There have been a lot of questions about the internal auditor’s independence after Commissioner Keith James sent Imogene Isaacs a demand letter on Monday, and Isaacs quit. Read the full story here.
James acknowledged that he wasn’t aware the city’s charter addresses independence or that the internal auditor can only be fired by commissioners with cause. The city is holding a special meeting Monday at 4 p.m. to discuss these issues.
Here is the city charter’s entry on internal audit. How do you interpret it?
Sec. 4.05. – Internal auditor.
There is hereby created the position of Internal Auditor. The Internal Auditor shall conduct, or cause to be conducted, financial, compliance, and expanded scope audits following generally accepted government auditing standards. The Internal Auditor shall have access to all records and personnel.
The Internal Auditor shall be appointed by the City Commission. Removal from office must be for cause by a majority vote of the entire membership of the City Commission.
To ensure independence of the audit function and to coordinate internal audit work with the needs of the Mayor and the City Commission, an Audit Committee is hereby established. The Audit Committee is a management committee and not a public board, commission or committee as specified in Article III, Section 3.01(5) herein. The Audit Committee shall be comprised of five (5) voting members; the Mayor or designee, the President of the City Commission and three (3) at-large members who shall be appointed by the City Commission. The at-large members shall be City residents with expertise in auditing preferably internal or management auditing and at least two (2) of whom shall be a Certified Public Accountant or a Certified Internal Auditor; appointments shall be staggered for terms of three (3) years. The President of the Commission shall be appointed as Chairperson of the Audit Committee. The Audit Committee shall perform an evaluation of the Internal Auditor annually and present such to the City Commission.
So what does the generally accepted government auditing standards say about independence?
3.02 In all matters relating to the audit work, the audit organization and the individual auditor, whether government or public, must be free from personal, external, and organizational impairments to independence, and must avoid the appearance of such impairments of independence.
3.03 Auditors and audit organizations must maintain independence so that their opinions, findings, conclusions, judgments, and recommendations will be impartial and viewed as impartial by objective third parties with knowledge of the relevant information. Auditors should avoid situations that could lead objective third parties with knowledge of the relevant information to conclude that the auditors are not able to maintain independence and thus are not capable of exercising objective and impartial judgment on all issues associated with conducting the audit and reporting on the work.
3.04 When evaluating whether independence impairments exist either in fact or appearance with respect to the entities for which audit organizations perform audits or attestation engagements, auditors and audit organizations must take into account the three general classes of impairments to independence–personal, external, and organizational.20 If one or more of these impairments affects or can be perceived to affect independence, the audit organization (or auditor) should decline to perform the work–except in those situations in which an audit organization in a government entity, because of a legislative requirement or for other reasons, cannot decline to perform the work, in which case the government audit organization must disclose the impairment(s) and modify the GAGAS compliance statement. (See paragraphs 1.12 and 1.13.)
3.05 When auditors use the work of a specialist,21 auditors should assess the specialist’s ability to perform the work and report results impartially as it relates to their relationship with the program or entity under audit. If the specialist’s independence is impaired, auditors should not use the work of that specialist.
3.06 If an impairment to independence is identified after the audit report is issued, the audit organization should assess the impact on the audit. If the audit organization concludes that it did not comply with GAGAS, it should determine the impact on the auditors’ report and notify entity management, those charged with governance, the requesters, or regulatory agencies that have jurisdiction over the audited entity and persons known to be using the audit report about the independence impairment and the impact on the audit. The audit organization should make such notifications in writing.
3.07 Auditors participating on an audit assignment must be free from personal impairments to independence.22 Personal impairments of auditors result from relationships or beliefs that might cause auditors to limit the extent of the inquiry, limit disclosure, or weaken or slant audit findings in any way. Individual auditors should notify the appropriate officials within their audit organizations if they have any personal impairment to independence. Examples of personal impairments of individual auditors include, but are not limited to, the following:
a. immediate family or close family member23 who is a director or officer of the audited entity, or, as an employee of the audited entity, is in a position to exert direct and significant influence over the entity or the program under audit;
b. financial interest that is direct, or is significant/material though indirect, in the audited entity or program;24
c. responsibility for managing an entity or making decisions that could affect operations of the entity or program being audited; for example, serving as a director, officer, or other senior position of the entity, activity, or program being audited, or as a member of management in any decision making, supervisory, or ongoing monitoring function for the entity, activity, or program under audit;
d. concurrent or subsequent performance of an audit by the same individual who maintained the official accounting records when such services involved preparing source documents or originating data, in electronic or other form; posting transactions (whether coded by management or not coded); authorizing, executing, or consummating transactions (for example, approving invoices, payrolls, claims, or other payments of the entity or program being audited); maintaining an entity’s bank account or otherwise having custody of the audited entity’s funds; or otherwise exercising authority on behalf of the entity, or having authority to do so;
e. preconceived ideas toward individuals, groups, organizations, or objectives of a particular program that could bias the audit;
f. biases, including those resulting from political, ideological, or social convictions that result from membership or employment in, or loyalty to, a particular type of policy, group, organization, or level of government; and
g. seeking employment during the conduct of the audit with an audited organization.
3.08 Audit organizations and auditors may encounter many different circumstances or combinations of circumstances that could create a personal impairment. Therefore, it is impossible to identify every situation that could result in a personal impairment. Accordingly, audit organizations should include as part of their quality control system procedures to identify personal impairments and help ensure compliance with GAGAS independence requirements. At a minimum, audit organizations should
a. establish policies and procedures to identify, report, and resolve personal impairments to independence,
b. communicate the audit organization’s policies and procedures to all auditors in the organization and promote understanding of the policies and procedures,
c. establish internal policies and procedures to monitor compliance with the audit organization’s policies and procedures,
d. establish a disciplinary mechanism to promote compliance with the audit organization’s policies and procedures,
e. stress the importance of independence and the expectation that auditors will always act in the public interest, and
f . maintain documentation of the steps taken to identify potential personal independence impairments.
3.09 When the audit organization identifies a personal impairment to independence prior to or during an audit, the audit organization should take action to resolve the impairment in a timely manner. In situations in which the personal impairment is applicable only to an individual auditor or a specialist on a particular audit, the audit organization may be able to eliminate the personal impairment. For example, the audit organization could remove that auditor or specialist from any work on that audit or require the auditor or specialist to eliminate the cause of the personal impairment. If the personal impairment cannot be eliminated, the audit organization should withdraw from the audit. In situations in which auditors employed by government entities cannot withdraw from the audit, they should follow paragraph 3.04.
3.10 Audit organizations must be free from external impairments to independence. Factors external to the audit organization may restrict the work or interfere with auditors’ ability to form independent and objective opinions, findings, and conclusions. External impairments to independence occur when auditors are deterred from acting objectively and exercising professional skepticism by pressures, actual or perceived, from management and employees of the audited entity or oversight organizations. For example, under the following conditions, auditors may not have complete freedom to make an independent and objective judgment, thereby adversely affecting the audit:
a. external interference or influence that could improperly limit or modify the scope of an audit or threaten to do so, including exerting pressure to inappropriately reduce the extent of work performed in order to reduce costs or fees;
b. external interference with the selection or application of audit procedures or in the selection of transactions to be examined;
c. unreasonable restrictions on the time allowed to complete an audit or issue the report;
d. externally imposed restriction on access to records, government officials, or other individuals needed to conduct the audit;
e. external interference over the assignment, appointment, compensation, and promotion of audit personnel;
f. restrictions on funds or other resources provided to the audit organization that adversely affect the audit organization’s ability to carry out its responsibilities;
g. authority to overrule or to inappropriately influence the auditors’ judgment as to the appropriate content of the report;
h. threat of replacing the auditors over a disagreement with the contents of an audit report, the auditors’ conclusions, or the application of an accounting principle or other criteria; and
i. influences that jeopardize the auditors’ continued employment for reasons other than incompetence, misconduct, or the need for audits or attestation engagements.
3.11 Audit organizations should include policies and procedures for identifying and resolving external impairments as part of their quality control system for compliance with GAGAS independence requirements.
3.12 The ability of audit organizations in government entities to perform work and report the results objectively can be affected by placement within government, and the structure of the government entity being audited. Whether reporting to third parties externally or to top management within the audited entity internally, audit organizations must be free from organizational impairments to independence with respect to the entities they audit. Impairments to organizational independence result when the audit function is organizationally located within the reporting line of the areas under audit or when the auditor is assigned or takes on responsibilities that affect operations of the area under audit.
Organizational Independence for Internal Audit Functions
3.16 Certain federal, state, or local government entities employ auditors to work for management of the audited entities. These auditors may be subject to administrative direction from persons involved in the entity management process. Such audit organizations are internal audit functions and are encouraged to use the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing in conjunction with GAGAS. Under GAGAS, a government internal audit function can be presumed to be free from organizational impairments to independence for reporting internally if the head of the audit organization meets all of the following criteria:
a. is accountable to the head or deputy head of the government entity or to those charged with governance;
b. reports the audit results both to the head or deputy head of the government entity and to those charged with governance;
c. is located organizationally outside the staff or line-management function of the unit under audit;
d. has access to those charged with governance; and
e. is sufficiently removed from political pressures to conduct audits and report findings, opinions, and conclusions objectively without fear of political reprisal.
3.17 The internal audit organization should report regularly to those charged with governance.
3.18 When internal audit organizations that are free of organizational impairments perform audits of external parties such as auditing contractors or outside party agreements, and no personal or external impairments exist, they may be considered independent of the audited entities and free to report objectively to the heads or deputy heads of the government entities to which they are assigned, to those charged with governance, and to parties outside the organizations in accordance with applicable law, rule, regulation, or policy.
3.19 The internal audit organization should document the conditions that allow it to be considered free of organizational impairments to independence for internal reporting and provide the documentation to those performing quality control monitoring and to the external peer reviewers to determine whether all the necessary safeguards have been met.
Organizational Independence When Performing Nonaudit Services
3.20 Audit organizations at times may perform other professional services (nonaudit services) that are not performed in accordance with GAGAS. Audit organizations that provide nonaudit services must evaluate whether providing the services creates an independence impairment either in fact or appearance with respect to entities they audit.27 Based on the facts and circumstances, professional judgment is used in determining whether a nonaudit service would impair an audit organization’s independence with respect to entities it audits.
3.21 Audit organizations in government entities generally have broad audit responsibilities and, therefore, should establish policies and procedures for accepting engagements to perform nonaudit services so that independence is not impaired with respect to entities they audit. (See appendix I, paragraphs A3.02 and A3.03 for examples of nonaudit services that are generally specific to audit organizations in government entities that generally do not impair the organizations’ independence with respect to the entities it audits and, therefore, do not require compliance with the supplemental safeguards described in paragraph 3.30.) Independent public accountants may provide audit and nonaudit services (commonly referred to as consulting) under contractual commitments to an entity and should determine whether nonaudit services they have provided or are committed to provide have a significant or material effect on the subject matter of the audits.
Overarching Independence Principles
3.22 The following two overarching principles apply to auditor independence when assessing the impact of performing a nonaudit service for an audited program or entity: (1) audit organizations must not provide nonaudit services that involve performing management functions or making management decisions and (2) audit organizations must not audit their own work or provide nonaudit services in situations in which the nonaudit services are significant or material to the subject matter of the audits.28
3.23 In considering whether audits performed by the audit organization could be significantly or materially affected by the nonaudit service, audit organizations should evaluate (1) ongoing audits; (2) planned audits; (3) requirements and commitments for providing audits, which includes laws, regulations, rules, contracts, and other agreements; and (4) policies placing responsibilities on the audit organization for providing audit services.
3.24 If requested29 to perform nonaudit services that would impair the audit organization’s ability to meet either or both of the overarching independence principles for certain types of audit work, the audit organization should inform the requestor and the audited entity that performing the nonaudit service would impair the auditors’ independence with regard to subsequent audit or attestation engagements.
Types of Nonaudit Services
3.25 Nonaudit services generally fall into one of the following categories (see appendix I, paragraphs A3.02 and A3.03 for examples of nonaudit services that are generally unique to audit organizations in government entities):
a. Nonaudit services that do not impair the audit organization’s independence with respect to the entities it audits and, therefore, do not require compliance with the supplemental safeguards in paragraph 3.30. (See paragraphs 3.26 and 3.27.)
b. Nonaudit services that would not impair the audit organization’s independence with respect to the entities it audits as long as the audit organization complies with the supplemental safeguards in paragraph 3.30. (See paragraph 3.28.)
c. Nonaudit services that do impair the audit organization’s independence. Compliance with the supplemental safeguards will not overcome this impairment. (See paragraph 3.29.)
Nonaudit Services That Do Not Impair Auditor Independence
3.26 Nonaudit services in which auditors provide technical advice based on their technical knowledge and expertise do not impair auditor independence with respect to entities they audit and do not require the audit organization to apply the supplemental safeguards. However, auditor independence would be impaired if the extent or nature of the advice resulted in the auditors’ making management decisions or performing management functions.
3.27 Examples of the types of services considered as providing technical advice include the following:
a. participating in activities such as commissions, committees, task forces, panels, and focus groups as an expert in a purely advisory, nonvoting capacity to
(1) advise entity management on issues based on the auditors’ knowledge or
(2) address urgent problems;
b. providing tools and methodologies, such as guidance and good business practices, benchmarking studies, and internal control assessment methodologies that can be used by management; and
c. providing targeted and limited technical advice to the audited entity and management to assist them in activities such as (1) answering technical questions or providing training, (2) implementing audit recommendations, (3) implementing internal controls, and (4) providing information on good business practices.
Nonaudit Services That Would Not Impair Independence if Supplemental Safeguards Are Implemented
3.28 Services that do not impair the audit organization’s independence with respect to the entities they audit so long as they comply with supplemental safeguards include the following:
a. providing basic accounting assistance limited to services such as preparing draft financial statements that are based on management’s chart of accounts and trial balance and any adjusting, correcting, and closing entries that have been approved by management; preparing draft notes to the financial statements based on information determined and approved by management; preparing a trial balance based on management’s chart of accounts; maintaining depreciation schedules for which management has determined the method of depreciation, rate of depreciation, and salvage value of the asset (If the audit organization has prepared draft financial statements and notes and performed the financial statement audit, the auditor should obtain documentation from management in which management acknowledges the audit organization’s role in preparing the financial statements and related notes and management’s review, approval, and responsibility for the financial statements and related notes in the management representation letter. The management representation letter that is obtained as part of the audit may be used for this type of documentation.);
b. providing payroll services when payroll is not material to the subject matter of the audit or to the audit objectives. Such services are limited to using records and data that have been approved by entity management;
c. providing appraisal or valuation services limited to services such as reviewing the work of the entity or a specialist employed by the entity where the entity or specialist provides the primary evidence for the balances recorded in financial statements or other information that will be audited; valuing an entity’s pension, other post-employment benefits, or similar liabilities provided management has determined and taken responsibility for all significant assumptions and data;
d. preparing an entity’s indirect cost proposal30 or cost allocation plan provided that the amounts are not material to the financial statements and management assumes responsibility for all significant assumptions and data;
e. providing advisory services on information technology limited to services such as advising on system design, system installation, and system security if management, in addition to the safeguards in paragraph 3.30, acknowledges responsibility for the design, installation, and internal control over the entity’s system and does not rely on the auditors’ work as the primary basis for determining (1) whether to implement a new system, (2) the adequacy of the new system design, (3) the adequacy of major design changes to an existing system, and (4) the adequacy of the system to comply with regulatory or other requirements;
f. providing human resource services to assist management in its evaluation of potential candidates when the services are limited to activities such as serving on an evaluation panel of at least three individuals to review applications or interviewing candidates to provide input to management in arriving at a listing of best qualified applicants to be provided to management; and
g. preparing routine tax filings based on information provided by the audited entity .
Nonaudit Services That Impair Independence
3.29 Compliance with supplemental safeguards will not overcome independence impairments in this category. By their nature, certain nonaudit services directly support the entity’s operations and impair the audit organization’s ability to meet either or both of the overarching independence principles in paragraph 3.22 for certain types of audit work. Examples of the types of services under this category include the following:
a. maintaining or preparing the audited entity’s basic accounting records or maintaining or taking responsibility for basic financial or other records that the audit organization will audit;
b. posting transactions (whether coded or not coded) to the entity’s financial records or to other records that subsequently provide input to the entity’s financial records ;
c. determining account balances or determining capitalization criteria;
d. designing, developing, installing, or operating the entity’s accounting system or other information systems that are material or significant to the subject matter of the audit;
e. providing payroll services that (1) are material to the subject matter of the audit or the audit objectives, and/or (2) involve making management decisions;
f. providing appraisal or valuation services that exceed the scope described in paragraph 3.28 c;
g. recommending a single individual for a specific position that is key to the entity or program under audit, otherwise ranking or influencing management’s selection of the candidate, or conducting an executive search or a recruiting program for the audited entity;
h. developing an entity’s performance measurement system when that system is material or significant to the subject matter of the audit;
i . developing an entity’s policies, procedures, and internal controls;
j. performing management’s assessment of internal controls when those controls are significant to the subject matter of the audit;
k. providing services that are intended to be used as management’s primary basis for making decisions that are significant to the subject matter under audit;
l. carrying out internal audit functions, when performed by external auditors; and
m. serving as voting members of an entity’s management committee or board of directors, making policy decisions that affect future direction and operation of an entity’s programs, supervising entity employees, developing programmatic policy, authorizing an entity’s transactions, or maintaining custody of an entity’s assets.31
Supplemental Safeguards for Maintaining Auditor Independence When Performing Nonaudit Services
3.30 Performing nonaudit services described in paragraph 3.28 will not impair independence if the overarching independence principles stated in paragraph 3.22 are not violated. For these nonaudit services, the audit organization should comply with each of the following safeguards:
a. document its consideration of the nonaudit services, including its conclusions about the impact on independence;
b. establish in writing an understanding with the audited entity regarding the objectives, scope of work, and product or deliverables of the nonaudit service; and management’s responsibility for (1) the subject matter of the nonaudit services, (2) the substantive outcomes of the work, and (3) making any decisions that involve management functions related to the nonaudit service and accepting full responsibility for such decisions;
c. exclude personnel who provided the nonaudit services from planning, conducting, or reviewing audit work in the subject matter of the nonaudit service;32 and
d. do not reduce the scope and extent of the audit work below the level that would be appropriate if the nonaudit service were performed by an unrelated party.
3.31 Auditors must use professional judgment in planning and performing audits and attestation engagements and in reporting the results.
3.32 Professional judgment includes exercising reasonable care and professional skepticism. Reasonable care concerns acting diligently in accordance with applicable professional standards and ethical principles. Professional skepticism is an attitude that includes a questioning mind and a critical assessment of evidence. Professional skepticism includes a mindset in which auditors assume neither that management is dishonest nor of unquestioned honesty. Believing that management is honest is not a reason to accept less than sufficient, appropriate evidence.
3.33 Using the auditors’ professional knowledge, skills, and experience to diligently perform, in good faith and with integrity, the gathering of information and the objective evaluation of the sufficiency and appropriateness of evidence is a critical component of audits. Professional judgment and competence are interrelated because judgments made are dependent upon the auditors’ competence.
3.34 Professional judgment represents the application of the collective knowledge, skills, and experiences of all the personnel involved with an assignment, as well as the professional judgment of individual auditors. In addition to personnel directly involved in the audit, professional judgment may involve collaboration with other stakeholders, outside experts, and management in the audit organization.
3.35 Using professional judgment in all aspects of carrying out their professional responsibilities, including following the independence standards, maintaining objectivity and credibility, assigning competent audit staff to the assignment, defining the scope of work, evaluating and reporting the results of the work, and maintaining appropriate quality control over the assignment process is essential to performing and reporting on an audit.
3.36 Using professional judgment is important in determining the required level of understanding of the audit subject matter and related circumstances. This includes consideration about whether the audit team’s collective experience, training, knowledge, skills, abilities, and overall understanding are sufficient to assess the risks that the subject matter under audit may contain a significant inaccuracy or could be misinterpreted.
3.37 Considering the risk level of each assignment, including the risk that they may come to an improper conclusion is another important issue. Within the context of audit risk, exercising professional judgment in determining the sufficiency and appropriateness of evidence to be used to support the findings and conclusions based on the audit objectives and any recommendations reported is an integral part of the audit process.
3.38 Auditors should document significant decisions affecting the audit objectives, scope, and methodology; findings; conclusions; and recommendations resulting from professional judgment.
3.39 While this standard places responsibility on each auditor and audit organization to exercise professional judgment in planning and performing an audit or attestation engagement, it does not imply unlimited responsibility, nor does it imply infallibility on the part of either the individual auditor or the audit organization. Absolute assurance is not attainable because of the nature of evidence and the characteristics of fraud. Professional judgment does not mean eliminating all possible limitations or weaknesses associated with a specific audit, but rather identifying, considering, minimizing, mitigating, and explaining them.