executive Director, State Tax Commission;
364 (v) Chair, Public Service Commission; and
365 (vi) Commissioners, Public Service Commission.
366 (c) "Deputy" means the person who acts as the appointed executive's second in

367 command as determined by the Department of Human Resource Management.
368 (2) (a) The executive director of the Department of Human Resource Management
369 shall:
370 (i) before October 31 of each year, recommend to the governor a compensation plan for
371 the appointed executives and the board or commission executives; and
372 (ii) base those recommendations on market salary studies conducted by the Department
373 of Human Resource Management.
374 (b) (i) The Department of Human Resource Management shall determine the salary
375 range for the appointed executives by:
376 (A) identifying the salary range assigned to the appointed executive's deputy;
377 (B) designating the lowest minimum salary from those deputies' salary ranges as the
378 minimum salary for the appointed executives' salary range; and
379 (C) designating 105% of the highest maximum salary range from those deputies' salary
380 ranges as the maximum salary for the appointed executives' salary range.
381 (ii) If the deputy is a medical doctor, the Department of Human Resource Management
382 may not consider that deputy's salary range in designating the salary range for appointed
383 executives.
384 (c) In establishing the salary ranges for board or commission executives, the
385 Department of Human Resource Management shall set the maximum salary in the salary range
386 for each of those positions at 90% of the salary for district judges as established in the annual
387 appropriation act under Section 67-8-2 .
388 (3) (a) (i) Except as provided in Subsection (3)(a)(ii), the governor shall establish a
389 specific salary for each appointed executive within the range established under Subsection
390 (2)(b).
391 (ii) If the executive director of the Department of Health is a physician, the governor
392 shall establish a salary within the highest physician salary range established by the Department
393 of Human Resource Management.
394 (iii) The governor may provide salary increases for appointed executives within the
395 range established by Subsection (2)(b) and identified in Subsection (3)(a)(ii).
396 (b) The governor shall apply the same overtime regulations applicable to other FLSA
397 exempt positions.

398 (c) The governor may develop standards and criteria for reviewing the appointed
399 executives.
400 (4) Salaries for other Schedule A employees, as defined in Section 67-19-15 , that are
401 not provided for in this chapter, or in Title 67, Chapter 8, Utah Elected Official and Judicial
402 Salary Act, shall be established as provided in Section 67-19-15 .
403 (5) (a) The Legislature fixes benefits for the appointed executives and the board or
404 commission executives as follows:
405 (i) the option of participating in a state retirement system established by Title 49, Utah
406 State Retirement and Insurance Benefit Act, or in a deferred compensation plan administered
407 by the State Retirement Office in accordance with the Internal Revenue Code and its
408 accompanying rules and regulations;
409 (ii) health insurance;
410 (iii) dental insurance;
411 (iv) basic life insurance;
412 (v) unemployment compensation;
413 (vi) workers' compensation;
414 (vii) required employer contribution to Social Security;
415 (viii) long-term disability income insurance;
416 (ix) the same additional state-paid life insurance available to other noncareer service
417 employees;
418 (x) the same severance pay available to other noncareer service employees;
419 (xi) the same leave, holidays, and allowances granted to Schedule B state employees as
420 follows:
421 (A) sick leave;
422 (B) converted sick leave if accrued prior to January 1, 2014;
423 (C) educational allowances;
424 (D) holidays; and
425 (E) annual leave except that annual leave shall be accrued at the maximum rate
426 provided to Schedule B state employees;
427 (xii) the option to convert accumulated sick leave to cash or insurance benefits as
428 provided by law or rule upon resignation or retirement according to the same criteria and

429 procedures applied to Schedule B state employees;
430 (xiii) the option to purchase additional life insurance at group insurance rates according
431 to the same criteria and procedures applied to Schedule B state employees; and
432 (xiv) professional memberships if being a member of the professional organization is a
433 requirement of the position.
434 (b) Each department shall pay the cost of additional state-paid life insurance for its
435 executive director from its existing budget.
436 (6) The Legislature fixes the following additional benefits:
437 (a) for the executive director of the State Tax Commission a vehicle for official and
438 personal use;
439 (b) for the executive director of the Department of Transportation a vehicle for official
440 and personal use;
441 (c) for the executive director of the Department of Natural Resources a vehicle for
442 commute and official use;
443 (d) for the Commissioner of Public Safety:
444 (i) an accidental death insurance policy if POST certified; and
445 (ii) a public safety vehicle for official and personal use;
446 (e) for the executive director of the Department of Corrections:
447 (i) an accidental death insurance policy if POST certified; and
448 (ii) a public safety vehicle for official and personal use;
449 (f) for the Adjutant General a vehicle for official and personal use; and
450 (g) for each member of the Board of Pardons and Parole a vehicle for commute and
451 official use.