Second Substitute S.B. 93

Representative Steve Eliason proposes the following substitute bill:

1 INTERNAL AUDIT AMENDMENTS
2 2014 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Howard A. Stephenson
5 House Sponsor: Steve Eliason
6
7 LONG TITLE
8 General Description:
9 This bill amends and enacts provisions related to the auditing of state agencies and local
10 education agencies.
11 Highlighted Provisions:
12 This bill:
13 . requires a local school board or charter school governing board to establish an audit
14 committee;
15 . requires a school audit committee to establish an internal audit program;
16 . defines terms;
17 . directs certain state agencies to establish internal audit programs;
18 . amends the powers and duties of an audit committee;
19 . amends the powers and duties of an agency internal audit director; and
20 . makes technical corrections.
21 Money Appropriated in this Bill:
22 None
23 Other Special Clauses:
24 None
25 Utah Code Sections Affected:

26 AMENDS:
27 63I-5-102 , as renumbered and amended by Laws of Utah 2008, Chapter 382
28 63I-5-301 , as renumbered and amended by Laws of Utah 2008, Chapter 382
29 63I-5-401 , as renumbered and amended by Laws of Utah 2008, Chapter 382
30 ENACTS:
31 53A-30-101 , Utah Code Annotated 1953
32 53A-30-102 , Utah Code Annotated 1953
33 53A-30-103 , Utah Code Annotated 1953
34 REPEALS AND REENACTS:
35 63I-5-201 , as last amended by Laws of Utah 2012, Chapters 212 and 365
36 63I-5-302 , as renumbered and amended by Laws of Utah 2008, Chapter 382
37
38 Be it enacted by the Legislature of the state of Utah:
39 Section 1. Section 53A-30-101 is enacted to read:
40 CHAPTER 30. INTERNAL AUDITS
41 53A-30-101. Title.
42 This chapter is known as "Internal Audits."
43 Section 2. Section 53A-30-102 is enacted to read:
44 53A-30-102. Definitions.
45 As used in this part:
46 (1) "Audit committee" means a standing committee:
47 (a) appointed by the local school board or charter school governing board with the
48 following number of members as applicable to the local school board or charter school
49 governing board:
50 (i) for a board of a local education agency that consists of seven or more members,
51 three members of that board; or
52 (ii) for a board of a local education agency that consists of six or fewer members, two
53 members of that board; and
54 (b) composed of people who are not administrators or employees of the local education
55 agency.
56 (2) "Audit director" means the person who directs the internal audit program.

57 (3) "Audit plan" means a prioritized list of audits to be performed by an internal audit
58 program within a specified period of time.
59 (4) "Internal audit" means an independent appraisal activity established within a local
60 education agency as a control system to examine and evaluate the adequacy and effectiveness
61 of other internal control systems within the local education agency.
62 (5) "Internal audit program" means an audit function that:
63 (a) is conducted by a local school board or charter school governing board independent
64 of the local education agency offices or other operations;
65 (b) objectively evaluates the effectiveness of the local education agency governance,
66 risk management, internal controls, and the efficiency of operations; and
67 (c) is conducted in accordance with the current:
68 (i) International Standards for the Professional Practice of Internal Auditing; or
69 (ii) The Government Auditing Standards, issued by the Comptroller General of the
70 United States.
71 (6) "Local education agency" means a school district or charter school.
72 Section 3. Section 53A-30-103 is enacted to read:
73 53A-30-103. Internal auditing program -- Audit committee -- Powers and duties.
74 (1) A local school board or charter school governing board shall establish an audit
75 committee.
76 (2) (a) The audit committee shall establish an internal audit program that provides
77 internal audit services for the programs administered by the local education agency.
78 (b) A local education agency that has fewer than 10,000 students is not subject to
79 Subsection (2)(a).
80 (3) (a) A local school board or charter school governing board shall appoint the audit
81 director, with the advisement of the audit committee, if the local school board or charter school
82 governing board hires an audit director.
83 (b) If the local school board or charter school governing board has not appointed an
84 audit director and the school board or governing board contracts directly for internal audit
85 services, the local school board or charter school governing board shall approve a contract for
86 internal audit services, with the advisement of the audit committee.
87 (4) The audit committee shall ensure that copies of all reports of audit findings issued

88 by the internal auditors are available, upon request, to the audit director of the State Board of
89 Education, the Office of the State Auditor, and the Office of Legislative Auditor General.
90 (5) The audit committee shall ensure that significant audit matters that cannot be
91 appropriately addressed by the local education agency internal auditors are referred to either the
92 audit director of the State Board of Education, the Office of the State Auditor, or the Office of
93 Legislative Auditor General.
94 (6) The audit director may contract with a consultant to assist with an audit.
95 (7) The audit director of the State Board of Education and the Office of the State
96 Auditor may contract to provide internal audit services.
97 Section 4. Section 63I-5-102 is amended to read:
98 63I-5-102. Definitions.
99 As used in this chapter:
100 [(6)] (1) "Agency governing board" is any board or commission that has policy making
101 and oversight responsibility over the agency, including the authority to appoint and remove the
102 agency director.
103 [(1)] (2) "Agency head" means a cabinet officer, an elected official, an executive
104 director, or a board or commission vested with responsibility to administer or make policy for a
105 state agency.
106 [(2)] (3) "Agency internal audit director" or "audit director" means the person
107 [appointed by the agency head, with the approval of the audit committee if one has been
108 established, to direct the internal audit function for the state agency.] who:
109 (a) directs the internal audit program for the state agency; and
110 (b) is appointed by the audit committee or, if no audit committee has been established,
111 by the agency head.
112 [(3)] (4) "Appointing authority" means:
113 (a) the governor, for state agencies other than the State Tax Commission;
114 (b) the Judicial Council, for judicial branch agencies;
115 (c) the Board of Regents, for higher education entities; [and]
116 (d) the State Board of Education, for the State Office of Education[.]; and
117 (e) the four tax commissioners, for the State Tax Commission.
118 [(4)] (5) "Audit committee" means a standing committee [whose] composed of

119 members who:
120 (a) are appointed by an appointing authority[:];
121 [(a) from members of the agency governing board; and]
122 (b) (i) [from individuals who] do not have administrative responsibilities within the
123 agency [who]; and
124 (ii) are not an agency contractor or other service provider; and
125 (c) have the expertise to provide effective oversight of and advice about internal audit
126 activities and services.
127 [(5)] (6) "Audit plan" means a prioritized list of audits to be performed by [the] an
128 internal audit [organization] program within a specified period of time.
129 (7) "Higher education entity" means the board of regents, the institutional councils of
130 each higher education institution, and each higher education institution.
131 (8) "Internal audit" means an independent appraisal activity established within a state
132 agency as a control system to examine and evaluate the adequacy and effectiveness of other
133 internal control systems within the agency.
134 (9) "Internal audit program" means an audit function that:
135 (a) is conducted by an agency, division, bureau, or office, independent of the agency,
136 division, bureau, or office operations;
137 (b) objectively evaluates the effectiveness of agency, division, bureau, or office
138 governance, risk management, internal controls, and the efficiency of operations; and
139 (c) is conducted in accordance with the current:
140 (i) International Standards for the Professional Practice of Internal Auditing; or
141 (ii) The Government Auditing Standards, issued by the Comptroller General of the
142 United States.
143 [(9)] (10) "Judicial branch agency" means each administrative entity of the judicial
144 branch.
145 [(10)] (11) (a) "State agency" means:
146 (i) each department, commission, board, council, agency, institution, officer,
147 corporation, fund, division, office, committee, authority, laboratory, library, unit, bureau, panel,
148 or other administrative unit of the state; and
149 (ii) each state public education entity.

150 (b) "State agency" does not mean:
151 (i) a legislative branch agency;
152 (ii) an independent state agency as defined in Section 63E-1-102 ;
153 (iii) a county, municipality, school district, local district, or special service district; or
154 (iv) any administrative subdivision of a county, municipality, school district, local
155 district, or special service district.
156 Section 5. Section 63I-5-201 is repealed and reenacted to read:
157 63I-5-201. Internal auditing programs -- State agencies.
158 (1) (a) If a director of an agency serves in the governor's cabinet, the director or the
159 governor shall establish an internal audit program for the respective agency.
160 (b) The governor may, by executive order, require a state agency not described in
161 Subsection (1)(a) to establish an internal audit program.
162 (c) The governor shall ensure that each state agency that reports to the governor has
163 adequate internal audit coverage.
164 (2) (a) The Office of the Court Administrator shall establish an internal audit program
165 under the direction of the Judicial Council, including auditing procedures for courts not of
166 record.
167 (b) The Judicial Council may, by rule, require other judicial agencies to establish an
168 internal audit program.
169 (3) (a) Dixie State University, the University of Utah, Utah State University, Salt Lake
170 Community College, Southern Utah University, Utah Valley University, Weber State
171 University, and Snow College shall establish an internal audit program under the direction of
172 the Board of Regents.
173 (b) The State Board of Regents may issue policies requiring other higher education
174 entities or programs to establish an internal audit program.
175 (4) The State Office of Education shall establish under the direction of the State Board
176 of Education an internal audit program that provides internal audit services for each program
177 administered by the State Office of Education.
178 (5) Subject to Section 32B-2-302.5 , the internal audit division of the Department of
179 Alcoholic Beverage Control shall establish an internal audit program under the direction of the
180 Alcoholic Beverage Control Commission.

181 Section 6. Section 63I-5-301 is amended to read:
182 63I-5-301. Audit committee -- Powers and duties.
183 (1) (a) Each appointing authority may establish an audit committee to monitor the
184 activities of the agency internal audit [organization] program.
185 (b) An audit committee may serve more than one state agency internal audit program.
186 (2) The appointing authority shall ensure that audit committee members have the
187 expertise to provide effective oversight of and advice about internal audit activities and
188 services.
189 (3) If an audit committee has been established, the audit committee shall:
190 (a) [consent to the appointment or removal of] appoint, evaluate, and, if necessary,
191 remove the agency internal audit director [as proposed by the agency head];
192 (b) prepare and adopt formal policies that define:
193 (i) the purpose of the agency's internal audit program; and
194 (ii) the authority and responsibility of the agency's internal auditors;
195 (c) ensure that policies adopted under Subsection (3)(b):
196 (i) do not place limitations on the scope of the internal audit program's work; and
197 (ii) clarify that an auditor does not have authority or responsibility for an activity that
198 the auditor audits;
199 (d) ensure that:
200 (i) the audit director employs a sufficient number of professional and support staff to
201 implement an effective internal audit program;
202 (ii) compensation, training, job tenure, and advancement of internal auditing staff is
203 based upon job performance;
204 (iii) the audit director and staff collectively possess the knowledge, skills, and
205 experience essential to the practices of the profession and are proficient in applying internal
206 auditing standards, procedures, and techniques;
207 (iv) the internal audit program has employees who are qualified in disciplines
208 necessary to meet the audit responsibilities, including accounting, business management, public
209 administration, human resource management, economics, finance, statistics, electronic data
210 processing, or engineering;
211 (v) internal audit staff are free of operational and management responsibilities that

212 would impair their ability to make independent audits of any aspects of the agency's operations;
213 (vi) the audit director and the internal audit staff have access to all personnel and
214 records, data, and other agency information that the audit director or staff consider necessary to
215 carry out their assigned duties; and
216 (vii) that the audit director and the director's employees have the necessary access to
217 the agency head, agency management, and agency staff;
218 [(b)] (e) consent to the internal auditing policies proposed by the agency head;
219 [(c)] (f) review and approve the annual internal audit plan, modifications to the internal
220 audit plan, risk assessment, and budget;
221 [(d)] (g) review internal and external audit reports, follow-up reports, and quality
222 assurance reviews of the internal audit office; and
223 [(e)] (h) periodically meet with the agency internal audit director to discuss pertinent
224 matters, including whether there are any restrictions on the scope of audits.
225 Section 7. Section 63I-5-302 is repealed and reenacted to read:
226 63I-5-302. Agency head -- Powers and duties.
227 If an agency has an internal audit program, and the agency's appointing authority has
228 not established an audit committee, the agency head shall assume the audit committee powers
229 and duties described in Subsection 63I-5-303 (3).
230 Section 8. Section 63I-5-401 is amended to read:
231 63I-5-401. Duties and powers of the agency internal audit director.
232 (1) The agency internal audit director [may] shall:
233 (a) furnish independent analyses, appraisals, and recommendations that may,
234 depending upon the audit scope, identify:
235 (i) the adequacy of the state agency's systems of internal control;
236 (ii) the efficiency and effectiveness of agency management in carrying out assigned
237 responsibilities; and
238 (iii) the agency's compliance with applicable laws, rules, and regulations;
239 (b) submit audit reports directly to the agency head and to the audit committee, if one
240 has been established;
241 (c) conduct internal audits of state agency programs, activities, and functions that may
242 consist of one or more of the following objectives:

243 (i) to verify the accuracy and reliability of agency records;
244 (ii) to assess compliance with management policies, plans, procedures, and regulations;
245 (iii) to assess compliance with applicable laws, rules, and regulations;
246 (iv) to evaluate the efficient and effective use of agency resources; and
247 (v) to verify the appropriate protection of agency assets;
248 (d) prepare audit reports of findings;
249 (e) review and evaluate internal controls over the state agency's accounting systems,
250 administrative systems, electronic data processing systems, and all other major systems
251 necessary to ensure the fiscal and administrative accountability of the state agency;
252 (f) develop audit plans containing the information required by Subsection (2) to be
253 based on the findings of periodic risk assessments;
254 (g) upon request, make a copy of the approved audit plan available to the state auditor,
255 legislative auditor, or other appropriate external auditor to assist in planning and coordination
256 of any external financial, compliance, electronic data processing, or performance audit;
257 (h) determine the scope and assignment of the audits;
258 (i) perform an audit of a special program, activity, function, or organizational unit at
259 the direction of the agency head or, if one has been established, an audit committee;
260 (j) maintain the classification of any public records consistent with Title 63G, Chapter
261 2, Government Records Access and Management Act;
262 (k) be subject to the same penalties as the custodian of those public records for
263 violating Title 63G, Chapter 2, Government Records Access and Management Act; and
264 (l) identify in the audit report any abuse, illegal acts, errors and omissions, or conflicts
265 of interest.
266 (2) (a) The audit plan required by this section shall:
267 (i) identify the individual audits to be conducted during each year;
268 (ii) identify the related resources to be devoted to each of the respective audits;
269 (iii) ensure that internal controls are reviewed periodically as determined by the agency
270 head or the audit committee, if one has been established; and
271 (iv) ensure that audits that evaluate the efficient and effective use of agency resources
272 are adequately represented in the plan.
273 (b) The agency internal audit director shall submit the audit plan to the agency head

274 and the audit committee, if one has been established, for approval.
275 (3) The agency internal audit director shall ensure that:
276 [(a) audits are conducted in accordance with professional auditing standards such as
277 those published by the Institute of Internal Auditors, Inc., the American Institute of Certified
278 Public Accountants and, when required by other law, regulation, agreement, contract, or policy,
279 in accordance with Government Auditing Standards, issued by the Comptroller General of the
280 United States;]
281 [(b)] (a) all reports of audit findings issued by internal audit staff shall include a
282 statement that the audit was conducted according to the appropriate standards;
283 [(c)] (b) public release of reports of audit findings comply with the conditions specified
284 by the state laws and rules governing the state agency;
285 [(d)] (c) copies of all reports of audit findings issued by the internal audit staff are
286 available, upon written request, to the Offices of the Legislative Auditor General and the Office
287 of the State Auditor [upon request]; and
288 [(e)] (d) significant audit matters that cannot be appropriately addressed by the agency
289 internal audit office are referred to either the Office of Legislative Auditor General or the
290 Office of the State Auditor.
291 (4) The agency internal audit director may contract with consultants to assist with
292 audits.