Toll Highway Authority internal audit reports 2024 results, outlines 2025 audit plan and ERM rollout

Sean Farmer, chief of internal audit for the Toll Highway Authority, told the Finance and Audit Committee that internal audit completed several mandated reviews in 2024 and is planning a set of cycle audits and risk-based reviews for 2025.

Farmer said internal audit "completed Feesha's requirements of creating and executing a 2 year audit plan, the annual certification letter, and the required cycle audits" for 2024 and noted the department issued a September 30 progress report to the board chair, the audit committee chair and the executive director. He told directors that five cycle audits were completed in 2024 and that the office passed an external peer review with the highest rating.

The internal audit update matters because it shows how the authority monitors internal controls and the follow-through on audit findings that could affect operations and financial reporting.

Farmer told the committee that internal audit derives its authority from the state's Fiscal Control and Internal Auditing Act and operates under the Institute of Internal Auditors' professional standards and code of ethics. He described the internal audit charter — updated in December 2024 — as defining the office's purpose, authority, responsibilities, scope and reporting processes.

The 2024 work included operational audits, support for SOX-related programs and payment-card industry reviews, prevailing-wage compliance efforts and assistance to other state agencies. Farmer said the authority did not receive federal grants in 2024 and that petty-cash disbursements were below the $5,000 audit threshold, so specific federal- or petty-cash audits were not required that year.

Looking ahead, Farmer said internal audit plans to complete mandated cycle audits in 2025 covering personnel and payroll, purchasing, contracting and leasing, organization and management, and expenditure control. He said additional planned work includes risk-based reviews, special projects at management request, external-party reviews and continued focus on remediation of open findings. He described the office's monthly follow-up process with action-plan owners and said the annual certification letter reporting material open findings to the Auditor General's office is being finalized for submission.

On staffing, Farmer said the department filled all staff-auditor positions and the IT audit manager role in 2024 and is working with administration to fill a construction audit manager vacancy. He described ongoing training and continuing professional education efforts to maintain certifications and support staff development.

Farmer also delivered an update on the authority's enterprise risk management (ERM) program. He described ERM as a structured framework to identify, assess, prioritize and respond to enterprise-level risks and said the program aims to align risk responses with the authority's strategic objectives. He summarized recent steps taken: a September 2024 debrief, January 2025 risk-identification workshops and February 2025 risk-assessment sessions with agency personnel.

Farmer said the ERM steering committee will meet quarterly in June, August and November 2025 to identify and confirm risk owners and finalize risk response plans. He said the program will implement key risk indicators (KRIs) and key performance indicators (KPIs) to monitor risks and that, as the program matures, responsibility for leading ERM may shift from internal audit to a separate executive risk stakeholder to preserve audit independence.

Chair Perinar and Executive Director Cassandra thanked Farmer for the reports; there were no formal motions or votes tied to the audit or ERM presentations.

The committee’s discussion emphasized ongoing remediation, staff capacity and the need to set clear risk owners and reporting metrics as ERM is implemented.

No formal committee action was recorded on the internal audit or ERM items during this session.