Introduction and Scope:
The Internal Audit (IA) Department performs an independent, objective assurance and consulting function to add value to and improve the performance of the Virginia Department of Health’s (VDH) operations. The scope of work in the IA department includes determining whether VDH risk management, internal control, governance processes, and implementation of best practices, as designed and represented by management, are adequate and functioning in a manner to ensure effectiveness and efficiency of operations, reliability of reporting, and compliance with policies, procedures, laws and regulations. Recommendations are made for improvements in procedures and systems. The audit function is a proactive change agent, providing impartial opinions on the processes reviewed, actions that are workable and cost-effective solutions that help mitigate business risks. Additionally, the IA department is tasked with conducting investigations derived from the Virginia State Employee Fraud, Waste and Abuse Hotline.
The Internal Audit department staff will adhere to the Institute of Internal Auditors’ “Code of Ethics”. In addition, IA staff will adhere to operating procedures as described in the department’s standard operating policies and procedures.
Authority is granted for full, free and unrestricted access to any and all of the Health Department records, physical properties, and personnel relevant to any function under review. All VDH employees are requested to assist Internal Audit in the fulfilling of their function. Documents given to IA staff during a review will be handled in the same prudent and confidential manner as by those employees normally accountable for them.
The Internal Audit Director reports directly to the Health Commissioner. All IA activities shall remain free of influence by any element in the organization, including matters of audit selection, scope, procedures, frequency, timing, or report content to permit maintenance of an independent and objective mental attitude necessary in rendering reports. Internal Auditors shall have no direct operational responsibility or authority over any activities they review. Accordingly they shall not develop nor install systems or procedures, prepare records, or engage in any other activity which would normally be audited.
Audit and Risk Steering Committee:
The Commissioner has tasked several VDH Division Directors, the Chief Deputy and the Deputy for Administration, as well as the VDH Performance Improvement Manager and the State Internal Auditor to attend quarterly meetings of an advisory committee, the purpose of which is to provide the Commissioner (and indirectly the Audit Director), input regarding the Internal And External Audit functions, as well as the Agencies Risk Management and Ethics areas.
The Internal Audit Director shall complete annually a summary of work completed during the prior year, for comparison with planned audits, as well as an audit plan for the subsequent year. The audit plan is to be developed based on prioritization of the audit universe based on risk, input from agency division managers and the approval of the Health Commissioner. Any significant deviations from the approved plan shall be communicated to the Health Commissioner through periodic activity reports.
A written Internal Audit report is prepared and issued by the IA Director or designee following the conclusion of each audit, and will be distributed as appropriate.
A copy of each audit report and a summary will be forwarded to the Health Commissioner along with the auditee’s response and corrective actions agreed to, completed or planned. Management’s response should include a timetable for completion, the person responsible for completing the action, and an explanation for any recommendations not implemented.
IA shall be responsible for performing an appropriate follow-up on audit findings and recommendations. All significant findings will remain an open issue until deemed cleared by the IA Director.
Internal Audit performs investigations of situations which may warrant special review. IA also performs investigations as referred by the State Internal Auditor under the State’s Hotline program.
Outside Audit Coordination:
Internal Audit maintains a close relationship with the Auditor of Public Accounts (APA) which performs the annual financial audit of VDH. The Internal Audit Plan is scheduled not to duplicate or overlap the work performed by the APA. The IA Director assists the Commissioner by coordinating the audit and the management response and corrective action plan for the annual review as well and any other audits by outside audit groups.
Internal Audit participates in a consultative basis in the development of the information security for any new information systems, and in the development of the overall Information Security program at VDH.
Richard P. Corrigan, CIA, CFSA, Internal Audit Director
Karen Remley, M.D., MBA, FAAP, Health Commissioner
Revisions Approved by the Commissioner’s Audit and Risk Steering Committee at the Feb. 3, 2012 meeting.