Audit Committee Thursday, September 27, 2018 Room 340-D

Transcription

1 Audit Committee Thursday, September 27, 2018 Room 340-D Hamilton-Wentworth District School Board 20 Education Court, P.O. Box 2558 Hamilton, ON L8N 3L1 AGENDA: 3:00 1. Call to Order S. Zucker 2. Approval of the Agenda S. Zucker 3. Review of May 31, 2018 Audit Committee Report to Board S. Zucker 4. Declaration of Conflicts of Interest Signoff on form S. Zucker 5. Action Items a) Motion: Election of Chair S. Zucker b) Motion: Annual Report to the Board of Trustees Chair c) Motion: Annual Report to the Board of Trustees and forwarded to the Ministry for the year ended August 31, 2018 Chair 6. Monitoring Items a) Annual Review of Audit Committee Terms of Reference Chair b) Review of Audit Committee Work Plan Chair 7. Update on School Board Sector Issues S. Zucker 8. Update from Regional Internal Audit Team J. Baker 9. Resolution into Private Session as per the Education Act, Section Chair a) the security of the property of the board. b) the disclosure of intimate, personal or financial information in respect of a member of the board or committee, an employee or prospective employee of the board or a pupil or his or her parent or guardian. 10. Meeting resumes in Public Session 11. Any Other Business Chair 12. Adjournment Chair

2 COMMITTEE REPORT Presented to: Board Date of Meeting: June 18, 2018 From: Audit Committee Date of Meeting: May 31, 2018 The committee held a meeting from 3:07 p.m. to 4:35 p.m. on May 31, 2018 at 20 Education Court, Hamilton, ON, in Meeting Room 340D with Trustee Beattie presiding. Members present were: Trustees Jeff Beattie and Todd White. External member present was: John Laretta (electronically). Regrets were received from Trustee Greg Van Geffen and Carol Calvazara. ************************************** MONITORING ITEMS: C. Update on RIAT Activities Jenny Baker, Regional Internal Audit Manager, presented the report and updated the committee on current audits in progress Health and Safety Audit and provided the Annual Independence Assertion in compliance with S1110 of the International Standards for the Professional Practice of Internal Auditing. Respectfully submitted, Jeff Beattie, Chair of the Committee

3 Declaration to the Chair of the Audit Committee of the Hamilton-Wentworth District School Board by a Member of the Audit Committee as to Whether or Not the Member has a Conflict of Interest 1.) This Declaration applies to: (check one) a) the Committee meetings of the Audit Committee for the fiscal year ; b) any changes subsequent to the fiscal year declaration. 2.) I, declare that I do not have a conflict of interest as (name of member) defined by Subsection 4(2) of O. Reg 361/10, Education Act, RSO 1990 C.E-2. (strike out if inapplicable) 3.) I, declare that I have a conflict of interest as defined (name of member) by Subsection 4(2) of O. Reg 361/10, Education Act, RSO 1990 C.E-2 because one or more of my: parent(s), child(ren)or spouse is/are employed by the Board at this time. (strike out if inapplicable) Dated at City, Ontario this day of, Audit Committee Member Note: Subsection 4(2) O. Reg 361/10, Education Act, RSO 1990 C.E-2 states: 4(2) For the purposes of clause (1)(c), a person has a conflict of interest if his or her parent, child or spouse is employed by the board. Written declarations must be submitted to the Chair of the committee at the first meeting of the committee in each fiscal year as per Subsection 14(1) O. Reg 361/10.

4 Annual Report to the Board of Trustees For the year ended August 31, 2018 This report summarizes the audit committee s actions for the year ending August 31, Audit Committee Members The audit committee consisted of 5 members listed below: - Greg Van Geffen - Chair - Jeff Beattie and Todd White Trustee representatives - Carol Calzavara, Jean Byrnes (resigned March 2018), John Laretta (joined May 2018) In addition, regular attendees at the Committee meetings were: - Jenny Baker Regional Internal Audit Manager - Manny Figueiredo Director of Education - Stacey Zucker Associate Director, Support Services - Denise Dawson Senior Manager, Business Services - David Marks Partner, Audit, KPMG LLP - Paul Ciapanna Senior Manager, Audit, KPMG LLP Administrative Tasks At the beginning of the year and in accordance with recommended good practice various administrative tasks were completed. These included: - Annual review of the Audit Committee s Terms of Reference; - Developing a work plan; - Developing a meeting schedule and agenda for the year; and - Signing off on the Declaration of Conflicts of Interest form Meetings It was agreed to hold three meetings throughout the year with a fourth meeting, from December to May, if necessary. All meetings have been held as planned. The members in attendance at each meeting were as follows:

5 Member s Name Sept 29, 2017 Nov 9, 2017 March 8, 2018 May 31, 2018 Jeff Beattie Jean Byrnes Carol Calvazara John Laretta Greg Van Geffen Todd White N/A N/A N/A N/A Governance The audit committee operated throughout the fiscal year ending August 31, All of the members satisfied the eligibility requirements in accordance with Ontario Regulation 361/10. External Auditors The relationship with the external auditors has been satisfactory and private meetings were held during the year. The external auditors KPMG presented the scope and extent of their work to the committee, which the committee reviewed and recommended for approval at the September 28, 2017 meeting. The external auditors confirmed their independence in the letter dated November 20, The audit committee reviewed and recommended the approval of the annual audited financial statements on November 9, The audit committee recommended the reappointment of the external auditors for the next fiscal year during the meeting held March 8, Internal Auditors The relationship with the internal auditors has been satisfactory and private meetings were held during the year. The Committee reviewed the results of the risk assessment, as well as the annual audit plan for the 2017/18 fiscal year. The following changes were made to the originally submitted internal audit plans: - Annual plan ( amended to include a Health and Safety Audit.) - Multi-year plan (Back-Up and Disaster Plan Audit was moved to ) The internal auditors performed the following work during the year: PLANNED AUDITS: - Accommodation Review Committee (ARC) Audit Follow Up (completed) - Information Technology (IT) Security and Vulnerability Assessment (completed) - School Generated Funds Audit Follow Up (completed)

6 - Repairs and Maintenance Audit Follow Up (completed) For all completed audits, the following is a summary of risks and findings made by the internal auditor: Audit Risks Findings Accommodation Review Committee (ARC) Audit Follow Up Information Technology (IT) Security and Vulnerability Assessment School Generated Funds Audit Follow Up A control rating of satisfactory with some improvement required was assigned to the original audit. A control rating of unsatisfactory has been assigned. A control rating of Satisfactory has been assigned. Based on follow-up work conducted, Five of the original action plans have been implemented and the issues are closed. Twenty-six control deficiencies were identified and twenty-eight recommendations were identified that if implemented will mitigate the risk that IT vulnerabilities are exploited. Additional follow up procedures were completed during February 2018 to confirm that action plans to address the remaining five findings have been implemented. Four of the five schools selected have implemented the plan. One recommendation was added. The other items are closed.

7 Audit Risks Findings Repairs and Maintenance Audit Follow Up An initial control rating of satisfactory with some improvement required was assigned to the original audit. Two items remain open of the original eleven findings with eleven recommendations. The audit committee endorsed each report, including management s action plan, and advised the board of trustees to accept it. Presentation of all audit reports were discussed in-camera. The audit committee received reports from internal audit that assessed the progress toward management s implementation of action plans developed in response to previous audit findings. This enabled the audit committee to engage management in a discussion regarding findings not satisfactorily actioned, as well as encouraging renewed efforts on overdue action plans. (Insert name of third party audits or reviews) Audit / Review (if applicable) (describe the date, the extent and the results of any audits or reviews performed by outside parties) Summary of the work performed In addition to the items noted above, the following outlines further work performed by the audit committee in the last 12 months: - Received a report from the internal auditors on their review of the effectiveness of controls across the school board; - Confirmed that the external and internal auditors did not encounter any difficulties in the course of their work; - Undertook a review of the external auditors performance; - Obtained confirmation from the Director of Education that the school board was compliant with all current federal and provincial Acts, Regulations and Statutes. - Undertook an evaluation of the effectiveness of the internal audit function, including the performance of the regional internal audit manager and his / her team; - Queried management on their approach to risk management as well as their strategy to manage such risks; and - Performed a self-assessment. By the signature noted below, we attest that we have discharged our duties and responsibilities under Ontario Regulation 361/10.

8 On behalf of the audit committee Audit Committee Chair

9 Annual Report to the Board of Trustees and Forwarded To the Ministry of Education For the year ended August 31, 2018 District School Board Name: Hamilton-Wentworth District School Board Fiscal Year: 2017/18 Re: Annual audit committee report to the Ministry of Education as per Ontario Regulation 361/10 During the 2017/18 fiscal year, the following internal audits or other engagements were started by the regional internal audit team but not completed by August 31st: - Health and Safety Audit - Complete pending presentation to Audit Committee In addition to those listed above, the following audits were completed in the 2017/18 fiscal year: AND - Accommodation Review Committee (ARC) Audit Follow Up - Information Technology (IT) Security and Vulnerability Assessment - School Generated Funds Audit Follow Up - Repairs and Maintenance Audit Follow Up Based on the internal audit plan, we are not expecting any enrolment audits to be performed. Audit Committee Chair Date Signature Title

10

11

12

13 AUDIT COMMITTEE WORK PLAN September 27, 2018 November 15, 2018 March 21, 2019 May 16, 2019 Open Declaration of Conflicts of Interest Signoff on form Election of Chair Annual Report to the Board of Trustees and Ministry on Annual Review of Audit Committee Terms of Reference Review Audit Committee Annual Work Plan Review Regional Internal Audit Mandate Regional Internal Audit Team Update and Annual independence certification Review of compliance report (prior fiscal year) Regional Internal Audit Team Update Regional Internal Audit Team Update Regional Internal Audit Team Update The following items are extracted from the Audit Committee Regulation regarding timelines: Ontario Regulation 361/ (1) An Audit Committee of a board shall meet at least three times in a fiscal year at the call of the chair of the committee, and at such times as the chair considers advisable. 11. (2) The first meeting of the Audit Committee in each fiscal year after the 2011 year shall take place no later than September (1) At the first meeting of the Audit Committee in each fiscal year, the members of the committee shall elect the chair of the committee for the fiscal year of the board from among the board members appointed to the committee. 14. (1) Every member of an audit committee shall, when he or she is appointed to the committee for the first time and at the first meeting of the committee in each fiscal year, submit a written declaration to the chair of the committee declaring whether he or she has a conflict of interest as described in subsection 4. Applicable Only Following Trustee Election 2. (3) A board established after the day this Regulation comes into force shall establish an audit committee in accordance with this Regulation no later than October 1 of the school year following the calendar year in which the board s members are first elected. 2. (4) The first meeting of an audit committee established under subsection (3) shall be held no later than December 1 of the school year following the calendar year in which the board s members are first elected. 20/09/2018

14 MEMO TO: Hamilton-Wentworth District School Board FROM: Jenny Baker, Regional Internal Audit Manager DATE: 27 September 2018 SUBJECT: Regional Internal Audit Status Report Open Committee Session This memorandum will serve to update the Audit Committee of the Regional Internal Audit Team s (RIAT) work since May 31, A. Audits Planned or in Progress No audits have been planned or initiated since the date of the last audit committee. B. Other i. Please refer to the attached training plan for and the results of training completed in , which summarizes RIAT compliance to International Standards for the Professional Practice of Internal Auditing standard #1230, Continuing Professional Development. ii. Rob Jelacic, Senior Internal Auditor resigned in June. HWDSB RIAT Report Audit Committee Session - Open

15 RIAT Education and Training Plan Objective: 1. To report on RIAT compliance to International Standards for the Professional Practice of Internal Auditing standard # Continuing Professional Development. 2. To define training plans to develop and maintain staff professional competencies. Completed Auditor Training Focus Date All Auditors John Forte Andrea Eltherington 1. Regional Internal Audit Conference 2. Ontario Association of School Business Officials,(OASBO) Internal Audit Section 3. Relevant seminars/webinars on fraud, ethics, privacy and IT Security offered by the various institutes (*see acronyms below) 4. Canadian Conference on IT Audit, Governance & Security (CPA Ontario & the IIA) Municipal Internal Auditors Association of Ontario, Fall workshop. 1. Presenter revised RIAT audit manual at RIAT conference Municipal Internal Auditors Association of Ontario, Spring workshop November 29-30, meetings throughout the year.) As offered throughout the year March 27-29, 2018 November 8, 2017 November 29-30, 2017 April 23, 2018 Jenny Baker Andrea confirms that she has met the annual continuing education requirements of the IIA. 1. Performing an Effective Quality Assessment -IIA 2. Presenter, Risk Assessments and QA Reviews at RIAT Conference Municipal Internal Auditors Association of Ontario, Spring Workshop Jan-Feb 2018 November 29-30,2017 April 23, 2018 Jenny confirms that she has met the annual continuing education requirements of CPA Ontario, ISACA and the ACFE. Planned Auditor Training Focus Date All Auditors 1. Regional Internal Audit Conference Late November OASBO Internal Audit 4-6 meetings during year 3. Review revised RIAT Audit manual and ensure team practices Throughout the year align with requirements 4. Relevant seminars/webinars on fraud, ethics, privacy and IT Throughout the year Security offered by the various institutes John Forte 1. Progress through CIA requirements Throughout the year Andrea 1. Assign audit projects to contribute to meeting CISA experience Throughout the year Eltherington requirements. Acronyms ACFE Association of Certified Fraud Examiners IIA- Institute of Internal Auditors ISACA Information Systems Audit and Control Association CIA Certified Internal Auditor CPA Chartered Professional Accountant CISA Certified Information Systems Auditor RIAT Status Update Report 2