MTSU audit committee approves updated internal audit charter and policy; staff note minor edits and outstanding quality assessment

The Middle Tennessee State University Audit and Compliance Committee on an affirmative voice vote approved an updated internal audit department charter and changes to Policy 70 to align the university's internal audit documents with new guidance from the Institute of Internal Auditors.

Leah Ladley, Chief Audit Executive, told the committee the charter and policy language follow recent Institute of Internal Auditors standards and a model internal audit charter. "This is a pretty major change for us," Ladley said, adding that the department has updated terminology (including changing "consulting" language to "advisory") and will present a redline for remaining edits before the board. She also said the department's internal quality assessment is not yet complete: "we're still working on that so that report will come to you later."

Why it matters: The charter and institutional policy establish the audit office's reporting relationships, scope and key responsibilities. Committee members asked for clearer and consistent wording about reporting lines and titles so the documents presented to the full Board of Trustees match each other and the Tennessee statutory requirements cited in the packet.

Committee discussion focused on how the charter describes reporting relationships between the internal audit function, the audit committee and the board. A trustee raised language in the packet that cites Tennessee Code Annotated and said the bullets were confusing; Ladley and Jeff Farrar, senior associate university counsel, agreed to confirm statutory language and return any clarified wording. Ladley summarized the committee's instruction: ensure the charter and Policy 70 are consistent in titles, reporting requirements and other terminology before final board approval.

The committee also reviewed two external reviews completed since the last meeting and Ladley noted a transcription error in the packet that she corrected during the presentation, saying the reference should read "Title VI" rather than "Title IV" in one line. She reported the Title VI compliance review found no recommendations on the implementation plan, and a Tennessee Department of Health grant review revealed no findings of a material nature.

On the quarterly internal audit report, Ladley said internal audit completed one investigation that closed with a memo and investigated a reported loss, finding no lacking internal controls in that area. The committee received an updated audit plan included in the meeting materials for future work.

Formal actions recorded during the public session included approval of the minutes from the Feb. 25 meeting, approval of the internal audit department charter as presented (with requested wording consistency checks), and approval of MTSU Policy 70 with the same caveat. Each motion was seconded and carried on a recorded voice vote.

The committee then moved into executive session for discussion related to cybersecurity audits and investigations, ending the public portion of the meeting.

Ending notes: Ladley said she will provide the pending internal quality assessment and redlined policy language to address the committee's concerns prior to the Board of Trustees meeting, and counsel will review statutory phrasing referenced in the charter packet.