THE OFFICE OF THE INTERNAL AUDITOR STATUS UPDATE MARCH 11, 2014

Transcription

1 THE OFFICE OF THE INTERNAL AUDITOR STATUS UPDATE MARCH 11, 2014 Since the last Audit Committee meeting, the OIA has focused on finalizing the execution of the 2013 Audit Plan and the development of the 2014 Proposed Audit Strategy and Plan Annual Report Florida statutes require the Chief of Internal Audit to submit an annual report on or before February 15, summarizing the activities of the OIA during the preceding fiscal year. Per statute this report should include, but not be limited to, the following: An evaluation of the effectiveness of Citizens internal controls Recommendations for corrective action, if necessary Summaries of the audits, reviews and investigations conducted by the office This report was delivered to Citizens Board of Governors, the Executive Director, the members of the Financial Services Commission, the President of the Senate and the Speaker of the House of Representatives to comply with Florida statutes and to provide information on how the OIA accomplishes its mission. A copy of the report is included later in the Audit Committee materials Audit Plan Execution OIA follows a risk-based approach in developing and monitoring progress in delivering the audit plan. As we reassess our understanding of the enterprise risks managed within the organization and consider the changing operational challenges, we continually reassess our plan, thereby confirming that it continues to provide the expected assurance and that audit resources remain appropriately focused. Since the previous meeting, OIA assessed the overall plan coverage for 2014 and identified some focus areas for inclusion in the plan. These include a targeted review of the Coordinating Counsel Procurement; an audit of Agency Investigation & Compliance Management; an audit of the 401(a)/457(b) Retirement Contributions; and a forensic audit of the Claims Payment Process Design. Progress Against Plan Audits that were in progress at the previous committee meeting were completed as agreed. The following graph represents progress to date on the 2014 audit plan. Thirty-five full audit, forensic audit & MAS reviews are planned for the year. To date three audits, including one audit carried over from 2013, have been completed and twelve more are in progress. 51% Progress Against Plan as of February 21, % 10% 0% Completed Draft Issued In Progress To Do 1

2 The OIA issued four audit and advisory projects and completed four Investigations since the last Audit Committee meeting: Coordinating Counsel Procurement 401(a)/457(b) Retirement Contributions Executive Expenses Audit work completed in assistance of the External Auditors Summary of Audit Results The following represents a brief summary of the audit work completed and presented to management. Detailed copies of the reports and memorandums have been included in this presentation for your consideration. Coordinating Counsel Procurement (Satisfactory) - The objective of this targeted review was to evaluate the effectiveness and adequacy of the Invitation to Negotiate (ITN ) and procurement processes surrounding this solicitation to ensure the process and controls were followed. Based on our examination of solicitation materials, evaluation criteria, scoring metrics, public audio files of evaluation & negotiation meetings, and other supporting documentation as well as committee member interviews, we found that the procurement process was followed adequately and that the final contract award decision was made objectively. Our work did however identify specific areas requiring additional attention which management has addressed with appropriate implementation measures. These areas include: developing a best practice guide for evaluators when allocating pricing points for professional services; and ensuring active involvement of Certified Contract Negotiators during negotiations and exceeding the statutory standard by assigning Certified Contract Negotiators to serve as solicitation officers for each ITN regardless of value. 401(a)/457(b) Retirement Contributions (Satisfactory) - During December Citizens was notified that the retirement contribution, calculated in the November 27 payroll, was not deposited timely. The objective of this audit was to evaluate the adequacy and effectiveness of payroll retirement calculation and contribution process as well as to determine whether the payroll contribution delay in question violated any laws and/or regulations. Based on the information obtained from interviews, review of the law governing retirement accounts, as well as independent research studies, we believe that the current process for funding retirement accounts is appropriate and within regulatory expectations. As it relates to this one funding delay occurrence, we believe that management acted appropriately by making a positive adjustment to all retirement accounts in order to compensate for the opportunity cost of not depositing funds timely. In addition, management has indicated that they will implement certain measures in order to mitigate the risk of future untimely retirement deposits. Executive Expenses (Satisfactory) - The objective of this audit was to evaluate the effectiveness and adequacy of key business processes and control functions for executive expenses and other selected administrative expense categories and to ensure compliance with the company s expense policy. Based on our examination of invoices, expense reports and other supporting documentation, we found that executive expenses were properly documented, approved and within expense policy guidelines and that all travel was properly authorized. In addition, the processes related to the review of executive expenses were generally designed to include appropriate controls. Recommendations were made to enhance the direct bill invoice reconciliation process and to provide minor clarifications to the Business Travel Policy. Management has agreed to implement appropriate measures to address these issues. 2

3 Audit work completed in assistance of the External Auditors - OIA completed audit testing focused primarily on assessing the adequacy and effectiveness of key controls related to underwriting premium payments and cash disbursement processes. This work was completed under supervision of Johnson Lambert LLP in support their 2013 financial statement attestation. The areas selected and scope of work completed were delegated and/or agreed upon by Johnson Lambert and OIA and were provided as a client assistance request. Results from our work did not identify any exceptions and OIA provided the testing work papers and results to Johnson Lambert. Investigation Completed Four investigations were completed during the period. In three of the four instances, the concerns raised, which led to the investigation, were unfounded. Minor process improvements resulting from the work completed were reported to management and are being addressed. In respect of the fourth investigation, OIA investigated an allegation of an external party, which is misrepresenting an affiliation with Citizens through the use of a website that appears to present an association or business relationship with Citizens. Following the investigation Citizens Legal team presented a Cease and Desist Letter to the external party after which links to Citizens were removed from the website. Work In Process OIA has twelve Audit/MAS projects in progress: Core Suite Project Commercial Claims Audit Clearing House IT Security Access Claims Quality Assurance Agency Investigation Management & Compliance Claims Legal Billing (Forensic) Claims Payment Process Design (Forensic) Citizens Data Warehouse Social Media Premium Refunds Debt Contract Compliance Staffing, Development and Training The department remains fully staffed with all positions filled. We recently appointed Gary Sharrock as Senior Internal Auditor (IT). Gary replaces Eddie Taliaferro who left Citizens at the end of January Gary brings twenty-two years of IT experience and over eight years of IT auditing, assurance and consulting background to the company. In his career, Gary held senior IT management roles in three large organizations, including a position as Chief Information Officer. His technical skills provided a solid foundation for his past positions in IT auditing and IS Assurance where he managed and performed risk assessments, integrated audits, complex IT audits and SOX compliance reviews as well as other special technical projects. Gary has a B.S. in Accounting from Wright State University and is a Certified Information Systems Auditor (CISA); Certified in the Governance of Enterprise IT (CGEIT); and Certified in Risk and Information Systems Control (CRISC). OIA is dedicated to the professional development of its staff to ensure continuous growth of knowledge, skills and other competencies throughout the year. For this purpose, each audit staff member developed an Individual Development Plan (IDP) which provides focused guidance towards personal growth through targeted training. Progress in the achievement of specified training needs is periodically reviewed and encouraged. OIA Administration OIA is continuously refining its audit processes and procedures (standards) in order to ensure that its work product aligns to acceptable audit practice and it remains a credible and 3

4 sustainable internal audit function for Citizens. These standards are used to deliver audit engagements efficiently, effectively and in accordance with professional standards. Our engagement standards align with The Institute of Internal Auditors (The IIA s) International Professional Practices Framework (IPPF). Annual Charter Update and Review CPIC Audit Committee Charter The primary function of the Citizens Property Insurance Corporation (Citizens) Audit Committee (Committee) is to assist the Board of Governors (Board) in fulfilling its oversight responsibilities for the financial reporting process, system of internal controls and risk management, Citizens compliance with legal and regulatory requirements, the qualifications, independence, and performance of the external auditors and internal audit function. The Audit Committee Charter is the formal written document that defines the authority and responsibility of the Committee as delegated by the Board. The Audit Committee Charter was originally approved during the March 13, 2008 Board of Governors meeting with subsequent approvals annually thereafter. This year s review of the Charter did not reveal any specific need for revision. If there are no changes from the Committee, it is recommended that the Committee approves the charter in its current form. CPIC OIA Charter The Office of the Internal Auditor departmental Charter is the formal written document that defines the OIA purpose, authority and responsibility. The charter establishes the OIA position within the organization, authorizes access to records, personnel and physical property relevant to the performance of engagements, and further defines the scope of the OIA activities. The Audit Committee last reviewed and amended the charter in March The suggested changes for 2014 annual approval pertains to changes in the Citizens enabling statute, under Section (6)(i) (Florida Statutes), following changes in the statute necessary for the establishing of an Inspector General role within Citizens. These changes are highlighted in red in the attached Charter. If there are no further changes from the Committee, we recommend that the Committee approve the charter in its current form. Control Deficiency Resolution As of February 21, 2014, there are nineteen remaining open items. Of the remaining issues, there is one high rated item which relates to the need to define and establish formalized privacy governance across the organization A corporate information privacy policy was developed and will, together with the recently refined information security and the information classification and handling policy, be presented to the executive leadership team for approval. We expect all issues will be fully remediated. Open Items by Risk Rating as of 2/21/ /30/13 10/31/13 12/31/13 2/21/14 Low Medium High 4

5 Audit Dashboard The Office of the Internal Auditor 2/21/2014 Audit dashboard reporting statistics are included in the Audit Committee materials for review. The productive hours reported are in line with projections and the OIA productivity percentage of 77% is above the targeted range of 70-75%. Recommendations 1. Chief of Internal Audit recommends that the Audit Committee approve the updated Audit Committee Charter and recommends ratification by the Board of Governors at the next scheduled meeting on March 12, Chief of Internal Audit further recommends that the Audit Committee approve the Office of the Internal Auditor Charter. 5