SECTION 1000 AUTHORITY, ORGANIZATION AND …

1 UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 1 CONTENTS SECTION 1000 AUTHORITY, ORGANIZATION AND PROFESSIONAL STANDARDS 1100 Internal Audit Charter 1200 Policy on Dual Reporting for Internal Audit Appendix Organizational Chart Appendix Responsibility Chart 1300 Professional Standards and Ethics Appendix Professional Standards and Ethics Appendix Professional Standards and Ethics Cross-Reference SECTION 2000 INTERNAL AUDIT PROGRAM 2100 History and Overview 2200 Customers and Services 2300 Communications 2400 Role of the Office of Audit Services 2500 Guidelines for Local Audit Oversight Committees Appendix Sample Audit Committee Charter SECTION 3000 INTERNAL AUDIT PROGRAM PLANNING AND REPORTING

2 3100 Strategic Plan 3200 Operating Plans Appendix Annual Audit Planning Timeline Appendix Risk Model 3300 Monitoring and Reporting Appendix Standard Time Categories and Definitions UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 2 CONTENTS SECTION 4000 PERSONNEL 4100 Roles and Responsibilities Appendix Sample Job Description (Staff/Senior) Appendix Sample Job Description (Principal/Supervisor) Appendix Sample Job Description (Associate Director/Manager) Appendix Sample Job Description (Director) 4200 Career Development and Counseling 4300 Training and Professional Development 4400 Skills Assessment and Resource Analysis 4500 Performance Evaluations Appendix Sample Annual Performance Evaluation Form Appendix Sample Interim Evaluation Form SECTION 5000 LIAISONS 5100 Control Environment Collaboration 5200 Office of the General Counsel 5300 Audits by External Agencies 5400 Law Enforcement Agencies 5500 Department of Energy SECTION 6000 AUDIT SERVICES Appendix Flowchart of General Audit Operating Process Appendix Flowchart of Local Audit Project Process 6100 Planning an Audit 6200 Conducting an Audit Appendix

3 Sample Attestation (Auditor) UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 3 CONTENTS Appendix Sample Attestation (Assistant/Associate Director) Appendix Sample Attestation (Director) 6300 Reporting Results Appendix Audit Report Pre-Issuance Quality Assurance Check list 6400 Audit Follow-up 6500 Other Audit Matters Appendix Sample Client Satisfaction Survey Appendix Sample Management Satisfaction Survey 6600 Conducting Information Technology Audits SECTION 7000 INVESTIGATION SERVICES 7100 Introduction 7200 Conducting an Investigation 7300 Communications and Reporting SECTION 8000 ADVISORY SERVICES 8100 Advisory Services Overview 8200 Planning an Advisory Services Engagement 8300 Conducting an Advisory Services Engagement 8400 Reporting Results of an Advisory Services Engagement 8500 Performing

4 Follow-up for Advisory Services 8600 Other Advisory Services Matters SECTION 9000 QUALITY ASSURANCE 9100 Quality Assurance Processes at the Local Level Appendix Quality Assurance Processes at the Local Level UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 4 CONTENTS 9200 System-Wide Quality Assurance Program 9300 Quality Assurance Reporting UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 5 1000 AUTHORITY, ORGANIZATION AND PROFESSIONAL STANDARDS SECTION Overview .01 The following sections set forth the mission and charter of the UC Internal Audit Program and outline the policies and guidelines for UC Internal Audit dual reporting and professional standards and ethics.

5 Authority .02 The mission and charter authorize and guide the UC Internal Audit Program in carrying out its independent appraisal function. ORGANIZATION .03 It is the policy of The UC Board of Regents to establish and maintain an Internal Audit Program as a staff and independent appraisal function. Internal Audit is a management control that functions by assessing the effectiveness of other managerial controls. Internal Audit examines and evaluates University business and administrative activities in order to assist all levels of management and members of The Board of Regents in the effective discharge of their responsibilities and furnishes them with analyses, recommendations, counsel and information concerning the activities and records reviewed.

6 Internal Audit is headed by the SVP/Chief compliance and Audit Officer (SVP/CCAO) and is a component of the Office of the Regents. The SVP/CCAO is appointed by the Regents and the President. The SVP/CCAO prepares, for approval by the President and The Board of Regents compliance and Audit Committee, a UC Internal Audit Annual Plan that defines the Audit Program to be conducted for the University during the year. Professional Standards .04 The University of California Internal Audit Program complies with the Institute of Internal Auditor s (IIA) International Professional Practices Framework, which includes the Core Principles for the Professional Practice of Internal Auditing, the Definition of Internal Auditing, the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing (Standards), as well as University policies and UC Standards for Ethical Conduct.

7 UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 6 1100 Internal Audit Charter Policy Statement .01 It is the policy of the University of California to maintain an independent and objective internal audit function to provide the Regents, President, and campus Chancellors with information and assurance on the governance, risk management and internal control processes of the University. Further, it is the policy of the University to provide the resources necessary to enable Internal Audit to achieve its mission and discharge its responsibilities under its Charter. Internal Audit is established by the Regents, and its responsibilities are defined by The Regents' Committee on compliance and Audit as part of their oversight function.

8 Vision .02 UC Internal Audit will be a universally recognized knowledgeable, collaborative and trusted resource on governance, risk management and control. Mission Statement .03 The mission of the University of California (UC) internal audit program (IA) is to provide the Regents, President, and campus Chancellors, and Laboratory Director independent and objective assurance and consulting services designed to add value and to improve operations. We do this through communication, monitoring and collaboration with management to assist the campus community in the discharge of their oversight, management, and operating responsibilities. Internal audit brings a systematic and disciplined approach to evaluating and improving the effectiveness of risk management, control and governance processes.

9 Authority .04 IA functions under the policies established by the Regents of the University of California and by University management under delegated authority. IA is authorized to have full, free and unrestricted access to information including records, computer files, property, and personnel of the University in accordance with the authority granted by approval of this charter and applicable federal and state statutes. Except where limited by law, the work of IA is unrestricted. IA is free to review and evaluate all policies, procedures, and practices for any University activity, program, or function. In performing the audit function, IA has no direct responsibility for, nor authority over any of the activities reviewed.

10 The internal audit review and approval process does not in any way relieve other persons in the ORGANIZATION of the responsibilities assigned to them. UNIVERSITY OF CALIFORNIA INTERNAL AUDIT MANUAL University of California 6/14/2018 Page 7 1100 Internal Audit Charter Independence and Reporting Structure .05 To permit the rendering of impartial and unbiased judgment essential to the proper conduct of audits, internal auditors will be independent of the activities they audit. This independence is based primarily upon organizational status and objectivity and is required by external industry standards. The Senior Vice President (SVP) - Chief compliance and Audit Officer (SVP/CCAO) has a direct, independent reporting relationship to the Regents, communicating directly with the Board of Regents and the Regents Committee on compliance and Audit regarding all elements of meaningful compliance and audit programs, including providing annual reports on compliance with applicable laws, regulations and University policy.