Policy Compliance Internal Auditing will be conducted in a manner consistent with the Standards for Professional Practice of Internal Auditing issued by the Institute of Internal Auditors.
Specific standards to be followed include:
- The Business Systems and Control Group must be independent of the activities they review and audit and must maintain an independent outlook.
- Reporting must be timely, honest and objective.
- Reviews must be performed with proficiency and due professional care.
- Evidence supporting audit/review observations must be sufficient, reliable, competent and appropriate to the review topic.
- The Group will maintain a quality assurance program to review the Business Systems and Control operations to ensure that the work complies with this charter and solicit an external quality review at least once every three (3) years unless limited resources or other unforeseen factors justify a different interval. The review will determine compliance with the standards incorporated into this charter and shall be conducted by qualified, objective persons who are independent of the HRM's functions and activities.
Reporting Structure
Effective March 2, 2006, the function of Business Systems and Control has been realigned directly under the Chief Administrative Officer with a direct reporting line to the Audit Committee of Council.
As part of the annual business planning process, the annual work plan will be reviewed and approved by the Chief Administrative Officer and reflected in the annual business plan for the Business Unit.
For the purposes of administration of the day-to-day function, the Business Systems and Control Group will report to the Director of Finance (changed effective March 2, 2006). Specifically, in the area of work plans, business plan and budget, achievement of goals and objectives and human resources and personal performance.
For the purposes of reporting on findings and recommendations, the Group will report to the respective Business Unit Director and the Chief Administrative Officer through to the Audit Committee.
Authority
To the extent permitted by law, the Business Systems and Control Group shall have access to all activities, properties, personnel, and records which are relevant to an area under study or review.
Independence
- Business Advisory
Independence in where and how facts are gathered regarding a specific business study and the ability to make unabridged and appropriate recommendations is integral to the success of this function. In delivering Business Advisory services, we will attempt to provide reasonableness tests to maintain a level of objectivity and independence.
- Policy Compliance
Independence reflects freedom to determine audit or assurance scope and to perform the appropriate scope of work.
The Business Systems and Control Group shall be free from control or undue influence in:
- the selection and application of audit techniques, procedures and programs;
- the interpretation of facts revealed by the examination or in the development of recommendations or opinions;
- the selection of areas, activities, personal relationships and managerial policies to be examined; and
- Selection of legitimate sources of information, records and other materials needed to perform the required services.
Objectivity
Objectivity is an essential element of independence and must exist in both Management Consulting and Internal Auditing.
Staff of Business Systems and Control will only participate in an advisory capacity in the planning, development, implementation and modification of business systems - computerized or manual. In addition, where required, staff will test the reasonableness of assumptions and/or relevant findings for material bias.
Management Responsibilities
Management of HRM accept, as a partner the Business Systems and Control Group, and agree to participate fully in the process of determining areas of opportunity and business risk for the HRM. Management understands that they are the owner of the processes, opportunities and business risks and it is their responsibility to exploit opportunity and control underlying business risks, not the Business Systems and Control Group.