1. Is the Internal Auditor an MHMRA employee?
2. What does an Internal Auditor do?
3. How long will an audit take?
4. What are the different types of audits?
5. How do you decide what to audit?
6. Who receives a copy of internal audit reports?
7. What are internal controls? Why should I be concerned?
8. Why does each department need individual policy and procedures, in addition to the Administrative, Business, Directives, etc. that are available?
9. What are some examples of common audit findings?
1. Is the Internal Auditor an MHMRA employee? (Top)
Yes, the Internal Auditor is an Agency employee. The Office of Internal Audit is located in Room 560, 7011 Southwest Freeway (713)970-7388. The office hours are 8:00 a.m. - 5:00 p.m., Monday through Friday and anytime you may require.
2. What does an Internal Auditor do? (Top)
The primary responsibility of the Internal Auditor is to evaluate and promote the system of internal controls established at the Agency. This is accomplished by a variety of means, including planned audits, internal control reviews, or advisory services (i.e. consulting engagements). Specifically, the Internal Auditor identifies actual and potential problems and recommends corrective courses of action, in accordance with professional internal auditing standards. In addition, the Internal Auditor performs special projects as requested by MHMRA management personnel and various Agency staff. The Internal Auditor has a dual reporting relationship. The Internal Auditor reports functionally to the audit committee and administratively to the Executive Director of MHMRA of Harris County.
3. How long will an audit take? (Top)
An audit can take from a few days to several months, depending on the nature, complexity and condition of the area under review.
4. What are the different types of audits? (Top)
OPERATIONAL AUDITS
Operational audits are the most common type of audit. Operating procedures, document flow, and internal controls are reviewed in detail. Operational audits assess the effective and efficient use of resources while accomplishing the area's goals and objectives.
COMPLIANCE AUDITS
Compliance audits assess the degree to which the area has adhered to laws, rules, regulations, policies and procedures. Compliance may be reviewed for adherence to Federal, State and local laws, along with other regulatory agencies.
FINANCIAL AUDITS
Financial audits address issues related to the proper accounting and reporting of financial transactions, including authorizations, cash receipts, cash disbursements, and commitments to purchase.
INVESTIGATIVE AUDITS
Investigative audits are performed when required and are the result of alleged acts of fraud or other misconduct. Alleged white-collar crime, misuse of Agency assets, and conflicts of interest are examples of reasons for an investigative audit. Typically, Internal Audit works with other parties, both internal and external to the Agency. Usually, the focus of Internal Audit's review is on internal controls, with the goal of determining whether or not internal controls were compromised.
INFORMATION SYSTEMS AUDITS
Information systems audits typically address general controls, focusing primarily on input controls, output controls, processing controls, backup and recovery plans, data security, and hardware security.
5. How do you decide what to audit? (Top)
Typically, an audit is selected for review as a result of Internal Audit's annual audit plan, administrative requests, or allegations of fraud or other misconduct. Internal Audit's annual audit plan is developed based on a combination of risk assessment, follow-up to previous audits, and mandated recurring audits.
6. Who receives a copy of internal audit reports? (Top)
The Executive Director, the Board Audit Committee Members, along with the Deputy Directors, External Audit Firm, and the responsible Managers of the area being audited. Given the confidential nature of investigative audit reports, Internal Audit further limits the distribution of such investigative reports.
7. What are internal controls? Why should I be concerned? (Top)
Internal control can be defined as a process, effected by an entity's board, management and other personnel, designed to provide reasonable assurance regarding the achievement of goals and objectives in the following categories:
- Effectiveness and efficiency of operations
- Reliability of financial reporting
- Compliance with laws and regulations
You should be concerned with internal controls because everyone at the Agency has some responsibility for the achievement and adequacy of internal controls.
8. Why does each department need individual policy and procedures, in addition to the Administrative, Business, Directives, etc? (Top)
Each department should maintain its own departmental policy and procedures manual to ensure that:
- Continuity and consistency of operations occurs
- Efficiency in operations occurs
- Documentation of "what-to-do" or "what-should-be-done" exists
- Documentation of "how-to-do" exists
- Documentation of the handling of non-routine and/or infrequent processes exists
- Efficiency and effectiveness of training for new employees occurs
On the other hand, MHMRA Wide Policies and Procedures addresses Agency-wide issues, typically Administrative, Client and Fiscal in nature, and does not cover department specific procedures, processes and/or services.
9. What are some examples of common audit findings? (Top)
Examples of common audit findings include the following:
- Inadequate separation of duties, i.e. one employee responsible for all aspects of specific types of activities
- Deposits not made in a timely manner
- Bank accounts not reconciled in a timely manner
- Administrative policies, procedures and practices not documented
- Subsidiary ledger accounts are not reconciled to the general ledger
- Expenditures or disbursements not properly authorized
- Administrative staff not cross-trained to provide coverage during extended absences
- Computer applications developed without adequate technical or user documentation
- Access to agency and departmental computer resources not properly controlled
- Computer data files not backed up on a regular basis
- Electronic backup media not stored in a secure location remote from the original data
- Mission, goals and objectives are not established and documented
