DISCUSSION OR ANALYSIS

The structure, organizational placement and reporting relationships of Audit and Consulting Services (ACS) were developed as a result of a detailed review of current professional audit standards and a review of information regarding selected municipal internal audit functions in Canada and the United States. The current structure, organizational placement and reporting relationships of Audit and Consulting Services are not only in compliance with the existing professional standards and best practices but also represents leading edge thinking. The ACS model recognizes the two main client groups and establishes the mechanisms and relationships to serve both groups.

One of the cornerstones of an effective audit function has long been seen as its “independence”. As a general statement, auditors are considered independent when they can carry out their work freely and objectively and render impartial and unbiased findings and recommendations. Each organization must determine the degree of independence necessary to its audit function and how best to ensure the necessary independence given the entity’s organizational and governance structures. In making these decisions, consideration should be given to the professional standards governing the auditor. These standards are discussed separately for the external audit function and the internal audit function.

External Audit:

The Municipal Act requires that City Council appoint an auditor to audit the financial statements of the municipality and its local boards. The Ministry of Municipal Affairs and Housing prescribes the basis of accounting and the overall duties of the auditor.

The Municipal Act requirement for the appointment of an external firm of auditors for a fixed period term is considered by the Ministry to establish the necessary independence for this audit function. Further both the Canadian Institute of Chartered Accountants and the Government Financial Officers Association of the United States and Canada advocate the external auditor report the results of this audit to an Audit Committee to enhance this independence. The City’s structure currently includes both of these elements.

Internal Audit:

The applicable standards for internal auditing are addressed by a number of organizations, including industry and practice area specialists. Information is presented from the following widely recognized organizations: the Institute of Internal Auditors, the US General Accounting Office and the National Association of Local Government Auditors.

The Institute of Internal Auditors (IIA)

The IIA, with some 70,000 members, is the acknowledged global leader and recognized authority for internal auditing standards. According to the IIA the internal auditing process provides assurance to management and the audit committee that risks are understood and managed appropriately. The function also serves an important role as an in-house consultant for a broad range of management issues and initiatives. Fundamental to this view of internal auditing is an active, knowledgeable and independent audit committee as well as an on-going acceptance and support by senior management.

The IIA addresses internal audit independence in its Standards for the Professional Practice of Internal Auditing. A new version of the Standards for the Professional Practice of Internal Auditing was recently approved by the IIA. The new Standards will be effective January 1, 2002. However, earlier adoption is encouraged. The new standards include the following:

“1100 – Independence and Objectivity

The internal audit activity should be independent, and internal auditors should be objective in performing their work.

1110 – Organizational Independence

The chief audit executive should report to a level within the organization that allows the internal audit activity to fulfill its responsibilities.

1110.A1 – The internal audit activity should be free from interference in determining the scope of internal auditing, performing work, and communicating results.

1120 – Individual Objectivity

Internal auditors should have an impartial, unbiased attitude and avoid conflicts of interest.

1130 – Impairments to Independence or Objectivity

If independence or objectivity is impaired in fact or appearance, the details of the impairment should be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment.

1130.A1 – Internal auditors should refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which the auditor had responsibility within the previous year.

1130.A2 – Assurance engagements for functions over which the chief audit executive has responsibility should be overseen by a party outside the internal audit activity.”

General guidance is also provided for government in the IIA position statement The Audit Committee in the Public Sector. The IIA’s view is that one means of demonstrating a higher level of accountability over the use of public funds and ensuring higher quality services is through the effective use of internal control, and more specifically, through the establishment of an audit committee that provides oversight on financial reporting, auditing and internal control. Key extracts from the IIA’s documents are quoted in Annex 1. The public sector recommendations have been designed in order to have broad applicability across the various levels and legislative environments faced by public sector entities around the world. The IIA cautions that the recommendations must be modified to fit specific organizational and legislative environments.

Annex B presents an Internal Auditing Independence Checklist replicated from the IIA’s internet site, which may assist the Committee in its discussions.

The United States General Accounting Office (GAO)

GAO exists to support the United States Congress in meeting its Constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO has developed standards for audits of government organizations, programs, activities and functions.

The GAO Government Auditing Standards, known informally as the “Yellow Book”, are widely used by internal auditors in the public sector and includes the following independence standard:

“In all matters relating to the audit work, the audit organization and individual auditors, whether government or public, should be free from personal and external impairments to independence, should be organizationally independent, and should maintain an independent attitude and appearance.”

The Yellow Book provides amplification as to what constitutes personal impairments, external impairments and organizational independence. It provides the following specific discussion of independence in the context of government internal auditors:

“To help achieve organizational independence, audit organization should report the results of their audits and be accountable to the head or deputy head of the government entity and should be organizationally located outside the staff or line management function of the unit under audit. The audit organization's independence is enhanced when it also reports regularly to the entity’s independent audit committee and/or the appropriate government oversight body.

Auditors should also be sufficiently removed from political pressures to ensure that they can conduct their audits objectively and can report their findings, opinions, and conclusions objectively without fear of political repercussion. Whenever feasible, they should be under a personnel system in which compensation, training, job tenure, and advancement are based on merit.

If the above conditions are met, and no personal or external impairments exist, the audits staff should be considered organizationally independent to audit internally and free to report objectively to top management.”

National Association of Local Government Auditors (NALGA)/Canadian Association of Local Government Auditors (CALGA)

NALGA is a professional organization intended to improve local government auditing. The organization disseminates information and ideas about financial and performance auditing, provides training, and offers a national forum to discuss auditing issues. NALGA has more than 500 members representing a wide diversity of audit organizations.

CALGA is an affiliated organization of Canadian local government auditors. Members of CALGA generally follow NALGA guidelines, but meet annually to discuss their application in the Canadian context.

NALGA has issued guidelines for establishing audit functions. In general, the guidelines recommend that when establishing an independent audit function, a local government should:

1. Provide for an “independent” auditor either through election or appointment by the legislative body or chief executive officer. Appointment or removal of an appointed auditor by a chief executive officer should be subject to legislative approval.

2. Authorize the auditor to conduct financial and performance audits in accordance with government auditing standards as promulgated by the United States General Accounting Office.

Conclusion

In general, the guidance provided by the various professional organizations with an interest in internal auditing is consistent with respect to “independence” and is summarized as follows:

- independence, defined as the ability to review and report on the activities of the local government in a fair, objective and unbiased manner is important.

- while “full” independence may be an ideal, it is not seen as a requirement. The degree of independence necessary to an individual audit function should be determined in the context of:

o the legislative framework

o the degree of involvement and interaction of political representatives with the administration

o acceptance and support of senior management

o the corporate culture, operating and administrative structures.

- the Audit Committee has the critical oversight role in ensuring independence and objectivity are maintained.

- a reporting relationship should exist with the highest level of management. This relationship must be above the units to be evaluated and outside of the financial function.

The information reviewed from other cities found that independence and reporting relationships vary considerably. The most independent model, found only in parts of the United States, is an elected auditor reporting to Council. At the other end of the scale were a number of audit functions who reported only to management at various levels.

In the Canadian context, there is also a range of reporting relationships, including direct reporting only to Council, direct reporting only to management and both. All auditors contacted indicated that the ability to effectively assist management in making improvements is an increasingly important component of the audit role.

The current City of Ottawa audit reporting relationship has addressed both:

- independence by establishing direct reporting of audits to Council through Audit Committee and ensuring Audit Committee has responsibility for ensuring this independence is maintained.

- the need of corporate management to have access to independent advice and audit expertise in order to establish and maintain an effective management control structure.

ENVIRONMENTAL IMPLICATIONS

There are no environmental implications to this report.

RURAL IMPLICATIONS

There are no rural implications to this report.

CONSULTATION

The Director, Audit and Consulting has met individually with members of Council to identify and discuss concerns relating to audit independence. This report is in response to identified concerns.

FINANCIAL IMPLICATIONS

There are no financial implications.

ANNEX 1

Extracts from the Institute of Internal Auditors

The Audit Committee in the Public Sector

The IIA’s view is that one means of demonstrating a higher level of accountability over the use of public funds and ensuring higher quality services is through the effective use of internal control, and more specifically, through the establishment of an audit committee that provides oversight on financial reporting, auditing, and internal control.

An effective audit committee provides several important aspects of control, including: ensuring the independence of the internal auditing function; ensuring appropriate action is taken on audit findings; acting as a communication link among external and internal auditors and operating management; and, as a means of reducing the risk of management override of internal audit.

The key IIA recommendations relating to independence applicable to the audit committee are as follows:

- The audit committee should be organized as a standing committee of the governing body.

- Audit committee members should be independent from the day-to-day management of the public sector entity to ensure an unbiased perspective on reports and recommendations brought to the committee.

- The audit committee and the internal auditors must maintain a degree of professional independence when assessing management’s performance of its responsibilities. However, this does not mean that an adversarial role is necessary or desirable because the internal auditors and management should have common goals.

The IIA position statement for public sector includes the following discussion of relationships necessary to the internal auditor.

“Internal auditors must be trusted by and work effectively with all levels of management, keeping in mind the best interests of the organization as a whole. They must have an organizational status sufficient to ensure a broad range of audit coverage, access to all pertinent documents and information, and adequate consideration of their findings and recommendations.”

The document goes on to address the reporting relationships and the oversight relationships between the audit committee and the internal auditor and similar relationships between internal auditors and executive management. These sections are reproduced below.

“Audit Committee – Internal Auditor Relationships

Oversight

The audit committee should exercise an active oversight role with respect to the internal auditing function. Oversight activities include:

1. Review and approval of the internal audit charter

2. Concurrence in the appointment or removal of the director of internal auditing

3. Review of plans and budgets

4. Review of audit results

5. Requests for audit projects

6. Review of quality assurance reviews

7. Support for communications with internal audit (ensure director of internal auditing has direct communication with the audit committee)

8. Ensure the independence of the internal auditing function.

Reporting

The director of internal auditing should periodically communicate directly with the audit committee as articulated in the internal auditing function’s charter and the audit committee’s charter. The audit committee-internal auditor relationship would be established through the internal audit charter, which is then approved by the governing board. Only if such a reporting relationship exists will the internal auditors have appropriate recourse in cases of misconduct or fraud involving executive-level management.”

“Executive Management—Internal Auditor Relationships

Oversight

Executive management has the primary responsibility for the day-to-day operations and the financial and other reporting of the entity. These responsibilities include the appointment and removal of the director of the internal auditing function, with review and approval by the audit committee. Executive management also has direct input into the internal auditors’ plan and budgets which are in turn reviewed by the audit committee. The internal auditors must be responsive to the needs of executive management, yet remain objective.

Reporting

The internal auditor should communicate directly with the audit committee. It is especially important that the internal auditors remain independent, which includes operating independently of management and remaining free from organizational impairments. It is also important that the internal auditors be independent of the chief financial and/or accounting officers to ensure objective reviews of the internal control structure and the financial reporting process.”

ANNEX 2

Internal Auditing Independence Checklist

As published on the Institute of Internal Auditors Web site.

A version of this checklist appeared in the Journal of Accountancy.

Internal auditors are independent when they can carry out their work freely and objectively. Achieved through organizational status and objectivity, independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits. Internal auditors should maintain an independent, objective mental attitude, not subordinating their judgment on audit maters to that of others. They should have the support of senior management and of the board (audit committee) so that they can gain cooperation of the customer and perform work free of interference. Based on The Institute of Internal Auditors’ Standards for the Professional Practice of Internal Auditing, this checklist can be used to determine internal auditing independence.

ORGANIZATIONAL STATUS

The director of internal auditing is responsible to an individual in the organization with sufficient authority to:

Promote independence
Ensure broad audit coverage
Ensure adequate consideration of audit reports
Ensure appropriate action on audit recommendations

The director has direct communication with the board, meets privately with the board annually, and regularly attends and participates in board meetings.
The board concurs in the appointment or removal of the director of internal auditing.
The purpose, authority, and responsibility of the internal auditing department is defined in a charter which has been approved by senior management, accepted by the board, and periodically assessed by the director. Results of assessments are reported to senior management and the board.
The charter should achieve the following:

Establish the department’s position within the organization.
Authorize access to records, personnel, and physical properties relevant to the performance of audits.
Define the scope of internal auditing activities.

The director annually submits the following to senior management for approval and to the board for information:

Summary of the department’s audit work schedule
Staffing plan
Financial budget
Activity reports that highlight significant findings and recommendations

OBJECTIVITY

Staff assignments are made so that potential and actual conflicts of interest and bias are avoided.
Internal auditors report to the director any situations indicating a possible conflict of interest.
Staff assignments are periodically rotated.
Internal auditors do not assume operating responsibilities unless it is understood that they are not functioning as internal auditors.
Internal auditors do not audit activities they previously performed until a reasonable amount of time has elapsed, in which case the results are reviewed for objectivity before release.
Internal auditors do not draft procedures for systems, or design, install, or operate systems.

BACKGROUND

“Audit Committee – Internal Auditor Relationships

Oversight

Reporting

“Executive Management—Internal Auditor Relationships

Oversight

Reporting