ANNUAL AUDIT RISK ASSESSMENT & WORK PLAN Presented by Sandra Healy, CGFM Principal Auditor Idaho Transportation Department

Office of Internal Review Org Chart * 07/16/96 Office of Internal Review Org Chart Donita Stephens Admin Assistant Mike Cram Principal Auditor Sandra Healy, CGFM Diego Curt, CISA Michelle Doane Mary Quarles,CPA Internal Review Manager Carri Rosti, CPA, CGFM ITD Director ITD Board (Audit Committee) Principal Auditor Principal Auditor *

ITD Office of Internal Review * 07/16/96 ITD Office of Internal Review Internal Review conducts independent reviews to assess the effectiveness, compliance, and efficiency of department programs, procedures, and internal controls (GAGAS compliant) Internal Review reviews records and financial reports for certain third parties contracting and sub granting with ITD *

Internal Review Staff & Duties Manager and five auditors Both internal & external audits Allocation of staff hours between internal & external Management requests for non-audit services

Audit and Review Work Plan * 07/16/96 Audit and Review Work Plan Based upon Audit Risk Assessment Criteria Management Need Date of Last Audit Amount of Monies involved Inherent Control Risk *

Risk Assessment Process Process begins mid-Dec Review running list of audit requests Meet with executive management Meet with FHWA Add new requests to running list Rate high, medium and low risk

IR Audit Risk Assessment Top 5-7 high risk projects IR Audit Risk Assessment Template Assess level of risk for each project

Internal Audit Risk Assessment Criteria   Weight Factor Value Extension Dollar Impact 5 >$ 10 mil. $ 5 mil. approximately 3 <$100 K 1 Federal Responsibility/Requirement Importance of Federal Regulations to this Program – Degree (5-0) Public Impact Degree (5-0) Prior Audit Performed (by IR, Legislative Auditor, FHWA) >5 Years Within 2 Years -2 Past 12 Months -5 Management Need/Request Within 6 Months No Hurry

Internal Audit Risk Assessment (cont.) Inherent Risk Factor   3 Potential for Irregularity or Fraud – Degree (5-0) Internal Controls/Administrative Controls Degree (5-0) (Very strong = 0; Very weak = 5) Legal Responsibility/Requirement Degree (5-0) Department Impact Reported Audit Problems on Most Recent Audit Potential Efficiency Improvement 2 Audit Time Estimate 1 <10 Man-Weeks 5 >60 Man-Weeks Total Audit Risk Value

Internal Review Audit Coverage * 07/16/96 Internal Review Audit Coverage 2009 2010 2011 2012 2013 2014 Division of Motor Vehicles X Division of Transportation Performance Division of Aeronautics Division of Highways Division of Administration Division of Human Resources *

Audit Plan Development Hours required for an Internal Audit Staff availability hours External audit hours Resulting Internal Audit hours available Audit work plan

Estimate Time Required (Internal Audits) Formula: Take top 3-4 and estimate time required Planning: 4 weeks Field Work: 8–12 weeks (complexity, travel, etc.) Wrap-up: 4 weeks Total: 16 – 20 weeks (team lead) 16 weeks x 40 hours/week = 640 hrs. 20 weeks x 40 hours/week = 800 hrs. Team member: 320–400 hrs. (1/2 time) Thus, each internal audit time estimate: 960–1200 hrs.

Estimate Staff Availability 5 Auditors @ 2,080 hours 10,400 Less vacation & SL @ 200 ea. 1,000 Less training @ 50 ea. 250 Net 9,150 Lost productivity (20%) 1,830 Estimated available time 7,320 (Not an exact science!)

External Audits Need to deduct from staff availability (high est.) 40 Pre-award reviews 24-40 hours ea. 1,600 60 Overhead rate reviews 16-24 hours ea. 1,440 2-3 Cognizant reviews@80 hrs. 240 2 Post audits/yr. @120 hrs. 240 1-2 Sub-grantees/yr. @ 80 hrs. 160 Total 3,680

Internal Audits - Staff Availability Estimated available staff hrs. 7,320 Less: Est. external audits 3,680 Est. FHWA joint audits 160 Available time for internal audits & non-audit services 3,480 (about 2-3 internal audits)

Audit Work Plan Key:

Audit Work Plan (cont.)

Audit Work Plan (cont.)

Annual Report to the Board Panel presentation – all auditors Last year’s audits and reviews (Internal, external & non-audit services) Each auditor speaks 1-2 mins. on a particular audit/review or effort involved in Audit and review work plan for current year (Internal, external and non-audit services)

Audit Resolution Log Prior audit recommendations Audit Resolution Committee meets quarterly Requests status updates Update audit resolution log Audit Mgr. presents to Executive Team

Summary Risk Assessment Process Audit Work Plan Audit Resolution Follow Up

Office of Internal Review Thank You/Questions * 07/16/96 Office of Internal Review Thank You/Questions *

Contact Information Sandra Healy, CGFM Principal Auditor Idaho Transportation Department Office of Internal Review 3311 W State St Boise, ID 83703 sandra.healy@itd.idaho.gov