OAR 125-700-0126: Contracted Internal Audit Services

(1) All agencies are able to contract for internal audit services according to laws, rules, and statewide policies guiding procurement processes. (2) Agencies meeting the requirement to establish, maintain, and fully support an internal audit function set in OAR 125-700-0125 may contract for internal audit services to meet, in whole or in part, requirements for audit work set in this chapter and ORS 184.360, including: (a) Completion of a risk assessment of the entire agency which conforms to audit standards established by nationally recognized entities such as the United State Government Accountability Office or the Institute of Internal Auditors. (b) Selection and performance of at least one audit identified in the agency risk assessment per year. (c) Performance of an audit related to governance and risk management at least once every five years. (3) Agencies meeting the requirement to establish, maintain and fully support an internal audit function set in OAR 125-700-0125 and using contracted internal audit services to meet, in whole or in part, requirements set in this chapter and ORS 184.360 may not contract for management of the internal audit function. These agencies retain responsibility for maintaining an effective internal audit activity in accordance with standards and policies for management of internal audit set in this chapter related to Governance (0135), Planning and Reporting (0140), and External Review (0145). (4) Providers of contracted internal audit services will: (a) Make the contracting agency aware of its responsibility to maintain an effective internal audit activity in accordance with professional auditing standards, the rules of this chapter, and ORS 184.360. (b) Attest whether or not the agency has and/or conforms to an existing QAIP, or disclose to senior management and the board any instances where the internal audit activity does not conform with the Standards or the Code of Ethics and how the lack of conformance impacts the overall scope or operation of the internal audit activity (c) Provide to the agency documentation necessary to demonstrate compliance with the established the QAIP, professional audit standards, rules of this chapter, and ORS 184.360.