from process police to guardian of public …...international professional practice framework...

© Escamilla, Poneck & Cruz, LLP ‐ 2013 1

FROM PROCESS POLICE TO

GUARDIAN OF PUBLIC TRUST?THE EVOLVING ROLE OF THE INTERNALAUDITOR IN TEXAS PUBLIC SCHOOLS

FROM PROCESS POLICE TO

GUARDIAN OF PUBLIC TRUST?THE EVOLVING ROLE OF THE INTERNALAUDITOR IN TEXAS PUBLIC SCHOOLS

Presented by:

Juan J. CruzEscamilla, Poneck & Cruz, LLP

School Districts in TroubleSchool Districts in Trouble

“Former Texas Judge Agrees to Pay $250k Restitution in School Health Care Fraud Case”

– Source: ABA Journal, September 13, 2012


Recent NewsRecent News

“DISD Discusses Internal Audit Probing Hiring Practices”

– Source: NBCNews.com January 11, 2012


“Former Ira Independent School District SuperintendentSentenced to 14 Months in Federal Prison on Mail FraudConviction”

– SOURCE: THE UNITED STATES ATTORNEY'S OFFICE NORTHERN DISTRICT OF TEXAS. August 31, 2012



“TEA begins Canutillo ISD inquiry: Possible efforts tocheat federal accountability examined”

– SOURCE: Las Cruces Sun-News, January 11, 2013


“TEA begins Canutillo ISD inquiry: Possible efforts tocheat federal accountability examined”

–SOURCE: Las Cruces Sun-News, January 11, 2013



“Former EPISD superintendent sentenced to 3 ½ years in jail, must pay

$180,000 in restitution”

–SOURCE: KFOX 14 NEWS, October 5, 2012


“EPISD board shirked law, duty to oversee district auditor”

– SOURCE: El Paso Times June 22, 2012


Texas Education CodeTexas Education Code

Section 11.170: Internal Auditor

If a school district employs an internal auditor:

1.) the board of trustees shall select the internal auditor; and

2.) the internal auditor shall report directly to the board.

Added by Acts 2006, 79th Leg., 3rd C.S., Ch. 5, Sec. 2.04, eff. May 31, 2006.

Defining the Role and Responsibilities of the Internal Auditor

Defining the Role and Responsibilities of the Internal Auditor

• The Institute of Internal Auditors defines the internal audit function as an independent and objective assurance and consulting activity designed to add value and improve an organization’s effectiveness.

Value Added?


Defining the Role and Responsibilitiesof the Internal Auditor

Defining the Role and Responsibilitiesof the Internal Auditor

Internal Auditor

External Auditor


Challenges and Issues Relevant to Texas School District Internal Auditors


• Retaliation against Internal Auditors after discovering something amiss

• The balancing act of remaining independent and objective, yet being perceived as part of the team with something to contribute

• The role and responsibility of the internal auditor in a fraud investigation

• The need to maintain clear lines of communication with to the board.



• An “internal auditor” is an “internal auditor” regardless of the title assigned; circumventing proper reporting lines with clever reclassifications is unethical

• Importance of good controls in key areas such as Student Activity Funds

• To maintain independence report structure must be directly to the Board of Trustees


Professional Code of ResponsibilityProfessional Code of Responsibility

Institute of Internal Auditors (IIA)

International Professional Practice Framework



Mandatory GuidanceThe three mandatory elements of the IPPF are:

1. Definition of Internal Auditing

2. Code of Ethics

3. International Standards for the Professional Practice of Internal Auditing (Standards)


IPPF – Code of EthicsIPPF – Code of Ethics

• Principles that are relevant to the profession and practice of internal auditing.

• Rules of Conduct that describe behavior norms expected of internal auditors. These rules are an aid to interpreting the Principles into practical applications and are intended to guide the ethical conduct of internal auditors.

Code of Ethics —Principles


Independence & ObjectivityIndependence & Objectivity

Independence +

Objectivity___________________________

Higher standards of organizational accountability and Transparency

What Does an Internal Auditor Do?What Does an Internal Auditor Do?

1. Governance - consists of all the parts that provide direction to an organization. It involves culture, Board oversight, management style; policies, rules, procedures etc.

2. Risk Management

3. Control Processes - “ground level” policies and procedures used to ensure (a) effective and efficient operations, (b) compliance with regulations, and (c) conformity to industry or other standards


What Does an Internal Auditor Do?What Does an Internal Auditor Do?

IIA Standard 2110.A1

States that the “internal audit activity must evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities.”

Dual Reporting CapacityDual Reporting Capacity

• Internal Auditors must be free from interference (defining scopes of audits, performing the audit work itself and communicating results)

• Internal Auditor/Chief Audit Executive must communicate directly with the Board of Trustees


Working with the SuperintendentWorking with the Superintendent

• Should report administratively to the Superintendent

• Includes: budgeting and accounting; internal communications; administration of the organization's internal policies and procedures

• Superintendent should ensure that IA has full access to information needed.

• Superintendent may “task” the internal auditor, but should always include full disclosure to the board

Working with Board of TrusteesWorking with Board of Trustees

• TEC 11.170 – Direct reporting to the Board of Trustees

• Auditors are expected to fully disclose their findings to both the unit they are auditing and the supervising body (i.e., Board of Trustees)

• Board should provide strategic direction to Auditing Department

• With full disclosure Board can make determination when outside investigation or work with General Counsel is required.


District Charter?District Charter?

• Charter should outline the purpose, objectives, organization, authorities, and responsibilities of the internal auditor and/or audit department, and the Board of Trustees

• Charter should grant the audit department the authorization for direct access to any records, files, or data needed to effectively examine any department.

Interface with Legal IssuesInterface with Legal Issues

FRAUD


Initial Detection of Occupational FraudsInitial Detection of

Occupational Frauds

©2010 Association of Certified Fraud Examiners, Inc.

Fraud PreventionFraud Prevention

1. Begins with the creation of a Culture of Ethical Conduct.

2. Tone is set at the top of the organizational chart.

3. District Leadership establishes “controls”

4. Internal Auditor assesses the effectiveness of these controls and identifies and reports on areas of risk or inconsistency.

5. All reports delivered to unit audited and the Board of Trustees.


Protecting the WhistleblowerProtecting the Whistleblower

• When a public employee speaks pursuant to her official duties, she is speaking as a government employee and not as a citizen, and the First Amendment does not protect her speech from employer discipline.

Garcetti v. Ceballos, 547 U.S. 410 (2006)

5th Circuit5th Circuit

• Public employee Auditor uncovers pornography being viewed on state-owned computers.

• Experiences backlash and interference in her investigation.

• Dissatisfied with the response to her investigation, she writes complaint letter to president and other organization leaders.

• Speech unprotected because the audit is “part of her job responsibilities”

Davis v. McKinney 518 F.3d 304 (5th Cir. 2008)


Texas Whistleblowers ActTexas Whistleblowers Act

• Protects public employees who make (1) good faith reports of (2) violations of law by their employer (3) to an appropriate law enforcement authority.

Additional Best Practices to ConsiderAdditional Best Practices to Consider

• Evaluation of Auditor

To maintain Auditor Independence and Objectivity consider placing the full responsibility for the evaluation of the Internal Auditor with the Board of Trustees.



• Direct Reports to Board of Trustees Meetings

An internal auditor should report to the Board of Trustees without interference from the Administration. The Auditor should report on a monthly basis to the Board of Trustees in closed session. When the Internal Auditor enters the closed session room, the Superintendent should step out.


• Tasking the Internal Auditor by Individual Board Members

No one board member should be tasking the internal auditor without knowledge and sanction of the full School Board.



• Tasking the Internal Auditor by the Superintendent

The Superintendent does have the authority to task the auditor. However, all findings are reported to the Board of Trustees. Management should always be given an opportunity to respond to the Audit prior to a final Audit Report.

The EndThe End

The University of Texas School of Law

Continuing Legal Education • 512-475-6700 • www.utcle.org

Presented: 2013 School Law Conference

February 21-22, 2013

Austin, Texas

The Role of the Internal Auditor

Presented By: Juan J. Cruz

Author contact information: Juan J. Cruz Partner Escamilla, Poneck & Cruz, LLP 216 W. Village Blvd, Suite 202 Laredo, Texas 78041 [email protected] 956-717-1300 – Phone 956-717-0539 – Fax Coauthor: Amy S. Johnson Associate Escamilla, Poneck & Cruz, LLP

1

FROM “PROCESS POLICE” TO GUARDIAN OF PUBLIC TRUST: THE EVOLVING ROLE

OF THE INTERNAL AUDITOR AND THE RELEVANCE TO TEXAS PUBLIC SCHOOLS BY JUAN J. CRUZ

A survey of recent news headlines illustrates an abundance of Texas school districts that have been charged with, or suspected of, tampering with grades, attendance and testing; misappropriating public funds; ignoring conflicts of interest in procurement; and generally engaging in other questionable or illegal conduct. Although not an anomaly within the state, the turmoil unraveling in the El Paso Independent School District (“EPISD”) over the last two years is one of the more conspicuous examples of this. Corporate financial scandals in the last decade have created a concentrated focus on white-collar corruption and heightened scrutiny of corporate governance and risk management. Resultant regulation addressing primarily publicly-held companies1 imposes affirmative duties on auditors to assess the risk of fraud.2 The American Institute of Certified Public Accountants has similarly tightened professional auditing standards and increased auditing responsibility. These measures, among others, require companies listed on the US Exchanges to disclose their governance measures, board structures and board oversight of risk management via internal auditing processes;3 the role of the private sector internal auditor is rapidly changing. Although directed at the private sector, public entities are not impervious to this wave of regulatory change. State agencies are also required to promote and practice sound internal control and provide accountability for their activities. Moreover, internal auditors within public entities face additional political risks from which their private-sector counterparts are largely exempt. School district internal auditors play a key role in fostering and preserving, or in the alternative undermining, the public trust with respect to finances and operations, as well as testing and instruction. Despite this, the task of our school district internal auditors remains largely misunderstood. The recent events in the EPISD are a stark reminder that not only can governance in the public sector fail, but also such ethical lapses have both tangible and intangible costs. The Texas Education Agency’s disabling of the EPISD Board of Trustees and the placement of the district under a Board of Managers was a clear attempt towards repairing the damage to the district’s credibility and restoring public trust. While the Trustees have been heavily scrutinized for their failure to adequately supervise former Superintendent Lorenzo García, amidst the turbulence the Board also emerged significantly confused over the proper interface between the district’s Internal Auditor, the Superintendent, and the Board of Trustees. In the months leading up to the exposure of multiple wrongdoings, an internal audit had indeed uncovered discrepancies in several areas of EPISD operations. The Board of Trustees, however, had previously delegated authority of internal audit oversight exclusively to the Superintendent, who then had the sole

1 E.g., Sarbanes-Oxley Act of 2002 Pub.L. 107-204; 74 F.R. 68334. 2 Statement of Auditing Standards (SAS) No. 99 (AU sec 316), Consideration of Fraud in a Financial Statement Audit; SAS No. 1 (AU sec 1), Codification of Auditing Standards and Procedures; PCAOB AS5. 3 U.S. Securities and Exchange Commission’s Proxy Disclosure Enhancements Release Nos. 33-9089; 34-61175; 17 C.F.R §§ 229, 239, 240, 249 and 274 (2005).

2

decision-making power in responding to the audit.4 This is not to suggest that a different tact would have with certainty prevented the crises. However, by circumventing best practices of internal audit accountability and reporting protocol, an ethical collapse was nearly certain to occur.

A. DEFINING THE INTERNAL AUDITOR Despite budget cuts and reductions in staff, school district leadership must ensure effective controls and high standards of organizational governance, accountability and transparency. In response, internal audit must remain independent and objective in ensuring that audit work focuses on the issues most important to the respective district and follows district protocol. This rather large charge begs the question: What exactly is the role of the internal audit staff in the overall function of a public school district? Diverging definitions of the “internal auditor” abound and experts in the field agree that one of the internal audit profession's greatest challenges is clarifying its role, responsibilities, and true value.5 In search of answers, in preparing for this paper and presentation, we surveyed our school district internal auditors state-wide, and requested anonymous input identifying the issues of greatest professional concern. While several narrowly-focused issues arose, such as risks in certain cash accounting situations, the vast majority of concerns involved the structure of reporting, communication and cooperation between the various entities in the school district. The remainder of this paper is dedicated to clarifying these issues. The internal auditor potentially plays a vital role in ensuring continuing organizational effectiveness and accountability but only when the role of audit activity is clearly defined and the proper reporting structure is in place. The Institute of Internal Auditors (“IIA”), an international professional association recognized as the professional leader in certification, education and guide of ethical professional conduct, defines the internal audit function as an independent and objective assurance and consulting activity designed to add value and improve an organization’s effectiveness.6 But what defines the scope of their work? What is their hand in either defining or maintaining a school district’s ethical culture and how do we better ensure it is effective? The dearth of case law on point and minimal content in the Texas Education Code betrays the importance of and complexity in answering these questions.

1. Traditional Perceptions Question: Why did the internal auditor cross the road? Answer: “Because he looked in the file and that’s what they did last year.” Jokes aside, internal auditors can fall victim to poor branding and the field, as have other professional occupations, has amassed a slew of undesirable

4 Zahira Torres & Hayley Kappes, EPISD Board Shirked Law, Duty to Oversee District Auditor, 6/22/2012, El Paso Times, available at, http://www.elpasotimes.com/news/ci_20913996/episd-board-shirked-law-duty-oversee-district-auditor. 5 SmartPros Ltd., Internal Auditor Jobs on the Rise (2007), http://accounting.smartpros.com/x57694.xml. 6 The Institute of Internal Auditors (“IIA”), available at https://na.theiia.org/standards-guidance/mandatory-guidance/Pages/Definition-of-Internal-Auditing.aspx.

3

nicknames and associated professional affronts.7 The misconceptions of contemporary internal auditors are perhaps partially rooted in the origins of internal auditing, which began as a pure appraisal activity in support of management only. In such capacity, colleagues likely observed internal audit staff on their seasonal “witch hunt” in which they followed a cycle of selecting high-risk audit targets and conduct the same investigation the same way year after year.8 Contemporary internal auditors are more properly categorized as business generalists who specialize in identifying opportunities by measuring compliance with district policies and procedures with an eye on increasing effectiveness for the organization as a whole.9

2. Texas Education Code In seeking to define the role of a school district internal audit staff, existing Texas law does not provide much guidance. While the Texas Education Code requires school districts to undergo an annual external audit of their financial statements,10 the creation of an internal audit function is optional.11 The Texas State Auditor’s Office recommends that districts with an annual operation expenditure of more than $20 million and enrolling more than 5000 students create an internal audit function.12 For those districts that do employ an auditor, the reporting structure and hiring procedure is statutorily controlled and under the auspices of the Board of Trustees.13 Other than Section 11.170 and a handful of statutory mandates,14 school districts must craft their own Audit Charters yet remain faithful to the professional guidelines, standards and codes of ethics established in the internal audit profession.

3. Professional Standards of Practice and Code of Ethical Conduct An institution’s best model of ethical and effective audit activity is existing professional standards and guidance. The IIA’s “International Professional Practice Framework” provides standards, best practices and guidance for independence and ethics, professional proficiency, scope and performance of audit work, management of internal auditing, and quality assurance reviews.15 The overarching goal of the internal auditor is to provide a safety net for ensuring effective operations, reliable financial reporting, compliance with laws and regulations and the safeguard of assets.16

7 Andrew L. Cheskis, What’s your Brand?, October 2012, Internal Auditor, http://www.theiia.org/intAuditor/feature-articles/2012/october/whats-your-brand/. 8 Robert Barry, Overcoming the 5 Class Myths of Internal Auditing, June 25, 2012, http://www.thatauditguy.com/overcoming-the-5-classic-myths-about-internal-auditing/. 9 The Institute of Internal Auditor’s International Professional Practice Framework. 10 Tex. Educ. Code §44.008(a), (b). 11 Id.; see also Texas State Auditor’s Office Report No. 3-010. 12 Texas State Auditor’s Office Report No. 3-010. 13 Tex. Educ. Code §11.170. 14 E.g., Tex. Educ. Code §37.108 (addressing security and safety requirements of district facilities and requiring a security and safety audit once every three years). 15 IIA’s Standards and Guidance can be found at: https://na.theiia.org/standards-guidance/Pages/Standards-and-Guidance-IPPF.aspx. 16 Id.

4

The Code of Ethics promulgated by the IIA presents the Principles and Rules of Conduct governing the behavior of individuals and organizations in the course of internal auditing.17 Internal auditors are expected to uphold the following principles: Integrity; Objectivity in evaluating the process being examined; Confidentiality absent legal obligations to disclose; and Competency. The Rules of Conduct provide behavior norms in support of the Principles of the profession.18 Notably, assessing an organization’s compliance with its code of ethics is not a voluntary activity. IIA Standard 2110.A1 states that the “internal audit activity must evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities.”19

B. RELATIONSHIP BETWEEN INTERNAL AUDITOR AND SCHOOL DISTRICT LEADERSHIP Despite the requirement of objectivity, internal auditors are part of the organization and play a much different role than that of an external auditor. The primary mission of an external auditor is to provide an independent opinion on financial statements conducted in accordance with generally accepted auditing and accounting standards. Internal auditors, on the other hand, are concerned will all aspects of an organization, and focus more intently on the efficiency of programming not typically examined in a financial audit. The activities, however, are not mutually exclusive of each other. Because of its overarching knowledge of district operations, the internal auditing staff may be the most effective liaison to coordinate the external audit process.20 An internal auditor may audit anything from financial statements to customer service or human resources processes. The primary function of an internal auditor is to provide an objective and independent review of data or processes that an organization has in place. Accordingly, the internal auditor must remain a disinterested party who has no vested interest in the success, failure, feasibility or accuracy of the data she examines. Finding the right position in the ecology of the school district requires a carefully-executed balancing act.

1. Board of Trustees The success or failure of assuring auditing objectivity and independence is closely tied to the reporting structure of an organization. Auditors are expected to fully disclose their findings to both the unit they are auditing and the supervising body. This reporting line for the internal audit activity is the ultimate source of its independence and authority. An internal auditor cannot examine an organization’s processes and controls without bias if the person responsible for those records is the internal auditor’s supervisor. This is precisely why the strategic and functional

17 The Institute of Internal Auditors International Professional Practice Framework, https://na.theiia.org/standards-guidance/mandatory-guidance/Pages/Code-of-Ethics.aspx. 18 Id. 19 IIA Standards and Guidance 2110.A1, http://www.theiia.org/guidance/standards-and-guidance/ippf/standards/standards-items/index.cfm?i=8267. 20 In our survey, several internal audit departments indicated that this collaborative arrangement between the internal and external audit function has been officially added to their district Audit Charter.

5

activities of the school district internal auditor are statutorily placed under the auspices of the Board of Trustees and should not be delegated.21 An effective relationship between the Board of Trustees and the internal audit department is critical. The Board of Trustees in its oversight of the internal auditor should provide strategic direction and enforcement of investigative activities if necessary.22 In further support of this independence, the Board of Trustees preferably should oversee the appointment, dismissal, and compensation of the internal auditor, or chief audit executive. Practically speaking, internal auditing should provide the Board with full disclosure of its audit activities and reports.23 While the Board may ensure that the internal audit function is properly addressing risk areas and also make recommendations for audit inquiry, the internal auditor gains significant independence by removing the superintendent or other high-ranking administrators form the chain of reporting. If the Board becomes aware of significant areas of concern, at that point they should consult with general counsel and determine whether to conduct an independent investigation and to what extent. A sound internal investigation can help insulate a board of trustees against allegations of failure to adequately respond to reports of internal misconduct.

2. Superintendent A district internal auditor should report administratively to the Superintendent or another administrator with sufficient authority to provide support to the internal audit team to support its daily function.24 IIA defines administrative reporting as the reporting relationship within the organization's management structure that facilitates the day-to-day operations of the internal audit function. Under this definition, administrative reporting typically includes: budgeting and management accounting; internal communications and flow of information; administration of the organization's internal policies and procedures. 25 The internal auditor should not be viewed as a substitute for adequate controls. With support and cooperation of the Board of Trustees, the Superintendent and administrative

21 Tex. Educ. Code §11.170; IIA’s definition of functional reporting assumes that the governing authority: approves the internal audit function's charter; approves the internal audit risk assessment and related audit plan; receives communications from the chief audit executive (“CAE”) on the results of internal audit activities and other matters that the CAE determines are necessary; approves all decisions regarding the appointment or removal of the CAE; approves the annual compensation and salary adjustment of the CAE; makes appropriate inquiries of management and the CAE to determine whether there are scope or budgetary limitations that impede the ability of the internal audit function to execute its responsibilities. 22 The Institute of Internal Auditors, “The Role of Auditing in Public Sector Governance” (2006). 23 Id. 24 IIA Practice Advisory 1110-2:Chief Audit Executive (CAE) Reporting Lines - Interpretation of Standard 1110 from the International Standards for the Professional Practice of Internal Auditing; “The chief audit executive should report to a level within the organization that allows the internal audit activity to accomplish its responsibilities . . .The Institute (IIA) believes strongly that to achieve necessary independence, the CAE should report functionally to the audit committee or its equivalent. For administrative purposes, in most circumstances, the CAE should report directly to the chief executive (CEO) of the organization.” 25 Id.

6

leadership must develop and maintain the internal control system. Internal controls include organizational structure, human resource policy, and management operating style. Any action an organizational leader takes to ensure district goals are achieved should be considered an internal control. Internal Audit is responsible for examining and evaluating the adequacy and the effectiveness of those systems. After evaluation, the internal auditor will make recommendations on areas of risk or perceived deficiencies; this information will also be related to the Board of Trustees. The dual reporting structure should be viewed as an asset rather than a liability. To ensure transparency, best practice indicates the dual reporting structure is ideal.26 When internal audit reports to the Board of Trustees, the function is kept structurally separate from management, a distinction that best maintains objectivity and independence and encourages unfiltered communication regarding issues of concern. Conversely, when internal auditors report to the Superintendent, both independence and objectivity can be seriously compromised in the midst of pressure from superiors to disregard questionable practices or issue tainted reports.

3. District Charter

One of the critical elements of a sound risk management system is an internal audit department with a well-defined charter that supports reporting and monitoring of risks. The mission statement or audit charter should outline the purpose, objectives, organization, authorities, and responsibilities of the internal auditor and/or audit department, and the Board of Trustees. In particular, the charter should grant the audit department the authorization for direct access to any records, files, or data needed to effectively examine any department. Moreover, that authorization should also include access to and communication with any district employee. The audit department should work with the Board of Trustees in the development of the charter and collaborate in its periodic review.

C. INTERFACE WITH LEGAL ISSUES

a. Fraud

Fraud prevention starts at the top and includes a Board of Trustees and Administration that creates a culture of accountability, honesty and transparency. The next layer of fraud prevention involves the implementation of systems and controls that prevent and detect fraudulent conduct. The internal auditor’s role comes into play in evaluating the effectiveness of those systems and controls. Associating the role of detecting fraud with the internal auditor is nothing new, but the scope has broadened considerably. Increasingly, the internal audit function is not to monitor and detect but also to investigate fraud incidences when they arise. Internal audit participates in fraud prevention by assessing the adequacy of internal controls set in place by district leadership. By merely asking questions, internal audit places the

26 Institute of Internal Auditors, “Practice Advisory 1110-1: Organizational Independence” (Jan 5, 2001).

7

organizational community on notice that it is on the lookout for possible fraudulent conduct. Internal audit reports to the audit committee and management on the functioning of internal controls in relation to fraud risk, thus facilitating adherence to financial reporting and corporate governance responsibilities. Once this assessment has taken place and internal audit produces and Audit Report, the Board in its oversight function must evaluate the risk and potential significance of the fraud reported, determine whether action taken will address the deficiencies in the operation of controls and whether additional external investigation or intervention of legal counsel is necessary.

b. First Amendment Issues In theory, fraud detection is the responsibility of every stakeholder in the school district. Practically, however, a public employee’s fear of retaliation remains a significant obstacle in securing a full accounting of an organization’s frequency of misconduct.27 Recent First Amendment cases that have arisen in the public employment setting are still reeling from the 2006 United States Supreme Court decision in Garcetti v. Ceballos.28 In Garcetti, the United States Supreme Court held that that when a public employee speaks pursuant to her official duties, she is speaking as a government employee and not as a citizen, and the First Amendment does not protect her speech from employer discipline.29 The chilling effect of Garcetti on whistleblower cases and responding retaliation has been evident,30 as many public employees now feel less secure in their ability to speak out freely against governmental fraud and corruption without facing employer retaliation.31 This should be of particular concern to those charged with keeping their thumb on the ethical pulse of a public entity. Davis v. McKinney32 particularly highlights how the First Amendment restrictions set by Garcetti must inform an internal auditor’s adherence to established protocol. Davis involved a lawsuit against a number of individual defendants and various entities of the University of Texas ("UT") System. Cynthia Davis had been employed by the University of Texas Health Center in Houston, Texas as an Audit Manager, a job that entailed oversight of computer-related audits and issuance of internal audit summaries and reports.

27 Statistics indicate that tips from employees are the best source of fraud detection within an organization. A 2010 survey conducted by the Association of Certified Fraud Examiners, Inc. indicates that anonymous tips account for approximately 40% of detected occupational fraud. The same survey indicates approximately 14% of detected occupational fraud is reported by internal audit staff. 28 Garcetti v. Ceballos, 547 U.S. 410, 126 S. Ct. 1951, 164 L. Ed. 2d 689 (2006); see also Williams v. Dallas Ind. Sch. Dist., 480 F.3d 689, 693 (5th Cir. 2007); Nixon v. City of Houston, 511 F.3d 494 (5th Cir. 2007). 29 Id. at 421. 30 See e.g., Ezuma v. City Univ. of New York 665 F.Supp.2d 70 (E.D. N.Y. 2009)( professor’s report regarding a colleague’s sexual harassment allegations fell within “official duties” as the department chair and not entitled to constitutional protection); Abdur-Rahman v. Walker, 567 F.3d 1278(11th Cir. 2009)(compliance inspectors within a sewerage public works department making internal complaints about improper reporting of sewer overflows to state authorities and possible violation of environmental laws were not protected against retaliation because their job duties included identifying and addressing such overflows). 31 Paul M. Secunda, Garcetti’s Impact on the First Amendment Speech Rights of Federal Employees, 7 First Amend. L. Rev. 117, 118-19 (2008-09). 32 Davis v. McKinney 518 F.3d 304 (5th Cir. 2008).

8

After applying for a promotion, for which she was told she was the most qualified, Davis conducted an audit and identified a number of staff computers that she believed were intentionally used to access pornography.33 Davis asked to be removed from the investigation for several reasons. First, she felt "the requirement that she review repugnant pornographic material denigrated her as a woman."34 More relevant to the topic at hand, she also felt that she was being harassed by several employees, including high ranking administrators, who wanted to thwart her investigation. Davis wrote an internal complaint letter to the President of the Health Center, and copied the UT Systems Chancellor regarding the "unethical and allegedly illegal" activity within the targeted department.”35 Davis' letter indicated that, having lost confidence in the UT System to investigate itself, she had contacted not only the FBI concerning the alleged pornography but also the EEOC about other discriminatory practices unrelated to the audit.36 She did not receive the promotion for which she had applied and claimed constructive discharge and alleged that her employer violated her First Amendment free speech rights by retaliating against her for speaking out on matters of public concern.37 Relying on Garcetti, the Fifth Circuit concluded that the complaints about the university’s inadequate response to the Davis’ pornography investigation for the Internal Audit Department directed at the president of the university and to her immediate supervisor were part of her job and therefore not protected speech under the First Amendment. In this regard, the Davis court pointed to an emerging principle that, “[c]ases from other circuits are consistent in holding that when a public employee raises complaints or concerns up the chain of command at his workplace about his job duties, that speech is undertaken in the course of performing his job.”38 This reasoning raises concerns for both the potential whistleblower and the internal auditor employed by the district. While a school district may establish an ethical culture through statements against retaliation, the promotion of fraud hotlines, ethics trainings, etc. the risk to the public employee remains. The message to the internal auditor post-Garcetti in particular, is that misconduct should be reported only through the established protocol. An internal auditor dissatisfied with the response from such a report assumes the risk of job loss should she decide to take the information elsewhere within the organization.

c. Whistleblower Act The Texas Whistleblower Act (“TWA”)39 protects public employees who make good faith reports of violations of law by their employer to an appropriate law enforcement authority. An employer may not suspend or terminate the employment of, or take other adverse personnel

33 Id. at 307 34 Id. at 308 35 Id. at 309 36 Id. 37 Id. at 310 38 Id. at 212 39 Tex. Gov’t Code §§ 554.001-554.010

9

action against, a public employee who makes a report under the Act.40 The TWA warrants discussion in defining the role of the internal auditor for at least two reasons. First, to give rise to a claim under the Act, the conduct in question must at least allegedly be in violation of an existing law.41 Furthermore, the law allegedly violated must be a state or federal statute, an ordinance, or a rule adopted under a statute or ordinance.42 Because there is sometimes a grey area between conduct that is unethical and conduct that is actually illegal many complaints and grievances, including alleged violations of an agency's internal procedures and policies – those things an internal auditor is responsible for investigating –will not support a claim.43 Second, the internal auditor can be implicated by the TWA in an interesting way. An “appropriate law-enforcement authority” to whom a report may be made under the TWA, is an authority capable of more than internally disciplining the culpable employees or forwarding information to another entity to prosecute; the governmental entity must be capable of regulating, enforcing, investigating, or prosecuting alleged violations.44 In early 2012, the Fifth District Court of Appeals of Texas decided Mullins v Dallas Independent School District,45 in which a public employee alleged that he was terminated in violation of the TWA when he made a report to the Office of Professional Responsibility (“OPR”) regarding alleged criminal conduct by other district employees.46 Mullins argued that his report to the OPR constituted a report to an appropriate law enforcement authority.47 While the court disagreed, it pointed out that such a report is subject to a “good faith” standard. If a whistleblower in good faith – reasonable in light of an employee’s training and experience – believes that a point of contact is an appropriate authority who can act on the information provided, such a report may be sufficient to trigger the protection of the TWA.48

D. CONCLUSION

The internal auditor often is the best gauge of a district’s ethical climate and the effectiveness of its operations. While not the only point position charged with maintaining compliance, in many ways an internal auditor serves as an organization’s safety net for compliance with rules, regulations, and overall best practices. An internal auditor’s ability to succeed, however, is completely dependent upon the structure of reporting within the district. It is critical that District Audit Charters are drafted with this and best practices in mind.

40 Id. at § 554.002 (a) 41 See Llanes v. Corpus Christi Indep. Sch. Dist., 64 S.W.3d 638, 642 (Tex.App.-Corpus Christi 2001, pet. denied). 42 See Tex. Gov't Code Ann. § 554.001(1) 43Llanes at 642. 44 Tex Government Code § 554.002(b). 45 Mullins v. Dallas Indep. Sch. Dist, 357 S.W. 3d 182 (Tex.App.-Dallas 2012). 46 Id. at 186. 47 Id. at 189. 48 Id.

10

E. RECOMMENDATIONS FOR BEST PRACTICES

The IIA provides a wealth of information for internal auditing best practices and policies. In addition to what can be found at www.theiia.org, we recommend that districts consider implementing the following audit policies.

Evaluation of Auditor – To maintain Auditor Independence and Objectivity consider

placing the full responsibility for the evaluation of the Internal Auditor with the Board of Trustees. See Appendix A as an example of a performance evaluation form for use by the Board of Trustees in its yearly evaluation of the internal auditor.

Direct Reports to Board of Trustees Meetings – An internal auditor should report to the Board of Trustees without interference from the Administration. The Auditor should report on a monthly basis to the Board of Trustees in closed session. The Texas Attorney General has stated that the “Open Meetings Act gives only the members of a governmental body the right to attend an executive session and gives a governmental body discretion with respect to what other persons may attend an executive session.”49 When the Internal Auditor enters the closed session room, the Superintendent should step out. See Appendix B for a sample agenda from a recent school board meeting in the United Independent School District.

Tasking the Internal Auditor by Individual Board Members – No one board member should be tasking the internal auditor without knowledge and sanction of the full School Board. If an internal auditor is asked by an individual board member to conduct an audit that is not within the Audit Charter, the requested audit should be placed as an amendment to the Audit Charter and approved by the full school board.

Tasking the Internal Auditor by the Superintendent – The Superintendent does have the authority to task the auditor. However, all findings are reported to the Board of Trustees. Management should always be given an opportunity to respond to the Audit prior to a final Audit Report.

49 Tex Att’y Gen. Op. Nos. JM-1004 (1989); JM-6 (1983) and JC-0375 (2001).

11

APPENDIX A INTERNAL AUDITOR PERFORMANCE EVALUATION FORM

12

Internal Auditor

Major Responsibilities and Duties: Evaluator's Rating 1. Prepare a flexible annual audit plan using an appropriate risk based

methodology. 2. Implement the annual audit plan, including, as appropriate, any special tasks or

projects approved by Board, which can be either requested by management or Board.

3. Issue written reports of audits/activities reviewed summarizing the observations

and recommendations. 4. Assist independent auditors during the course of the annual financial audit. 5. Investigate significant suspected fraudulent activities within the district and

notify the superintendent and board of trustees of the results. 6. Select, train and supervise the internal audit staff. 7. Evaluate the expertise of the internal audit staff and efficiently use the

departmental training/travel budget improve audit proficiency. 8. Prepare and administer the department budget. 9. Provide training for board and/or district personnel to promote understanding of

financial information, effective and efficient use of assets and resources. Adherence to policies, laws and regulations and application of internal control to District operations.

10. Properly manage the department to fulfill its responsibilities as stated in the

internal audit department charter, efficiently and effectively utilize resources, and ensure that all work conforms to the standards for the Professional Practice of Internal Audit.

11. Perform audits in accordance with Standard for the Professional Practice of

Internal Audit. 12. Demonstrate behavior that is professional, ethical, and responsible.

13

13. Perform other duties as assignee. 14. Communication with Board of Trustees. Summative Conference Comments:

Recommendation of Evaluator (board member):

□ Renewal and/or extension of Contract

□ Non-Renewal of Contract

□ Termination of Contract

□ Non-Extension of Contract I have read and received a copy of this evaluation. I have reviewed this instrument. Internal Auditor’s Signature Date Board President’s Signature Date

14

APPENDIX B

BOARD OF TRUSTEES AGENDA SHOWING INTERNAL AUDITOR REPORT IN CLOSED SESSION

15

Agenda of Regular Meeting The Board of Trustees United ISD

A Regular meeting of the Board of Trustees of United ISD will be held Wednesday, January 16, 2013, beginning at 6:15 PM in the United ISD - Student Activity Complex, Fine Arts Building, 5208 Santa Claudia Lane, Laredo TX 78043. The subjects to be discussed or considered or upon which any formal action may be taken are as listed below. Items do not have to be taken in the order shown on this meeting notice. Unless removed from the consent agenda, items identified within the consent agenda will be acted on at one time.

I. Pledge of Allegiance

A. Honor the Texas Flag; I pledge allegiance to thee, Texas, one state under God, one and indivisible.

II. Announcement by the Board President calling this meeting of the United Independent

School District to order. Let the record show that a quorum of Board Members is present, that this meeting has been duly called, and that notice of this meeting has been posted in accordance with the Texas Open Meetings Act, Texas Government Code Chapter 551.

III. Public Comments: Comments are limited to three minutes per speaker. The Board Parliamentarian will be the timekeeper and will inform the speaker when they have one (1) remaining minute. No more than three (3) persons will be allowed to speak on any side of an issue. Should there be more than three (3) people who wish to speak on a particular issue they need to select not more than three (3) representatives to speak for them. Comments must address items listed on the agenda. The presiding officer or designee shall determine whether a person who wishes to address the Board has attempted to solve a matter administratively. If not, the person shall be directed to the appropriate policy, as noted in BED (LOCAL), to seek resolution before bringing the matter to the Board at a subsequent meeting. Pursuant to 551.042 of the Texas Government Code, no Board Member or Administrator may respond to a member of the public, unless such response is a recitation of District policy or a statement of specific factual information. When a speaker comes to the podium,

16

please indicate what agenda item you will be addressing. Furthermore, please refrain from mentioning any employee's name and any complaint about any employee’s duties or responsibilities should be channeled through the appropriate grievance policy.

IV. Recognitions

A. United South High School - TAFE Regional Competition V. Consent Agenda Items

A. Approval of Monthly Disbursements B. Approval of Awarding Bids, Proposals and Qualifications C. Approval of Application for Expedited and General State Waivers for the 2012-

2014 School Year D. Approval of Application for Missed Instructional Days Waiver for the 2012-2013

School Year E. Approval of Innovative Courses for the Oil and Gas Academy F. Second Reading of Policy CV (LOCAL) - Facilities Construction G. Second Reading of (LOCAL) Policies in TASB Update 95

VI. Items for Individual Consideration

A. Board Minutes for the Month of November 2012

B. Donations

C. Approval of Request from Board Members in re: Use of Board of Trustees Discretionary Funds for Various Projects/Campuses

D. Approval of Resolution of the Board to Suspend Portions of EIA (LOCAL), for the 2012-2013 School Year Only

17

E. First Reading of Policy CH (LOCAL): Purchasing and Acquisition

F. First Reading of Policy EHDC (LOCAL): Alternative Methods for Earning Credit - Credit by Examination without Prior Instruction

VII. Closed Session: Board will adjourn into closed session pursuant to the following

sections of the Texas Open Meetings Act

A. 551.071 Consultation with Board's Attorney 551.074 Discussion of Personnel or to Hear Complaints against Personnel

1. Consider Appointment of Director of Fixed Assets 2. Discussion, including consultation with legal counsel, to propose the continuing

contract termination of Javier Reyes.

B. 551.074 Discussion of Personnel or to Hear Complaints against Personnel 551.076 Considering the deployment, specific occasions for, or implementation

of, security personnel or devices

1. Kazen Elementary School Student Activity Fund Audit 2. Zaffirini Elementary School Student Activity Fund Audit 3. Ruiz Elementary School Student Activity Fund Audit

4. Nye Elementary School Student Activity Fund Audit

5. Trautmann Middle School Student Activity Fund Audit

6. UHS 9th Grade Student Activity Fund Audit

7. Status of on-going Audits

VIII. Reconvened from Closed Session, the Board will take appropriate action on items, if

necessary, as discussed in Closed Session.

18

A. Appointment of Director of Fixed Assets

B. Action re: propose continuing contract termination of Javier Reyes and authorize Superintendent to send notice of same.

IX. Adjournment

19

If during the course of the meeting covered by this Notice, the Board of Trustees should determine that a closed or executive meeting or session of the Board of Trustees is required, then such closed meeting or session as authorized by the Texas Open Meetings Act, Texas Government Section 551.001 et seq., will be held by the School Board at the date, hour, and place given in this Notice or as soon after the commencement of the meeting covered by this Notice as the School Board may conveniently meet, in such closed or executive meeting or session concerning any and all purposes permitted by the Act, including, but not limited to the following sections and purposes:

Texas Government Code Section:

551.071 Private consultation with the board's attorney 551.072 Discussing purchase, exchange, lease, or value of real property 551.073 Discussing negotiated contracts for prospective gifts or donations 551.074 Discussing personnel or to hear complaints against personnel 551.076 Considering the deployment, specific occasions for, or implementation of security personnel

or devices 551.082 Considering discipline of a public school child, or complaint or charge against school student 551.0821 Discussing matter that reveals personally identifiable information about public school student

551.083 Considering the standards, guidelines, terms or conditions the board will follow, or will instruct its representatives to follow, in consultation with representatives of employee groups

551.084 Excluding witnesses from a hearing.

Should any final action, final decision, or final vote be required in the opinion of the School Board with regard to any matter considered in such closed or executive meeting or session, then the final action, final decision, or final vote shall be either:

(a) in the open meeting covered by the Notice upon the reconvening of the public meeting; or (b) at a subsequent public meeting of the School Board upon notice thereof- as the School Board shall determine.

The notice for this meeting was posted in compliance with the Texas Open Meeting Act on , at . United Independent School District Roberto J. Santos, Superintendent

from process police to guardian of public …...international professional practice framework...

Documents