Buncombe County audit committee hears Baker Tilly plan to serve as outsourced internal audit

Buncombe County’s audit committee met with Baker Tilly to review the firm’s proposed role as the county’s outsourced internal‑audit provider and to set expectations for communication, data handling and the initial risk‑assessment process. Chris Kalafaddis, a partner and national risk advisory public‑sector leader at Baker Tilly, introduced the firm and its public‑sector experience.

"My name is Chris Kalafaddis. I'm in the partner principal role and also serve as our national risk advisory public sector leader," he said, describing services that include internal audit, IT and cyber audit, fraud forensics and enterprise risk management. Stacy Gill, director of Baker Tilly’s Public Sector Internal Audit team, outlined the firm’s methodology: understand the organization, perform an enterprise risk assessment, then "Plan, Execute audits and Communicate results," with follow‑up on management corrective actions.

The presentation said the arrangement would begin with a proposed initial three‑year term and that the firm will perform annual audit planning, hotline investigations and ongoing reporting to the audit committee. Gill was identified as the likely primary point of contact for the engagement.

Committee members and county staff discussed the expected level of committee involvement. Several members asked for more front‑end engagement as the transition proceeds; Glenda Weinert and Howard Whitesides, both audit committee members, said they preferred closer contact early in the relationship. The group settled on a structure of regular formal meetings every other month with written status updates between meetings so the committee can track progress, open issues and any potential findings. Mason Scott, assistant finance director, said staff will coordinate the logistics of those updates and committee access.

County staff described prior negotiation difficulties with another vendor over master services and business‑associate agreement language, noting concerns about redaction demands, liability caps and data‑handling clauses. Melissa Moore, Buncombe County finance officer, said the county had asked for stronger protections. "We couldn't claim any type of data breach under their data insurance," Moore said of the earlier vendor negotiations, adding those terms created unacceptable risk.

Moore said Baker Tilly negotiated more restrictive data‑use terms for the county, including an assurance that county data used in any AI processes would remain within U.S. operations. "They agreed that they would ensure that none of our data was assigned to anything that was not U.S. based," the finance officer said. Another committee member noted "No such issues with Baker Tilly," signaling confidence that the current firm’s contract terms were acceptable.

Next steps recorded in the meeting: staff will complete a kickoff for the risk assessment, share the risk‑assessment questions with committee members who wish to participate or comment, and Baker Tilly will begin collecting documentation and surveying departments. The committee emphasized the importance of maintaining independence from management while complying with public‑records and open‑meetings requirements.

The meeting record shows the committee moved the conversation forward without a new formal vote on contract award at this session; the county’s legal and procurement staff continue to finalize the master‑services agreement and related statements of work.