Summary

The system of quality control related to the Office of Chief Inspector General and the internal audit function of the Florida Department of Education, Division of Universities, Board of Regents, was generally adequate to reasonably ensure compliance with applicable professional auditing standards, Office of Chief Inspector General policies and procedures, and specific provisions of Section 20.055, Florida Statutes, which relate to the operation of State agencies’ offices of inspectors general and internal audit functions for the period January 1, 1998, through December 31, 1998.

Matters not material to overall compliance with professional auditing standards and specific provisions of Section 20.055, Florida Statutes, are discussed below:

• Our review of the supporting working papers related to two internal audit reports issued during our review period by the University of North Florida, Office of Inspector General, disclosed that, contrary to requirements of the Standards for the Professional Practice of Internal Auditing, supervisory review of the internal audit reports and working papers was not documented. (See paragraphs 14 through 19.)

• Although the electronic data processing systems utilized by Florida’s State Universities provide data that is relied on by management for decision making, control, and compliance with external requirements, the internal audit positions established in the University Offices of Inspectors General generally do not require electronic data processing experience and the internal audit staff in the University Offices of Inspectors General generally do not have training and experience in electronic data processing. Standards for the Professional Practice of Internal Auditing call for internal auditors to examine information systems to ascertain their accuracy, reliability, timeliness, usefulness, etc. Training and experience in electronic data processing would serve internal auditors well in meeting those professional requirements. (See paragraphs 20 through 23.)

• Contrary to Section 20.055(5)(b), Florida Statutes, and related policies and procedures established by the State University System (SUS) Office of Inspector General Operations Manual to protect information that has been made exempt from public inspection, some audit working papers reviewed included personally identifiable records of university students (social security numbers) that were not clearly identified to allow removal of such information prior to public inspection of the working papers. Section 228.093(3)(d), Florida Statutes, mandates that personally identifiable records or reports of a student, and any personal information contained therein, are confidential and exempt from the provisions of Florida’s public records law, Section 119.07(1), Florida Statutes. (See paragraphs 25 through 29.)

• Contrary to Section 20.055(5)(d), Florida Statutes, and contrary to related policies and procedures established by the SUS Office of Inspector General Operations Manual, internal audit working papers supporting several of 18 audits selected for review did not contain documentation sufficient to determine compliance with the requirement that auditees respond to preliminary internal audit findings within 20 working days after the receipt of the tentative findings. (See paragraphs 30 through 34.)

The Chancellor's written response to the findings and recommendations included in this report is shown as Exhibit F.