DAS reports stronger statewide internal-audit compliance but flags gaps in external assessments

The Joint Committee on Legislative Audits heard an informational presentation Feb. 3 from the Oregon Department of Administrative Services on the agency's 2023'24 report on statewide internal audit activities. Department officials said agency compliance with internal-audit rules and staffing levels have improved, but gaps remain in required external quality assessments and in how exemptions are handled.

Malia Masiba, legislative director for the Department of Administrative Services, introduced Eli Ritchie, the department's chief audit executive and statewide internal-audit coordinator, who presented the report and answered committee questions.

Ritchie told the committee that "this is the strongest performance that we've ever had, at least in that time," referring to agency compliance and staffing since DAS began reporting on internal-audit activities. He said 34 agencies met the statute's eligibility criteria for establishing an internal-audit function; of those, 29 have established functions and five have exemptions. Ritchie said the exemption process and some long-standing exemptions are areas he is working to clarify and address with affected agencies.

Ritchie described the statutory and rule framework governing internal audit in state government, telling the committee that the statute (referred to in the presentation as "184.36") requires DAS to adopt rules, report annually and coordinate internal-audit activity across state agencies. He explained that rule-based structural elements include adoption of professional auditing standards, a dual reporting structure, audit committees with external members, and a governing charter for each audit function. The service requirements he listed include an agency risk assessment, a risk-based audit plan, periodic governance and risk-management audits and an external quality assessment of each audit function.

On specific results from fiscal year 2023'24, Ritchie reported that 24 of 29 agencies with audit functions produced an agency risk assessment within the reporting period, and 26 of 29 conducted at least one risk-based audit. He said 28 of 29 completed a governance and risk-management audit. Staffing levels for internal auditors have risen from a previous low after the recession to what Ritchie described as a historical high; he said a few vacancies existed but one vacancy had since been filled and two agencies were contracting with outside audit providers.

He flagged external quality assessments as a persistent compliance issue: 12 agencies were out of compliance with the requirement for an external assessment every five years. Ritchie said he is developing corrective action plans and expects it will take several years to bring all functions into compliance.

Committee members asked how agencies prioritize audits. Representative David Gomberg (asked as "Rep. Gomberg" in the transcript) and Representative Graber asked about risk methodology. Ritchie said audit chiefs use different methodologies but commonly identify objectives, risks to those objectives and then score risks by likelihood and severity; some also factor "auditability" to determine whether audit is the right tool. On public access, Ritchie said internal audits are typically available to the public but that records or passages may be redacted under public-records exemptions depending on subject matter.

Ritchie also described differences and collaboration between internal and external auditors: internal auditors follow standards from the Institute of Internal Auditors (the "Red Book"), while external auditors use Government Accountability Office or federal standards (the "Yellow Book"). He emphasized that both functions serve the public interest and that external auditors may rely on internal-audit work when it meets quality standards.

Committee members raised the large number of smaller agencies, boards and commissions that do not meet the statutory thresholds for an audit function; Ritchie said those entities often receive some external coverage from the Secretary of State or contract auditors on an ad-hoc basis, and that he hopes to identify more opportunities to increase audit coverage for smaller entities.

Ritchie said 13 agencies performed advisory or consulting engagements in the year covered by the report; the transcript recorded a combined total of either "32 or 34" consulting engagements but did not specify an exact final number. He also described efforts to clarify exemptions, to provide tools and resources to chief audit executives and to improve compliance with external-assessment requirements.

The presentation included a brief history of Oregon internal-audit guidance, beginning with optional guidance in the Oregon accounting manual in 1991, mandatory guidance implemented in 1993, statutory action in 2005 referenced as creating the statute "184.36," and rule changes and audits by the Secretary of State in later years (including a rules update in 2022 and Secretary of State audits in 1996, 2003 and 2017'18 cited in the presentation). Ritchie said he previously participated in the Secretary of State audit work and is now serving in the role he once audited.

The committee closed the informational hearing after a period of questions and Ritchie said he would work with agencies on corrective action plans to address the outstanding external-assessment noncompliance. The committee staff announced that next week's meeting will include two annual financial reports: the state financial report and the Oregon State Lottery Commission report.