Internal Audit report - Toronto · Internal Audit Division has issued 10 reports in ... with...

Staff report 1

STAFF REPORT ACTION REQUIRED

Annual Report to the Audit Committee – Internal Audit Division Work Plan and Activity

Date: May 31, 2014

To: Audit Committee

From: Director, Internal Audit

Wards: All

SUMMARY

This report provides information to the Audit Committee relating to the audit work completed by the City's Internal Audit Division since the last issuance of its Annual Report in October 2013. The report includes audit activity over eight months from October 2013 to May 2014. Appendix A outlines reports issued since we last reported to the Audit Committee, audits in progress and those planned for the remainder of 2014. Audit work projected for 2015 and 2016 is outlined in Appendix B.

Internal Audit Division has issued 10 reports in the past eight months. Some of the more significant reviews include a contract management audit of a large capital construction contract in Toronto Water, managed by Engineering and Construction Services (ECS), and a review of the administration of the 5 non-OMERS pension plans. The work planned for 2015 through 2016 focuses on contract management across the City and includes a follow up review on the Multi Residential Apartment Building Program in MLS that was highlighted in the 2013 annual report.

Performance measures such as the percentage of Internal Audit recommendations implemented by City Divisions and overall client satisfaction level with Internal Audit services were exceeded in 2013. All except one of the 10 recommendations made by the Institute of Internal Auditors in their 2011 Quality Assurance Review of the Division have been implemented, with the remaining recommendation expected to be implemented by the end of 2014.

Staff report 2

RECOMMENDATIONS

The City Manager recommends that:

1. The Audit Committee receive this report for information.

Financial Impact

There are no financial impacts associated with this report. However, recommendations made by Internal Audit and implemented by management consistently provide program efficiencies and/or cost savings throughout the City.

The Deputy City Manager and Chief Financial Officer has reviewed this report and agrees with the financial impact information.

DECISION HISTORY

In November 2011, the Internal Audit Division underwent an external Quality Assurance review conducted by the Institute of Internal Auditors. A recommendation stemming from this review was that Internal Audit report to the Audit Committee its activities and annual work plan. This is the third annual report to the Audit Committee since the issuance of that recommendation.

ISSUE BACKGROUND

Effective January 1, 2002, the Institute of Internal Auditors Professional Practices Quality Assurance Standards required "every internal audit department to have an external quality assessment at least once every five years by a qualified independent reviewer from outside the organization."

The Quality Assessment was performed on the Internal Audit activity in November 2011. The Overall opinion provided by the Institute was that Internal Audit activity partially conforms to the Standards, Code of Ethics and Definition of Internal Audit. They state that a "generally conforms" rating (highest possible rating) could be attained by implementing the ten recommendations in their report. An update on the status of these recommendations is included in the body of the report under section Quality Assurance and Improvement Program and in Appendix C.

COMMENTS

Mandate and Mission

The mission of the Internal Audit Division is to assist senior management meet their responsibilities for maintaining proper systems of internal controls, identify and evaluate significant risk exposures and strengthen risk management throughout the City.

Staff report 3

The mission is achieved by providing senior management with the following services:

assurance (audit) services including compliance, operational, financial, forensic and internal control reviews

business and risk consulting including identifying risks and providing advice on the design and development of new or enhanced programs, policies, processes or information systems

Key Operational Statistics - 2013

15 audits completed

Over 6,200 hours spent on audit services

520 hours spent on advisory services

90% average client satisfaction rating

89% of recommendations implemented from prior years

331 hours training undertaken to maintain certifications

Staffing

The Division has a complement of 6 professional staff and is headed by a Director, see organizational chart below. However the Division has not been at full complement for several years due to gapping, secondments and leaves of absence. In 2013 the average staffing was 5.5 full time equivalents (FTE's) and up to May 2014 the average staffing is 4.3 FTE's or a 28% reduction in staff as shown in the chart below.

Staff report 4

Currently the Division is in the process of preparing a business case and is in discussion with Information and Technology staff to incorporate an Information Technology auditor to our staff complement. This position is necessary to ensure proper management accountability, benefits management and risk management for large scale business transformation projects that are part of the City's IT landscape.

All professional staff in the Division have one or more professional accounting and/or auditing designations. Internal Audit staff hold 17 professional designations.

o Diploma in Investigative Forensic Accounting (DIFA)

o Chartered Accountant (CA) o Certified Management

Accountant (CMA) o Certified General Accountant

(CGA) o Certified Fraud Examiner

(CFE) o Certified Internal Auditor

(CIA) o Certified Information Systems

Auditor (CISA) o Certified Government Audit

Professional (CGAP)

Budget

The 2014 budget for the Division consists of gross expenditures of $1.144M, partially funded by divisional recoveries totalling $611K, for a net budget of $533K. The divisional recoveries are provided by the three Clusters as well as the Clerk's Office and Toronto Public Health. The majority of the Internal Audit budget consists of salaries and benefits, $1.121M or 98% of the gross budget. The budget has remained stable with no significant changes over the years as shown in the chart below.

Staff report 5

The Division has benchmarked 2014 Internal Audit costs within other municipalities and/or agencies in Ontario.

Comparison of Internal Audit Costs

Municipality/Agency

2014 Municipal/Agency Operating Budget (in $000's)

2014 Internal Audit Costs (in $000's)

Number of FTE Staff

Audit Costs as a % of Municipal Operating Budget

City of Toronto (Excludes ABCC's not audited) 6,500,000 1,144 8 0.02% Toronto Community Housing Corporation 662,000 1,038 10 0.16% Region of Peel 2,000,000 1,530 10 0.08% Toronto Police Services 1,086,000 1,703 14 0.16% Toronto Transit Commission 1,697,000 899 10 0.05% City of Mississauga 676,617 1,224 8 0.18% City of Brampton 530,000 1,000 9 0.19%

When benchmarking, it is difficult to make specific comparisons of internal audit costs to the organization's operating budgets as the services offered, size of the organizations, reporting structure, and the specific risks and controls in place for each organization

Staff report 6

differ. Even though it is difficult to make comparisons, it is evident that the City allocates a lower percentage of the municipal operating budget (.02%) to the Internal Audit Division than other jurisdictions benchmarked (exclusive of the Auditor General's Office).

Work Plan – 2013/2014

The work plan includes both reviews initiated by Internal Audit based on risk assessment and requests for audit work from management. In 2013 Internal Audit enhanced its Risk Assessment Methodology to ensure a consistent treatment of the risks facing each division. The methodology encompasses ranking of specific risk criteria while taking into account concerns of senior management.

One major area of focus for the Division continues to be contracts managed by City divisions. There are significant risks and exposures if these contracts are not managed appropriately. To address the potential risks, Internal Audit has conducted contract management audits every year.

Though limited by staffing resources and less than a full complement of staff in the past several years, as noted on page 3, Internal Audit continues to annually:

conduct a follow up on recommendations issued by Internal Audit

co-ordinate AG annual follow up of recommendations

co-ordinate the AG Continuous Controls Monitoring responses from Divisions several times a year

conduct a vendor-employee match and report out on results at least once every year

Other related work conducted on an as needed basis includes:

providing risk and control advice to all City Divisions

acting as a point person and providing advice relating to conflict of interest inquiries

conducting, assisting as well as providing advice in fraud investigations

assisting management in responding to AG audits upon request

Appendix A details the 10 audit reports issued since the last Annual Report to the Audit Committee, projects in progress and projects scheduled for the remainder of 2014. Some notable reviews that are projected to be completed include a Review of the Complaints Handling process in selected City Divisions, Transportation Services contract managed by Engineering and Construction Services, Bridge Inspection Practices and the use of Consultants in Risk Management and Information Security and Enterprise Architecture Units within the City's Information & Technology Division.

The table below provides details on a few of the more significant projects completed and reports issued since the last report to the Audit Committee.

Staff report 7

Summary of Significant work since October 1, 2013

Audit Project Objective and Results Non-OMERS Pension Administration – Pension Payroll and Employee Benefits (PPEB)

Objective: Assess the adequacy of control pertaining to the administration of the 5 City sponsored pension plans. Results: As a result of our audit, PPEB will:

enhance supervision of pension service representative activities and segregate incompatible functions

improve the physical security over and completeness of pensioner files

improve prevention and collection of overpayments made to pensioners

perform regular confirmation of pension accounts on a go forward basis

Contract Management Review – Engineering and Construction Services (ECS) managed Toronto Water Construction Contract – Ashbridges Bay

Objective: To assess whether there are adequate processes and controls in place to ensure the construction contract is properly managed. Results: As a result of our audit, ECS will:

enhance oversight of consultant and contractor activities and document evidence of that oversight

update the Capital Works Manual to reflect the various project delivery methods and change order process

improve process for calculating contingency allowances

2013 Annual Follow up on Internal Audit Recommendations

Objective: To determine the adequacy, effectiveness and timeliness of corrective actions taken by management on IA reported findings. Results:

A total of 509 recommendations have been made by IA since 2005. 23 of these recommendations have been determined to be no longer relevant

Of the 486 remaining recommendations, 431 (89%) have been fully implemented as of October 2013 and 48 (10%) have been partially implemented

Staff report 8

Audit Coverage by Area

The work plan is based on risk. However, the work plan is also designed to provide audit and advisory services to each Cluster. The charts below show that Internal Audit has provided equitable service to all Clusters.

Advice Hours by Area

Advisory services are provided based on ad hoc requests by divisional management and staff. The chart below shows the amount of hours spent providing advice to each cluster.

Cluster Hours on Advice

To Dec. 31, 2012 Hours on Advice

To Dec. 31, 2013

Cluster A 118 152 Cluster B 191 86 Cluster C 201 175 Corp - city wide - 74 Other - Clerks, CMO, Legal 64 29 ABC 13 4 Total 587 520

Staff report 9

A Look Ahead – Work Plan 2015/2016

The projected work plan for 2015 to 2016 will continue to focus on contract management with reviews planned in Solid Waste Management (deferred from 2014), Toronto Water (Basement Flooding Relief Program and other major capital contracts) and Information Technology Project Management. Other key reviews planned include MLS Integrated Business Management System controls and data integrity and a review of Medical and Fire emergencies response times. See Appendix B for further details.

Performance Measures

Performance metrics used to measure divisional performance are1:

Internal Audit Recommendations Implemented

Our goal is to facilitate the implementation of 90% of audit recommendations.

Client Satisfaction

Our goal is to maintain an 80% client satisfaction rate. An audit effectiveness survey is provided to clients after each audit which gauges client satisfaction, professionalism and knowledge of staff, and overall value added by Internal Audit Services. We have consistently exceeded our goal in the last 7 years.

1 Internal Audit will refine performance measure as more data is accumulated.

Staff report 10

Number of Audits Completed

Our goal is to complete 15 audits annually. This performance measure was implemented in 2013.

Staff report 11

Challenges

The audit work plan is formulated based on the availability of 6 professional staff. The 6 staff are responsible to conduct reviews across the more than 45 Divisions in the City and the three DCM offices. Given the magnitude of the City operations and the risks present in such a large organization, sufficient annual coverage cannot be provided with the limited resources available to the Division. Specifically, the number of professional staff does not allow Internal Audit to perform key audits of City Divisions and programs on a cyclical basis, which is the best practice in the field of internal auditing.

As part of the KPMG Shared Service Report the City Manager received council approval on June 11, 2013 to implement the following recommendation in 2014. "Enhance the use of the City’s Internal Audit Division for compliance, assurance and business risk consulting services by agencies that do not have their own audit resources." This recommendation in turn places further pressure on the Divisional human resources requiring the Division to market its services outside City Divisions and be available to service the audit needs of Agencies, Boards, Commissions and Corporations (ABCC's). This expanded scope of service will further impact the ability of the Division to provide value added services to its clients.

The City Manager agrees with the aforementioned pressure in the staff Report "Results Arising from the Shared Services Study Related to Internal Audit and Jurisdictional Research Respecting Funding Models for Accountability Functions" dated February 1, 2013. He stated that "It is the City Manager's view that the City's audit resources, including for the Auditor General's Office, are lean relative to the size and complexity of Toronto's government and there are limited opportunities for further efficiencies."

Quality Assurance and Improvement Program

In November 2011, the Internal Audit division underwent a Quality Assurance review conducted by the Institute of Internal Auditors (IIA). The Overall opinion provided by the Institute was that Internal Audit activity "partially conforms" to the Standards and there were 10 recommendations included in their report, summarized in Appendix C. Internal Audit has successfully implemented 9 of the 10 recommendations. The remaining recommendation relates to the implementation of a Quality Assurance and Improvement Program (QAIP).

In 2014, Internal Audit will begin an initiative to establish a QAIP. It will aim to provide a formal structured approach to ensure quality in Internal Audit activities and demonstrate compliance with the IIA standards of professional practice. The QAIP will be fully developed by 2015 and will encompass:

ongoing monitoring

periodic internal self assessment

external quality assessment

Staff report 12

Shared Service Review

In June 2013, Council approved the City Manager to begin implementation of the following recommendations made by KPMG in the shared service report that relate to Internal Audit:

enhance the use of the City’s Internal Audit Division for compliance, assurance and business risk consulting services by agencies that do not have their own audit resources

establish a Quality Assurance Centre of Excellence to leverage tools, templates and specialized skills, coordinate work plans and share best practices

The Division has provided and will continue to offer audit services to ABCC's by request on a fee for service basis. Internal Audit has in the past provided audit services to Exhibition Place and Toronto Community Housing Corporation and has 2 reviews planned for the Police Service Board in 2014/2015. Furthermore, a meeting has taken place with the Toronto Public Library to identify current outsourced audit services that can be potentially performed by Internal Audit

Internal Audit has selected a sample of Quality Assurance units across the City divisions (Toronto Water, Toronto Public Health, Toronto Employment and Social Services, Children's Services, and the Shelter Support and Housing Administration) as a pilot group and has gathered information with the goal to get familiar with the various QA functions. Once completed, the Division will facilitate a group discussion to determine benefits of further meetings with stakeholders to share the practices, methods and tools used by individual QA groups. If it is decided sharing opportunities would be beneficial, alternatives for sharing this knowledge including extending this opportunity to ABCCs would then be explored and evaluated.

In addition, an Internal Audit Working Group (IAWG) that includes senior internal audit representatives from the City of Toronto, Toronto Police Service, Toronto Transit Commission and Toronto Community Housing Corporation has been formed and is now in its second year. Meetings are held on a quarterly basis. Membership has been extended to the Toronto Parking Authority in 2014.

Progress achieved to date by the IAWG include sharing of best practices in areas such as electronic staff time tracking, audit risk assessment methodology, utilizing electronic audit working papers, and minimizing costs of professional memberships.

http://app.toronto.ca/tmmis/viewAgendaItemHistory.do?item=2013.AU10.12

http://app.toronto.ca/tmmis/viewAgendaItemHistory.do?item=2013.AU10.12

Staff report 13

CONTACT

Ruvani Shaubel, Director Internal Audit Division 416-392-8034 ([email protected])

SIGNATURE

_______________________________

Ruvani Shaubel, Director Internal Audit

ATTACHMENTS

Appendix A Internal Audit Work Completed since Last Annual Report Appendix B Internal Audit Potential Projects for 2015-2016 Appendix C Summary of Quality Assurance Recommendations

APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT

As of May 31, 2014

Name of Project/Division Project Objectives Project Start

Date Report Date*** Project Results

14

2013 Projects Completed and In Progress 1.

Review of Divisional Fraud Action Plans (FAP's) – Clusters A & C

To assess the effectiveness of divisional FAP's. The objective of this review is to address division specific fraud risks and assess related controls and furthers the objectives of the AG's Forensic Unit.

March 2013

March 2013

"A" – September 13, 2013

"C" – October 16, 2013

Recommendations made to improve mitigation of fraud, including training and enhanced documentation in FAP.

2.

Contract Management Review – Engineering and Construction Services (ECS) – Toronto Water

Review of contract managed by ECS for adequacy of oversight and contract management practices.

May 2013 February 7, 2014 Recommendations made to improve management's oversight of consultant and contractor activities.

3.

Review of Processes Surrounding the TESS Benefits Card

To conduct a post-implementation review on the Benefit Card processes.

August 2013 March 10, 2014 Recommendations made to improve security of cardholder personal information, issuance of benefit cards, reporting and system controls.

4.

2013 Annual Follow Up of Internal Audit Recommendations

Follow up on the status of Internal Audit recommendations.

October 2013 December 6, 2013

89% of recommendations have been implemented.


As of May 31, 2014



15

5.

Administration of City Pension Plans**

To assess the adequacy of controls pertaining to the administration of the 5 City sponsored pension plans.

July 2013 December 12, 2013

Recommendations made to improve management oversight of system changes, physical security of pensioner files, overpayments, outstanding cheques, transfer funds and journal entries.

6.

Labour Relations Grievance Process**

To ensure the administration and reporting of grievance and arbitration activities is efficient and effective.

May 2013 December 18, 2013

Recommendations made to improve grievance documentation, response time, administration and management reporting.

7.

Review of Time & Attendance Processes – PF&R**

Review processes to ensure the completeness, validity and accuracy of payroll data.

September 2013

February 6, 2014 Recommendations made to standardize payroll processes and improve supervisor oversight across all community centres.


As of May 31, 2014



16

8.

Review of Fleet Asset Acquisition**

Review the vehicle acquisition process to ensure vehicles are approved for purchase or replacement, specifications are provided and reserve monies are in place.

August 2013 September 16, 2013

Recommendations made to improve the processes of disposition and acquisition of vehicles.

9.

Review of Management Oversight and Controls Relating to Attendance and Overtime Management – Cluster A

To review management of attendance and overtime in selected Divisions within Cluster A. This review complements the AG Continuous Audit Monitoring efforts.

February 2014

In Progress Overtime portion of this review has been cancelled. Preliminary work and Auditor General Continuous Auditing of this area has minimized the risk and shown that overall overtime has consistently decreased.

Attendance Management portion started in 2014.

10.

Review of Processes and Controls – Revenue Services – Vacancy Rebates

Review to be conducted relating to adequacy of controls for the vacancy rebate for commercial properties.

Q4 2014 (Tentative)

Deferred from 2013 due to the implementation of new system.


As of May 31, 2014



17

2014 Projects Completed and In Progress 1.

Review of Seaton House Processes**

To investigate FWH allegations and provide recommendations for improvement.

February 2014

March 14, 2014 Recommendations made to improve cash handling, security, process documentation and training.

2.

Pension Investigation** To assess the completeness of documentation retained and existence of active pensioners.

March 2014 In Progress

3.

EDC – IMIT Grants** To ensure adequate documentation and controls exists around processes of application, financial incentive agreement, annual review and payment.



As of May 31, 2014



18

4.

Review of a Transportation Services Contract Administered by Engineering & Construction Services (F.G. Gardiner Expressway Structure Repair – York Street to Jarvis Street)

To assess the processes and adequacy of controls in place to ensure the construction contract is properly managed.


5.

Review of Internal Quality Assurance Functions in Employment & Social Services, Children's Services, Toronto Water, Shelter, Support, Housing & Administration and Toronto Public Health divisions

The objective is to determine similar processes and best practices in each of the programs that could be leveraged and expertise shared.


6.

Compliance with Bridge Inspection Standards and Legislation

To assess the procedures in place to support the ongoing safety and repair of bridges and compliance with the Public Transportation and Highway Improvement Act.

Q4 2014


As of May 31, 2014



19

7.

Management of Consultants in the Risk Management & Information Security Unit and the Enterprise Architecture Unit.

To assess the adequacy of process and controls in place to manage consultants.

May 2014 In Progress

8.

Review Effectiveness of Complaints Handling Processes in Selected Cluster B Divisions

To determine the effectiveness of the complaints handling process.

June 2014

9.

Review of Payroll Processing Controls

To assess controls to ensure payroll is processed accurately and timely.

July 2014

10. Transportation Services Toronto Hydro Street Lighting Contract Review**

To assess the processes and adequacy of controls in place to ensure the contract is properly managed.

June 2014

11. OMBI Measures** To determine the integrity of information.

Q3 2014 (Tentative)


As of May 31, 2014



20

12. Review of Vacancy Rebate Program Processes and Controls

To assess the adequacy of controls for the vacancy rebate for commercial properties.

Q4 2014 (Tentative)

13. Review of Processes and Controls Pertaining to the Life Cycle Management of the Water Infrastructure

To ensure a strategy to maintain infrastructure is in place and adhered.

Q4 2014 (Tentative)

14.

Conduct two (2) reviews requested by the Toronto Police Services Board

Control of Evidence/Property

Human Rights

Requests from the Toronto Police Services Board (Objectives TBD when reviews are approved)

Q4 2014 (Tentative)

15.

Development of Internal Audit's Quality Assurance Improvement Program

To provide a formal structured approach to ensure quality in Internal Audit activities and demonstrate compliance with the IIA standards of professional practice.

Q4 2014 (Tentative)


As of May 31, 2014



21

16.

Annual Follow Up on the Status of Outstanding Internal Audit Recommendations in 2014

Follow up on the status of IA recommendations

Q4 2014 (Tentative)

17.

Contract Management Review of the Renovation of the St. Lawrence Market – North Building


Q4 2014 (Tentative)

18. Review of Bid Packages – Transportation Services

To ensure that bids are reviewed and assessed accurately.

Q4 2014 (Tentative)

19. Review of MLS Progress System Controls and Data Integrity

To ensure the adequacy of controls and integrity of data.

Deferred Deferred due to client reviewing the processes and IT systems.

20. Review of Business License Issuance Processes and Controls in MLS

Review of processes and controls to ensure effective and efficient issuance of various business licenses.

Deferred Deferred due to client reviewing the processes and IT systems.


As of May 31, 2014



22

21. Review of a Solid Waste Management Contract Administered by Engineering & Construction Services


Deferred Deferred due to no significant SWM contracts involving ECS in progress in 2014.

22. Contract Management Review for the Supply and Cleaning of Work Garments for Toronto Water, Solid Waste Management and Transportation Services

To assess the processes and adequacy of controls in place to ensure the goods and services contract is properly managed.

Deferred to 2015

Deferred until 2015 as new contract has not yet been awarded.

APPENDIX B

23

2015 – 2016 POTENTIAL PROJECTS

Contract Management Reviews:

Contract management review of various Major Capital Projects in Toronto Water

Contract management review of the Basement Flooding Relief Program administered by Toronto Water

Contract management review of Agreements to Supply Water to other municipalities

Contract management review of Construction of new Data Centre

Effectiveness of Information & Technology Project Management

Review of management of Lease Agreements processes and controls

Contract management review of the Implementation of Automated Water Meters

Compliance and Operational Reviews and Special Projects:

Review the efficiency and effectiveness of the Multi Residential Apartment Building (MRAB) program

Review effectiveness of Complaints Handling Processes in selected divisions within Cluster A and C

Review of MLS Integrated Business Management System (IBMS) controls and data integrity

Compliance with Environmental and Health & Safety regulations and standards in Solid Waste Management

Review of processes and controls in the tracking and use of development charges

Review effectiveness of emergency plans and performance

Review of processes and controls with respect to the Enforcement of Property Standards

APPENDIX B

24

Review of medical and fire emergencies response times

Other Projects & Reviews:

Annual follow up on the status of outstanding Internal Audit recommendations in 2015 and 2016

External Quality Assurance Self Assessment of Internal Audit Division

Original Approved by:

________________________________ Director, Internal Audit

________________________________ City Manager

APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS

25

Recommendation Management Response Status

1. Enhance Independence of the IA Activity and the

Accountability of Management’s Acceptance of Risks

Ensure that IA activity is given adequate access to the Audit Committee and adopt the practice of reporting to the Audit Committee on audit plan and results.

The City Manager and Deputy City Managers, in consultation with the CAE, will re-assess the role, responsibility and reporting relationship for the City's internal audit function as part of the overall service review of shared functions across the City. Starting in 2012 the CAE will submit to the Audit Committee an annual summary report on the activity undertaken by the Internal Audit Division and the Divisional Work plan for the next two years.

Complete

2. Revise the Internal Audit Charter

Revise the Internal Audit Charter to include the following:

Purpose – refer to Internal Audit’s role in assisting management to determine that processes are functioning in a manner to ensure programs, plans and objectives are achieved

Reporting Relationship – enhance to include periodic reporting to the Audit Committee on the Internal Audit annual plan, performance against plan, and key matters raised, as referred to in Part I, item 1

Refer to the mandatory nature of the Standards as required by Standard 1010

Review the charter annually, as part of the Quality Assurance and Improvement Program, to ensure its continued appropriateness, and submit to the Audit Committee for re-approval.

Internal Audit will revise the Charter accordingly and include the revised charter in their annual reporting to the Audit Committee in 2012. Going forward the charter will be reviewed and its appropriateness determined on an annual basis.

Complete


26


3. Expand the Quality Assurance and Improvement

Program Establish, as part of the QAIP, a schedule of periodic assessment of conformance to Standards. Provide an annual report on the overall results of the QAIP in order to ensure maximum benefit and improvement from the program. Consider additional meaningful performance metrics from the Quality Assessment Manual, GAIN (Global Audit Information Network) and other sources, to improve measurement of Internal Audit effectiveness in carrying out its mandate.

Internal Audit will review the IIA guidelines for periodic assessments scheduled to be released in March 2012 and consider adjusting performance metrics to improve measurement of internal audit effectiveness.

In Progress

4. Improve Coordination with other Audit, Compliance and Assurance functions

Establish disciplined protocols for regular coordination with the Auditor General, external auditors, and other appropriate internal and external providers of assurance compliance or consulting services. This should include timely sharing of the approved audit plan and changes thereto, and copies of internal audit reports.

Internal Audit has initiated and will continue meetings with the external auditor on an annual basis and will continue to the ongoing practice of co-ordinating work with the Auditor General's Office to ensure there is no duplication and inefficiency in the City's overall audit programs. Written protocols will be formulated for inclusion in the Internal Audit manual outlining the co-ordination activity between the audit functions in the City and sharing of audit work plans and reports.

Complete

5. Enhance the Risk Assessment and Annual Planning Process Enhance the Internal Audit risk assessment and annual plan

The Risk assessment and annual plan methodology will be reviewed and enhanced to consider the above and to ensure balance between assurance and advisory/consulting

Complete


27


methodology to ensure:

the audit universe includes all programs, major projects, systems, and management processes that are considered essential to the accomplishment of the organization’s objectives

the risk assessment and prioritization of audits follows consistent criteria, is adequately documented and aligns with the audit universe

staff time for each audit in the plan is estimated to enhance resource management and as input to performance measurement as addressed in item 9 below

the plan and performance against it is communicated to the Audit Committee as addressed in PART I, No. 1 above

services. Specific requests of management for assistance will be considered based on risk assessment.

6. Formalize and Document Communication and Approval of the Audit Plan

Formalize and document Audit Committee approval of the annual Internal Audit Plan and significant changes thereto.

As per Part I, item 1, Internal Audit's role and reporting relationship will be re-assessed as part of the City's overall review of Internal Audit functions across the City. Starting 2012 the CAE will submit to the Audit Committee an annual summary report on the activity undertaken by the Internal Audit Division which will include planned areas of work for the two upcoming years.

Complete

7. Institute a Standard Procedure to Assess Risk at the Engagement Level

Implement a standard procedure for assessing risk at the engagement level to complement the existing planning

Internal Audit will develop a standardized format to assess risk at the project engagement level.

Complete


28


disciplines for objective and scope. This will help ensure consistency in the confirmation of the risk on which the project selected and that individual risks within the area are adequately assessed.

8. Reassess Process for Evaluating Management Requests for Services

Reassess the process for evaluating management requests to ensure an appropriate consideration of risk and the effective and efficient deployment of resources toward the greatest risk and added value.

Management requests for assistance will be considered in light of risk and availability of resources.

Complete

9. Establish Periodic Formal Reporting on the IA Activities and Results

Internal Audit reporting should be enhanced to include periodic (quarterly) reports to senior management and the Audit Committee on:

the Annual Internal Audit Plan and any changes thereto

progress against the plan,

significant risk exposures and issues raised,

results of follow up audits, and

Internal Audit performance against QAIP metrics.

Internal audit will report on a regular basis to the City Manager on the above noted topics and on an annual basis to the Audit Committee.

Complete

10. Consider Implementing Additional Reporting, Efficiency and Effectiveness Improvements

The Division will copy the City Manager on all audit reports; continue to strengthen follow up procedure started

Complete


29


Ensure that existing guidelines on report distribution include the requirement that all audit reports be copied to City Manager.

Continue strengthening the recently initiated process of follow up of Internal Audit recommendations.

Develop and make use of further audit tools and techniques currently available to the profession; i.e., risk analysis, automated working papers etc.

in 2011 and consider further enhancements to audit tools and techniques currently in use.

Internal Audit report - Toronto · Internal Audit Division has issued 10 reports in ... with...

Documents

Transcript of Internal Audit report - Toronto · Internal Audit Division has issued 10 reports in ... with...