����APP

The mandate of internal audit is to strengthen ����APP’s (the University) ability to create, protect, and sustain value by providing independent, risk-based, and objective assurance and advice. The internal audit function enhances the University’s:

• Successful achievement of its objectives;
• Governance, risk management, and control processes;
• Decision-making and oversight; and
• Reputation and credibility.

Under the Institute of Internal Auditors (IIA) Global Internal Audit Standards (2024), internal auditing involves two types of engagements:

1. Assurance Engagements – an objective examination of evidence to provide an independent assessment of activity within an organization. Assurance activity is aimed at reducing risk and increasing confidence for stakeholders and are a required component of an annual internal audit plan.
2. Advisory Engagements – used to facilitate strong risk management, control processes, and governance, without the internal auditor assuming management responsibility. Advisory engagements, also called consulting, are intended to improve processes rather than evaluate them after the fact. These engagements may or may not result in a formal report.

 

The Audit and Finance Committee establishes and monitors, on behalf of the Board of Regents, the internal audit function of the University. The Director, Internal Audit will report functionally to the President and Vice-Chancellor and to the Chair of the Audit and Finance Committee of the Board of Regents. Administratively, the internal audit function will report to the Vice-President, Finance and Administration.

Internal auditors will have no direct operational responsibility or authority over any of the activities they review. The Director, Internal Audit will ensure that the internal audit function remains free from all conditions that threaten its ability to carry out work in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the Director, Internal Audit determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties.

Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance.

Internal auditors will exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined.  They will make a balanced assessment of all relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments.

Audit has the authority to audit all activities of the University and has full and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out internal audit responsibilities. Internal auditors are accountable for confidentiality and safeguarding records and information.

The Director, Internal Audit will disclose to the President and Vice-Chancellor and Board of Regents any interference encountered related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfill its mandate.

Internal Audit is authorized to obtain assistance from subject matter experts outside the University to complete internal audit services where appropriate and within approved budget allocations.

Internal Audit’s responsibilities include:

• Adhering to the standards of their professional designations and the Standards for the Professional Practice of Internal Auditing, including its Code of Ethics.
• Examination and evaluation of the adequacy and effectiveness of the University’s internal control structure.
• Providing data-driven, consultative insights and advice to support informed decision-making, particularly on risk exposure, control effectiveness, and governance maturity.
• Provision of strategic audit engagements in a thoughtful, collaborative manner to help assess compliance with legislation, regulations, policies and obligations.
• Providing value-added advisory services related to process improvement, policy development, system implementation and change initiatives.
• Partnering with academic and administrative units to improve efficiency, strengthen controls, and adopt best practices.
• Investigating suspected or known violations of policies and procedures, financial irregularities, fraud or misuse of University assets under Memorial’s Protected Disclosure policy and per the Procedure for Reporting and Investigating Fraudulent Activity.

The President and Vice-Chancellor and Audit and Finance Committee of the Board of Regents’ responsibilities include:

• Approving the Internal Audit Charter and the annual Internal Audit Engagement Plan, as outlined in the Audit and Finance Committee Terms of Reference.
• Meeting periodically with the Director, Internal Audit to update and focus discussion related to internal audit and organizational risk.
• Making appropriate inquiries of management and the Director, Internal Audit to obtain assurances over the organization’s internal control framework.
• Demonstrating commitment to appropriately monitor and manage enterprise risk.
• Receiving communications from the Director, Internal Audit on internal audit activities relative to the internal audit engagement plan, and any additional advisory or review work carried out by internal audit including those at the request of the management.
• Helping to ensure that opportunities for improvement arising from internal audit engagements are addressed appropriately.
• Involvement in the recruitment or termination of the Director, Internal Audit.
• Contributing to the performance assessment of the Director, Internal Audit.
• Receiving disclosures by the Director, Internal Audit of actions deemed to substantially restrict or interfere with conduct of investigations or approved internal audit activities.

Vice-Presidents are responsible for:

• Demonstrating a commitment to a control environment where risk is appropriately monitored and managed.
• Enabling conditions for internal audit effectiveness such as collaborating with internal audit on emerging or existing significant risks and areas of potential assurance and advisory services.
• Receiving and reviewing relevant audit reports by the Office of Internal Audit.
• Ensuring opportunities for improvement arising from audit activity are addressed appropriately and in a timely manner, where applicable.

Unit Heads are responsible for:

• Ensuring cooperation is extended to the Office of Internal Audit by providing the Office with full, free and unrestricted access to functions, University records, property, systems, physical assets and personnel during the conduct of the audit.
• Ensuring that information requested by Internal Auditors is provided in a timely manner.
• Developing action plans for implementing audit recommendations or collaborating on alternatives that meet the objectives of the recommendations.
• Working with their personnel to sufficiently implement the agreed upon course of action to sufficiently address recommendations.
• Providing the Office of Internal Audit with details of any completed corrective actions and/or status of the action plan(s).

The Director, Internal Audit has the responsibility to develop a risk-based annual internal activity plan that considers the input of the President and Vice-Chancellor, the Audit and Finance Committee of the Board of Regents and senior management. The plan will be submitted to those parties for discussion, and to the President and Vice-Chancellor and Audit and Finance Committee for approval.

Topics chosen for engagements are based on the University’s strategic objectives, inherent and residual risk of University operational areas, the adequacy of the system of internal control, resources available to Internal Audit and the results of previous audits. The Director, Internal Audit will adjust the plan, as necessary, in response to changes in the University’s operating environment and strategic direction. Any significant deviations from planned activity will be communicated.

The Office of Internal Audit coordinates with Enterprise Risk Management to discuss current and emerging significant risks. Memorial’s Enterprise Risk Management Policy and Framework provide a structured approach for identifying, assessing, and monitoring institutional risks. Internal Audit considers information from the Enterprise Risk Management process when developing its risk-based engagement plan and determining priorities.

In creating the annual activity plan, internal audit will consider relying upon the work of other internal and external providers of assurance and advisory services for the purpose of providing efficient audit coverage.

Internal Audit’s typical deliverable reporting will be as follows:

Per the Procedure for Office of Internal Audit Reports, before finalization, the written draft report is submitted to Unit/Department heads, the respective Vice-President and the President and Vice-Chancellor. Draft reports are also submitted to the Chair of the Audit and Finance Committee before being provided in final to the Board of Regents.

The Director, Internal Audit will report to the President and Vice-Chancellor and Audit and Finance Committee of the Board of Regents:

• Results of assurance and advisory services.
• Status of implementation of prior internal audit recommendations, including any which are no longer applicable or otherwise resolved.
• The annual internal audit plan and performance relative to its plan.
• Internal audit budget and resource requirements.
• Significant revisions to the internal audit plan and budget.
• Potential impairments to independence, including relevant disclosures as applicable.
• Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the Board of Regents that could interfere with the achievement of the University’s strategic objectives.

A written report will be prepared and issued by the Director, Internal Audit following the conclusion of each internal audit engagement and will be distributed as appropriate (see table above). Where appropriate, audit reports will include management's response and corrective action taken or to be taken. Management's response should include a timeline for anticipated completion of action to be taken and an explanation for any corrective action that will not be implemented, where applicable.

The Director, Internal Audit will periodically report to the President and Vice-Chancellor and Audit and Finance Committee of the Board of Regents on Internal Audit’s purpose, authority and responsibility as well as performance relative to the approved annual engagement plan. If applicable, the self- assessment will include plans to address deficiencies and opportunities for improvement.

The Internal Audit department is committed to following the Global Internal Audit Standards of The Institute of Internal Auditors. Internal Audit activity generally conforms with the 2024 Global Internal Audit Standards, with the exception of Standard 12.1, 12.2 and 12.3 relating to the maintenance of a Quality Assurance and Improvement Program. The impact of this non-conformance is that the internal audit reports will be worded as “generally conforms to Global Internal Audit Standards” instead of “in conformance with the Global Internal Audit Standards”.

Apart from this, there will be no impact to the overall quality, execution and reporting of the Internal Audit activities and to the independence and objectivity of the Internal Audit Function.

This Charter shall be reviewed and approved as circumstances require and at least every four years by the President and Vice-Chancellor and the Audit and Finance Committee of the Board of Regents.