V.H. – Audits – 12-2025

1. General Purpose and Governance

The Audit, Risk and Compliance Committee (Committee) is established as a standing committee of the Board under Idaho State Board of Education, Policies and Procedures, Section I. Bylaws to provide fiscal , compliance and risk management oversight responsibilities. The Committee provides oversight for: financial statement integrity, financial practices, internal control systems, financial management, risk management, compliance and ethical standards of conduct. This policy and relevant sections of the Board's bylaws serve as the Committee’s charter. Changes to this policy must be approved by the Committee before being submitted for approval by the Board..

The Committee serves as the Board's liaison with its external auditors regulatory auditors, the internal audit and risk management functions of the Office of the State Board of Education, and with compliance officers of the institutions. The Committee reviews institution fiscal operations. The Committee also reviews institutional procedures for controlling operating risks and monitors the compliance programs . At the discretion of the Committee, this policy, or portions of it, can be applied to agencies of the Office of the State Board of Education or to programs and activities of the Office of the State Board of Education. The Committee chairperson reports periodically to the Board on the activities of the Committee, including any recommended changes or additions to the Board's policies and procedures through the Business Affairs and Human Resources Committee. The Committee is authorized to act on applicable items that do not require Board approval.

The Committee shall meet at least four times per year and may be aligned with regularly scheduled Board meetings or more frequently as circumstances may require. The Committee may require institution or agency management or others to attend the meetings and provide pertinent information as necessary.

2. Calendar

The Committee shall establish a calendar of all regularly scheduled meetings including Committee chairperson (or designee) reports to the Board, the independent auditors, institutions, and others as appropriate. The Committee should take into consideration the requirements and due dates of other State agencies in establishing timelines.

3. Selection of External Auditors

Items 3, 4 and 5 apply to the institutions only (Boise State University, Idaho State University, University of Idaho, and Lewis-Clark State College).

1. The Committee shall allow enough time to prepare and publish a request for proposal, review and evaluate proposals, obtain Board approval of the selected audit firm, and negotiate a contract. The Committee shall consider the need to seek a new proposal every three years.
2. The Committee shall establish a process for selecting an external audit firm. The process used should include representatives from the Board, Committee, and institutions.
3. The Committee shall make the selection of the recommended external audit firm.
4. The selection of the new external audit firm shall be presented to the Board for approval at the next Board meeting following the Committee’s recommendation.
5. An annual review of external auditor performance and fees shall be conducted.

4. Financial Statement Auditors

1. Lead Partner Rotation
   
   It is the intent of the Board to adhere to the recommendation of the National Association of College and University Business Officers (NACUBO) to require rotation of the lead audit partner of the external audit firm every five years, with a two-year timeout provision. The Committee shall establish when the five- year limit will be reached for the current lead audit partner. At least one year prior to that time, the Committee shall discuss transition plans for the new lead audit partner. The five- year limit will be reviewed annually with the external auditors. These discussions shall be documented in the Committee meeting minutes.
2. Scope and Reporting
   1. Prior to the start of any audit work for the current fiscal year, the Committee will meet with the lead external audit partner to review the audit scope. Questions related to audit scope should include significant changes from prior year, reliance on internal controls and internal audit function, assistance from institutional staff, and changes in accounting principles or auditing standards. The Committee should also discuss how the audit scope will uncover any material defalcations or fraudulent financial reporting, questionable payments, or violations of laws or regulations. Areas of the audit deserving special attention by the Committee and issues of audit staffing should also be reviewed.
   2. Prior to the publication of the external auditor’s report, the Committee will review all material written communications between the external auditors and institution management, including management letters, schedules of posted and/or unadjusted misstatements, and opinion modifications. The Committee shall conclude on the appropriateness of the proposed resolution of issues, and the action plan for items requiring follow-up and monitoring. The Committee shall review these risks with institution management at each meeting or sooner, if necessary, to make sure it is up- to-date.
   3. Subsequent to the external audit report, the Committee shall meet with the lead external audit partner and the Chief Financial Officer of each institution, to review the scope of the previous year’s audit, and the relationship between the internal audit function and the external auditors with respect to the scope of the external auditor’s work. Prior to the start of interim work for the current year audit, the Committee shall review the audit plans.
3. Accounting Policies
   
   Annually and/or in conjunction with the year-end external audit, the Committee shall review with the lead external audit partner all critical accounting policies and practices and all alternative treatments of financial information within generally accepted accounting principles that have been discussed with management of the institutions, the ramifications of each alternative, and the treatment preferred by each institution.
4. Financial Statement Review
   
   At the completion of the external audit, the Committee shall review with institution management and the external auditors each institution’s financial statements, Management’s Discussion and Analysis (MDA), related footnotes, and the external auditor’s report. The Committee shall also review any significant changes required in the external auditor’s audit plan and any serious difficulties or disputes with institution management encountered during the audit. The Committee shall document any discussions, resolution of disagreements, or action plans for items requiring follow-up.
5. Single Audit Review
   
   At the completion of the Single Audit Report, as required under the Single Audit Act of 1984, and the Single Audit Act Amendments of 1996 (collectively “Single Audit Act”), the Committee shall review with institution management and the external auditors each institution’s Single Audit Report. The Committee shall discuss whether the institution complies with laws and regulations as outlined in the Single Audit Act and applicable compliance guidance.. The Committee shall report to the Board that the review has taken place and any matters that need to be brought to the Board’s attention. The Committee shall document any discussions, resolution of disagreements, or action plans for items requiring follow- up.

5. Internal Audit (Internal Audit and Advisory Services – IAAS)

1. IAAS reports functionally to the Committee and administratively to the Board’s executive director. The Committee shall have sole oversight of internal audit related activities. The internal audit function will be administered by a chief audit executive (CAE) within the Office of the State Board of Education. Institutions are prohibited from establishing their own internal audit functions. The Committee shall:
   1. Ensure that IAAS works under an internal audit charter, reviewed annually by the Committee
   2. Ensure the functional independence of IAAS
   3. Hiring, termination and discipline of the CAE rests with the Board with advice from the Committee and the OSBE Executive Director.
   4. Provide input into the performance review of the CAE
   5. Approve and provide feedback on an annual plan submitted by the CAE
   6. Advise the Board about increases and decreases to IAAS resources needed to carry out internal audit activities
   7. Receive and review an annual performance report on IAAS activities from the CAE.
   8. Review IAAS’s conformance to internal audit professional standards established by the Institute of Internal Auditors (“IIA”).
   9. Review IAAS findings and recommendations, and review the adequacy of corrective action taken by institution management.
2. IAAS shall have free and unrestricted access to institutional personnel, buildings, systems and records needed to perform internal audit work. Institutions are responsible for providing adequate office space, furniture and communication equipment for on- campus audit teams. The Committee shall review and resolve any difficulties encountered by internal audit staff including restrictions on scope or access to personnel, buildings, systems or records. Internal auditors are responsible for handling information in accordance with relevant policies, procedures and laws. The CAE shall establish audit procedures for the collection and retention of private personal, sensitive, or confidential information.
3. IAAS will maintain a quality assurance and improvement program that covers all aspects of its operations. The program will include an evaluation of I conformance with internal audit standards and an evaluation of whether IAAS conforms to the IIA’s Code of Ethics. The program will also assess the efficiency and effectiveness of IAAS and identify opportunities for improvement.
   
   The CAE will communicate to the Committee IAAS’s quality assurance and improvement program, including results of internal assessments (both ongoing and periodic) and external assessments conducted at least once every five years by a qualified, independent assessor or assessment from outside Idaho higher education.

6. Other Audits

1. Legislative Audits
   1. All state agencies under the Board’s jurisdiction, excluding the State Department of Education, will receive financial statement audits and federal single audits in accordance with federal and state laws and regulations. The Committee must be informed immediately by an agency of any audit activity being conducted by the legislative auditor.
   2. At the completion of a legislative audit, the Committee may discuss with the legislative auditor the progress of the legislative audit, including a report on preliminary and final audit findings and recommendations.
2. Employee Severance Audits
   
   When key administrative personnel leave an agency or institution, the Committee may bring to the Board a recommendation as to whether an audit should be conducted and the scope of such an audit.
3. Other External Audits and Reviews
   
   The Committee is authorized to engage the services of outside auditors or evaluators to perform work used to supplement the work of the Committee, to assess compliance with laws and regulations, or to assess business processes.

7. Risk Management

The Committee shall provide oversight of a system-wide enterprise risk management process. This includes authorizing a standardized enterprise risk management methodology. It also includes receiving reports or presentations from board staff or institutional employees regarding operating risks and risk management activities. :

8. Compliance

1. General
   
   The Board is committed to ethical conduct and to fostering a culture of compliance with the laws and regulations which apply to the institutions and agencies under its governance.
2. Compliance Officer
   
   Each institution shall establish a compliance function, administered by a full-time Compliance Officer. The institutions shall consult with the Committee on the appointment of the Chief Compliance Officer. The Compliance Officer shall report directly to the institution President and indirectly to the Committee. Exceptions to this structure can be authorized by the Committee.
3. Compliance Program The Committee shall provide oversight of the effectiveness and adequacy of resources of the compliance program. The Compliance Officer shall be responsible for administering a compliance program. A a minimum, the compliance program must include the following:
   1. A code of ethics or standards of conduct that apply to all employees.
   2. A published and widely disseminated list or index of compliance areas and assigned responsibilities, categorized and prioritized based on risk, likelihood, and negative impact of potential events.
   3. A risk-based compliance training program to educate employees on the laws, regulations and policies relevant to their day-to-day job functions. Training for volunteers will be delivered as necessary and at the reasonable discretion of the supervising employee.
   4. A framework for coordinating compliance oversight, monitoring and reporting. This includes a management level group or individual with authority and adequate resources to examine compliance issues and assist the compliance officer in investigating, monitoring, and assessing compliance and/or recommending policies or practices designed to enhance compliance.
   5. A process to ensure institutional policies are regularly reviewed for compliance with current federal and state laws and regulations and Board policies. .
   6. Reporting mechanism that provide for anonymous and confidential reporting of compliance issues. Once mechanism shall be an anonymous reporting hotline to be administered by the Chief Compliance Officer.
   7. Processes to timely investigate or review potential issues of non- compliance. This process must include a process for documenting investigations or reviews.
   8. Coordination with General Counsel, Internal Audit and Advisory Services, and Systemwide Risk Management Services to address compliance related issues.
   9. A process to coordinate resolution of compliance matters.
4. Compliance Reporting
   
   The compliance officer shall prepare and submit reports to the Board’s executive director and the Committee regarding the adequacy and effectiveness of the compliance program and reasons for updates made to the program. This includes reporting information useful for understanding the effectiveness of the compliance program and to assess compliance related risk. These reports will be submitted at least annually and more frequently if directed by the Committee.
   
   The compliance officer is required to timely report to the President and the Committee actual or likely issues of material non- compliance. Issues of material non-compliance are those that:
   1. Are of significant public interest using the reasonable person standard
   2. Result in corrective or enforcement action by a regulatory agency
   3. Involve executive leadership; or
   4. Exposes the institution to significant fines, penalties or financial liability. The Committee will establish criteria to determine amounts to be “significant.” For purposes of this subparagraph, “financial liability” means the estimated obligation by the institution or another party resulting from non- compliance.
      
      The compliance officer shall immediately report issues of potential or actual fiscal misconduct to the chief audit executive. Fiscal misconduct shall be resolved under Board policy V.Y.