Audit director proposes three‑year risk‑based plan and policy updates; committee to review legal input

The audit committee spent substantial time discussing proposed updates to the district’s audit policy and charter.

Janice Hansen, senior internal performance auditor, proposed that the office adopt a formal enterprise risk assessment every three years to drive a three‑year audit plan and an annual work plan. She said that approach would shift the committee away from ad hoc topic suggestions to selecting audits driven by a documented risk assessment.

Hansen also proposed a new requirement that district departments notify and consult with the internal audit office when they are subject to other external or internal audits; that information would help the audit office refine risk assessments and avoid duplication. A third policy addition would codify an implementation plan and validation process for audit recommendations so the committee can track and verify closures.

Hansen said she has been iterating drafts with legal counsel and planned to present a more developed staff proposal at the committee’s next meeting with the aim of referring substantive policy changes to the policy committee. Members asked for additional examples and for legal input before broad board review; Hansen said she will circulate additional examples (including other districts and university models) and that legal review has already begun.

The committee discussed timing and workload: members urged quick feedback on the conceptual elements (risk assessment, external audit coordination, implementation validation) and noted current board retreat values could guide word‑smithing at the policy stage.

Next steps: Hansen will provide additional examples, incorporate legal counsel’s input, and present a refined draft for committee consideration; the committee expects to refer a staff‑approved version to the policy committee for formal consideration.