PART A: INTRODUCTION
An important component of the work of trustees is effective governance and oversight of school board operations. Audit committees, as established by Ontario Regulation 361/10: Audit Committees, share the burden of this oversight, with a specific focus on financial reporting, controls, and risk management. Audit committees rely on a team of internal and external auditors to provide an opinion on the accuracy and completeness of financial reporting, verify effective controls, and help ensure risk is appropriately managed.
School boards work with both internal and external auditors. Internal auditors have a mandate that allows them to look at the financial and non-financial processes of a school board. External auditors primarily conduct an audit of a school board’s financial statements, but also perform specified audit procedures as required by the Ministry of Education.
Audit committee work is very important to the role of trustee. Even if a trustee is not sitting on an audit committee, it is very important for them to engage with reports that emerge from these meetings. The work of the committee is a key part of a board’s overall oversight role.
PART B: AUDIT COMMITTEES AND STRATEGIC RISK MANAGEMENT
Overview
Audit committees play a key role in ensuring that school boards have strong internal controls, budgetary and legal compliance, accurate financial reporting and disclosure, sound business practices, and a culture of ethical behaviour.
Establishing Audit Committees
To promote effective governance, the Education Act was amended in 2009 to require the creation of an Audit committee in each Ontario district school board. Through sector consultation, Ontario Regulation 361/10: Audit Committees, was created. The regulation clearly spells out all aspects of audit committees. Each board was required to establish an audit committee no later than January 31, 2011.
What are Audit Committees?
Audit committees are legislated, standing committees of the board. They assist the board of trustees to oversee and objectively assess the performance of the school board’s risk management, internal audit and external audit functions.
What Does an Audit Committee Do?
Audit committees are a legislated and key component of a school board’s governance structure. They provide oversight through offering objective advice and recommendations to the board on whether the organization’s governance, risk management, and internal control processes are well-designed and working effectively.
Audit committees are intended to build trust and confidence in how the school board manages its resources. In fulfilling its oversight responsibilities, the audit committee should take great care in terms of demonstrating transparency and accountability. It is important to ensure that anyone sitting on an audit committee receives formal training on the purpose and mandate of the committee, the general questions that should be asked, the risk management aspects of the role, and on the board’s objectives. The audit committee should also establish a process of continuing education for its members.
Benefits of an Effective Audit Committee
When an audit committee is operating effectively, it provides a range of benefits to the board. These include improved financial practices and reporting, a strong internal audit function, and a robust external audit process. Boards may also experience heightened credibility among their local communities, as public confidence in the management of public education dollars is strengthened.
Composition of an Audit Committee
Audit committees comprise members of the board of trustees as well as non-board members. Non-board members are individuals from the community who have accounting, financial management or other relevant business experience that would enable them to understand the accounting and auditing standards applicable to the board. For greater independence, they cannot be employees of any district school board and must not have any of the specified conflicts of interest (such as having a parent, child or spouse employed by the board).
All audit committee members must be independent from the board’s management. An effective audit committee includes members who offer an appropriate mix of skills and experience. Members must abide by the school board’s code of conduct, and are required to disclose any conflict of interest, or appearance of one, to the committee.
The size of the committee varies depending on the size of the board of trustees. The average school board audit committee has five members, with at least two committee members who are not trustees.
It is good practice that the director of education, senior business official, relevant staff and regional internal audit manager attend all meetings, with the external auditor attending where appropriate.
Skills of the Audit Committee
Non-board members of the audit committee are required to have accounting, financial management or other relevant business experience. Additionally, when recruiting for an audit committee member, a board should seek out community members with sound judgment and objectivity, a high level of ethics, and strong communications skills.
Selection Committee and Terms of Appointment
The board must establish a selection committee to identify and recruit potential non-board members for the audit committee. The selection team should consist of the director of education, the senior business official of the school board and the chair of the board of trustees. To ensure the independence of the audit committee, the board’s internal audit staff should not be involved in the selection process.
Terms of office for audit committee members are determined by the school board, but maximums apply. The term for non-board members cannot exceed three years and the term for board members cannot exceed four years. Consideration should be given to stagger the terms of non-trustee members so that some continuity is maintained. Board members can be reappointed, whereas non-board members can only be appointed twice for a maximum total of six years. At that point, the board is required to advertise the position to identify new potential candidates. The incumbent may be reappointed only if no candidates are identified through the advertising process. Incumbent members remain on the committee pending new appointments. Terms are considered long enough to ensure a good measure of continuity but short enough to allow for new perspectives and insights.
It’s important to note that there is no remuneration for non-board audit committee members. Committee members may, however, be reimbursed for travel and committee-related expenses.
Role of the Audit Committee Chair
The chair has a key role in ensuring the effectiveness of the committee. At the first meeting of the audit committee in each fiscal year, the members of the committee elect the chair of the committee for the fiscal year of the board from among the members appointed to the committee. It is important to note that any audit committee member may be chair; it does not necessarily have to be a trustee.
In their role, the chair should have a sound understanding of the responsibilities of the audit committee and how it supports the board’s governance structure and work. The chair will also make sure that committee members have up-to-date knowledge about the board and its activities. The chair must facilitate discussions in ways that ensure the committee addresses the most important issues before it. Other beneficial skills include the ability to plan and manage committee meetings and coordinate the annual audit committee self-assessment. The chair should maintain an open and constructive relationship with senior managers, internal and external auditors, and the board of trustees.
Powers of the Audit Committee
An audit committee’s authority to carry out its functions and duties is established by Regulation 361/10. The committee has unrestricted access to the board’s management and employees and to the information it needs to carry out its responsibilities. It can meet with or require the attendance of individuals at committee meetings to provide the information or explanations they have requested. The audit committee also has the power to require the internal or external auditor to provide reports, as well as the power to access all records examined by internal and external auditors. With prior approval by the board, the committee can retain legal counsel, accountants or other professional assistance it needs to fulfill its responsibilities.
The audit committee may also meet with the internal audit team, external auditor or any staff of the board, without other board staff or trustees present who are not members of the committee.
Though the audit committee has broad authority to investigate, it is ultimately the board of trustees that have decision-making authority. Any recommendations resulting from an investigation would require approval from the board to be enacted.
Audit Committee Meetings
A minimum of three audit committee meetings are required every fiscal year, with the first meeting taking place no later than September 30. The audit committee chair works with senior management and the regional internal audit manager to establish a work plan and agendas so the committee can carry out its responsibilities.
A meeting quorum is the majority of the members but at least one non- board member must be present for quorum. Decisions are made by resolution and each member has one vote. The chair is entitled to cast a second vote in the event of a tie.
Each board should be clear on its policy and criteria for holding open or closed audit committee meetings. This is determined by each individual board and should reflect the principles of openness and accountability. As note above, it is good practice for relevant staff to attend all meetings.
Reporting to the Board and Ministry of Education
Ontario Regulation 361/10 requires that an annual report be submitted to the board. This report must contain a summary of the work the committee performed and matters addressed at meetings, an assessment of the committee’s progress in addressing audit observations and recommendations, and attendance records.
The board must also provide an annual report on internal audit to the Ministry of Education. The board must provide a summary of the work actually performed by the internal auditor in the year, compared to the planned work. This provides the ministry with information on the use of the internal audit funding allocation. Based on the multi-year internal audit plan, the board must also report on whether any enrolment audits are expected. This will assist the ministry in planning its own enrolment audits, with the objective of avoiding enrolment audits by the ministry and regional internal auditors in the same year.
Enrolment is the biggest driver of funding for a school board, so the ministry audits a sample of boards each year.
The report to be submitted to the ministry each year is required by a date that is established by the minister, which is generally January 15th.
It’s important to note that the Ministry does not require the full audit plan or audit results.
The Six Main Duties of Audit Committees
Audit committees have responsibilities in six main areas:
- Financial reporting
- Internal controls
- Internal audit
- External audit
- Compliance matters, and
- Risk management
Duty 1: Financial Reporting
Each school board has the responsibility to prepare consolidated financial statements. It is the role of the audit committee to review and, as it deems appropriate, recommend the approval of these financial statements to the board.
Audit committees also have the responsibility to review the results of the annual external audit and look at any difficulties the external auditor may have encountered in conducting their work and any significant changes that were made to the audit plan.
The committee must also review with the director of education, the senior business official, and the external auditor all matters that the external auditor is required to communicate to the audit committee under generally accepted auditing standards. They must review with the external auditor any written communications between the external auditor and the director of education or the senior business official and are required to ask the external auditor about whether the financial statements of the board’s reporting entities, if any, have been consolidated with the board’s financial statements.
Duty 2: Internal Controls
A school board’s internal control system is established to provide reasonable assurance that the board’s objectives will be achieved. A simple example of an internal control could be the requirement of a purchase order for procurement of items over a certain dollar amount.
The audit committee has a duty to:
- Review the overall effectiveness of the board’s internal controls
- Review the scope of both the internal and external auditors’ reviews of the board’s internal controls
- Discuss with the board’s officials any significant financial risks and the measures taken to monitor and manage these risks
There are a number of resources available to assist audit committees with their duties related to internal controls. The audit committee receives reports from internal auditors, which contain observations, recommendations and responses from board staff, action plans and timelines. The committee also receives the internal auditor’s annual report which provides assessment of the board’s processes for control and risk management. Additionally, the external auditors will present a management letter that contains risks identified during the audit.
Duty 3: Internal Audit
The audit committee has a duty to oversee the work of the internal auditors. Regional internal audit teams report to the audit committees established at school boards within their region.
With regard to internal audit, a board’s audit committee has a duty to review the annual and multi-year audit plans and to make recommendations to the board of trustees for approval of these plans. The audit committee also reviews internal audit findings and recommendations as well as management’s response to recommendations, while conducting a performance review of the regional internal audit manager.
Duty 4: External Audit
In addition to overseeing the work of the internal auditors, the audit committee also has a duty to oversee the work of the board’s external auditor. The committee must make recommendations to the board on the content of the external auditor’s plan and on all proposed major changes to the plan. The audit committee must also conduct a performance review of the external auditor annually.
Where there are any disagreements about financial reporting between the director of education, the senior business official and the external auditor, the audit committee should work to resolve these.
Duty 5: Compliance Matters
An audit committee has duties related to the board’s compliance matters. These include reviewing the effectiveness of the board’s systems for monitoring compliance with legislative requirements and with the board’s policies and procedures.
There are approximately 200 statutes that impose liability in various situations (e.g., Income Tax Act, Employment Standards Act, Occupational Health and Safety Act, etc.). Those who are in charge of the board’s governance are held accountable if there is a lack of compliance.
The audit committee must obtain confirmation from the board’s director of education and supervisory officers that all statutory requirements are being met and should receive regular updates on compliance matters.
There may be reports received from other parties such as regulators, and any significant findings in these reports must also be reviewed.
Where there have been instances of non-compliance, the audit committee should review any action taken by the board to address the non-compliance.
Duty 6: Risk Management
Audit committees have a number of duties related to risk management at their board. It is the responsibility of the audit committee to stay informed on significant risks to the school board. The audit committee should review the board’s policies for risk assessment and management and assess the steps the director of education and a senior business official have taken to manage such risks.
Strategic Risk Management
Strategic risk management does not have a universally defined owner, and is useful as a governance and risk management tool for boards of trustees, audit committees and senior management. It is intended to be a comprehensive approach to identifying, assessing, and managing risks that could impact an organization’s ability to achieve its strategic objectives. For Ontario school boards, strategic risk management involves a structured process to anticipate and prepare for potential risks and opportunities, thereby improving school board operational resilience and strategic focus.
Key benefits of strategic risk management for Ontario school boards include the following:
- Improved Decision-Making: By understanding where risk management practices are strong or need improvement, school boards can make more informed decisions, leading to increased confidence in their strategic choices.
- Enhanced Operational Resilience: Strategic risk management helps school boards better anticipate and prepare for major risks and opportunities, which improves their ability to respond to unexpected events and maintain continuity in their operations.
- Effective Resource Allocation: A sound strategic risk management framework ensures that board resources are allocated to address the most significant risks and opportunities in relation to their strategic plan objectives.
- Consistent Consideration of Uncertainty: A framework facilitates a consistent approach to considering uncertainty in relation to the multi-year strategic plan, as set by trustees and school boards. This method ensures that risk management is integrated into the strategic planning process.
- Training and Awareness: A framework should include tools and resources to help school boards implement strategic risk management practices effectively. The framework needs to include training modules and video resources to raise awareness and build capacity among trustees and staff.
Overall, strategic risk management provides Ontario school boards with a proactive approach to managing risks, ensuring they are well-prepared to achieve their strategic objectives while maintaining a high level of operational resilience.
Strategic risk management, when properly implemented and supported by trustees and senior school board staff, can have positive impacts throughout the organization. In particular, strategic risk management offers the following benefits to students in Ontario school boards by ensuring a stable, safe, and supportive learning environment:
- Enhanced Safety and Security: By identifying and mitigating potential risks, school boards can create safer environments for students. Enhanced safety and security measures include addressing physical safety, cybersecurity, and emergency preparedness.
- Improved Resource Allocation: Strategic risk management ensures that resources are allocated effectively to address the most significant risks and opportunities. Proper resource allocation means that funds and efforts are directed toward initiatives that directly benefit students, such as educational programs, technology, and facilities.
- Operational Resilience: By anticipating and preparing for major risks, school boards can maintain continuity in their operations. Resilience ensures that education is not disrupted by unforeseen events, such as natural disasters or pandemics.
- Better Decision-Making: With a clear understanding of risks and opportunities, school boards can make more informed decisions that positively impact student education and well-being. Better, more informed decisions related to curriculum development, extracurricular activities, and student support services provide direct benefits to student educational experiences and outcomes.
- Consistent Quality of Education: Strategic risk management helps school boards maintain a high standard of education by addressing potential challenges proactively. This area of focus ensures that students receive a consistent and high-quality education, regardless of external factors.
- Support for Innovation: By managing risks effectively, school boards can create an environment that supports innovation and continuous improvement. An innovative environment allows for the introduction of new teaching methods, technologies, and programs that enhance students’ learning experiences.
If done effectively, strategic risk management helps create a more stable, safe, and supportive environment for students and school board staff.
The board of trustees has primary responsibility for oversight of the board’s risks. Part of this responsibility is delegated to the audit committee through its duties, as outlined in legislation. The audit committee cannot consider each risk item in detail on an ongoing basis, but has the responsibility to:
- Ensure management has implemented an appropriate system to manage risks
- Provide effective risk oversight through its regular processes
PART C: THE INTERNAL AUDIT FUNCTION
The Internal Audit Function
The internal audit function has the objective of evaluating and improving a school board’s processes for risk management, control and governance. The function works to uncover control gaps, prevent waste, streamline processes and help direct a school board’s resources to areas of highest risk.
The regional internal audit team structure helps achieve objectives of internal auditing. Across the province, regional audit teams are grouped together into eight regions based on geographic location, with one French-language audit team for all French-language boards. A host board is assigned within each of the regions to oversee the administrative requirements of the regional audit team on behalf of the other boards in the region. Host boards receive grant funding to cover the associated operational and administrative costs.
Regional internal auditors are employees of the host board. They report to the audit committees in their region where they provide internal audit service to each board.
What do Internal Auditors do?
Internal auditors work with school board management to conduct audits that provide feedback on a board’s operations.
Internal auditors make recommendations that provide school boards with direction to improve practice. It is up to the audit committee to accept the recommendations, and up to management to implement them. Follow-up on implementation of recommendations should happen regularly at audit committee meetings.
One of the benefits of the regional internal audit model is that the team may facilitate sharing of leading practices among school boards both within the region and all eight regions.
It is important to remember that internal auditors can only look at a snapshot of a board’s operations and test on a sample basis. This means that the scope of the auditor’s work is limited to a point in time, and auditors cannot provide 100% assurance.
What do Internal Auditors look at?
In working with school boards, internal audit teams bring a diversity of skills and knowledge that can add an effective review of a school board’s operations. Review areas might include any functional area within a board (i.e., human resources, facilities, instruction and schools, business services, transportation, IT, and communications).
Internal auditors offer a wide range of support. Examples of supports would include helping a board identify and plan to implement leading practice in recruitment and hiring, identifying opportunities to support effective communication throughout the district, and suggesting improvements to cyber security or health and safety programs, etc.
Keys to an Effective Internal Audit Function
The most important factor in ensuring effective internal audit services is strong support from the director of education and senior management team. This is essential to helping regional internal audit teams achieve their objectives of assisting boards and making useful recommendations. School board management should communicate regularly with their regional internal audit team and attend audit committee meetings as appropriate to build a strong working relationship. The director of education and senior business official should attend every meeting.
Also essential to the effectiveness of the internal audit function is the creation of a formal regional internal audit team mandate or charter that grants unrestricted access to school board operations. The mandate or charter should define its purpose, authority and responsibility. It should be signed by the director of education, audit committee chair and regional internal audit manager, and should be reviewed regularly.
Objective and highly skilled internal audit staff are also essential. Audit staff must have impartial attitudes, avoid conflict of interest and adhere to professional audit standards.
Internal audit recommendations can help school boards save money and streamline processes. The independent internal audit function also provides the Auditor General and the provincial Ombudsman with a reasonable level of assurance regarding the education sector.
Internal auditors support the work of trustees and school boards in building public confidence in the sector as they provide objective accountability and transparency that demonstrates the board is effectively managing its resources.
PART D: EXTERNAL AUDIT
The Ministry of Education is the primary user of a school board’s financial statements. As such, though the information within a school board’s financial statements is generally presented in accordance with Public Sector Accounting Board standards, statements may be modified as specified by the Ministry of Education. Financial statements are prepared by school board staff and then audited by an external audit firm hired by the school board.
External auditors play a crucial role in ensuring the financial integrity and accountability of the board. Key responsibilities of an external auditor include:
- Financial statement audits
- Compliance and risk management
- Audit committee interaction
- Reporting and recommendations
Financial Statement Audits
External auditors conduct annual audits of the school board’s financial statements in accordance with generally accepted Canadian auditing standards. They provide an independent opinion on whether the financial statements present a true and fair view, in all material respects, of the board’s financial position and performance.
Compliance and Risk Management
External auditors evaluate the effectiveness of the board’s internal controls, compliance with relevant laws and regulations, and risk management processes. This evaluation includes assessing the accuracy of financial statements, the effectiveness of internal controls, and the board’s adherence to any specific financial directives established by the Ministry of Education. In addition, external auditors may perform specific procedures as required by the ministry.
Audit Committee Interaction
External auditors work closely with the school board’s audit committee, which is responsible for overseeing the board’s financial reporting, controls, and risk management. External auditors provide the audit committee with an annual plan for the financial statement audit, and then report back on the results of the audit once completed. As well, they may attend some audit committee meetings to ensure they are aware of important items raised at the meetings.
Reporting and Recommendations
After completing the financial statement audit, external auditors present their findings and recommendations to the audit committee. They address any questions that may arise and provide insights to improve financial processes and controls.