1. Home
  2. About
  3. Board & Governance
  4. Policies & Procedures

BP 7-01 – Audit Committee Authority and Charter

State Board for Community Colleges and Occupational Education

BP 7-01

APPROVED: June 13, 2007
EFFECTIVE: July 1, 2007
REVISED: February 8, 2023
RETITLED: February 8, 2023
REVISED: March 12, 2025

REFERENCE(S): Board Bylaws; The Institute of Internal Auditors’ (IIAs’) International Professional Practices Framework (IPPF)

APPROVED:

/ Landon Mascareñaz /
Landon Mascareñaz, Chair

Policy Statement

The Board Audit Committee (Committee) is a committee of the State Board for Community Colleges and Occupational Education (SBCCOE or Board). This policy defines the purpose and authority of the Committee, as well as the Internal Audit Charter.

Scope

This policy applies to all members of the Audit Committee and System Internal Audit in the Colorado Community College System, including its Colleges (CCCS or System).

Definitions

“Fiduciary Responsibilities” include assessing risk and addressing matters including financial statement reporting, internal controls, compliance with applicable laws, regulations, Board Policies, and System Procedures. These responsibilities are to include fraud prevention and detection.

“Financial Expert” is an individual who possesses one or more of the following:

  • An understanding of “Generally Accepted Accounting Principles” (GAAP) and financial statements.
  • The ability to assess the general application of such principles in connection with the accounting for estimates, accruals, and reserves.
  • Experience preparing, auditing, analyzing, or evaluating financial statements that present a breadth and level of complexity of accounting issues that are generally comparable to the breadth and complexity of issues that can reasonably be expected to be raised by the Colorado Community College System’s financial statements, or experience actively supervising one or more persons engaged in such activities.
  • An understanding of internal controls.
  • An understanding of audit committee functions.

These attributes may be acquired in one or more ways:

  • Education and experience as a principal financial officer, principal accounting officer, controller, public accountant or auditor, or experience in one or more positions that involve the performance of similar functions.
  • Experience actively supervising a principal financial officer, principal accounting officer, controller, public accountant or auditor, or person performing similar functions.
  • Experience overseeing or assessing the performance of public accountants with respect to the preparation, auditing, or evaluation of financial statements.
  • Other experience relevant to audits, investigations, or financial operations.

Composition of Board Members and Qualifications

  • The Committee shall be appointed by the Chair of the Board and approved by the Board, in accordance with the Board’s Bylaws.
  • The Committee shall consist of at least three Board members and the Chancellor, who will serve as a non-voting member.
  • At least one member of the Committee will be a Financial Expert, as defined in this policy. In the event the Board does not have a member who meets the qualifications of a financial expert, this shall not nullify the authority, activities, or actions of the Audit Committee.
  • The Chair of the Board shall appoint, and be approved by the Board, one of the members of the Audit Committee as its Chair, in accordance with the Board’s Bylaws.

Authority of the Committee

The Committee has the authority to authorize audits and investigations through the operation of the System Office Internal Audit department. To allow for independent analysis and investigation, the Committee shall delegate audit and investigation oversight to the System Office’s Director of Internal Audit. The Committee may retain independent auditors, legal counsel, accountants, or others, as it deems necessary, to assist it in the conduct of any audit or investigation.

While the Audit Committee has the responsibilities and powers set forth in this policy, it is not the Committee’s duty to plan or conduct audits or to determine that the System’s financial statements are complete, accurate, and in accordance with generally accepted accounting principles. System Office executive leadership is responsible for the preparation, presentation, and integrity of the System’s financial statements and for the appropriateness of the accounting principles and reporting policies used. The independent auditors contracted by the Colorado Office of the State Auditor are responsible for auditing the System’s financial statements.

Duties of the Audit Committee

To establish, maintain, and ensure that CCCS’ Internal Audit function has sufficient authority to fulfill its duties, the Audit Committee shall:

  • Discuss with the Director of Internal Audit and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and advisory) of the internal audit function.
  • Ensure the Director of Internal Audit has unrestricted access to and communicates and interacts directly with the Audit Committee, including in private meetings without senior management present. Such meetings must be held in accordance with laws and regulations applicable to public records.
  • Discuss with the Director of Internal Audit and senior management other topics that should be included in the internal audit charter.
  • Participate in discussions with the Director of Internal Audit and senior management about “essential conditions”.  Essential conditions establish the foundation that enables an effective internal audit to function and are defined in the Global Internal Audit Standards.
  • Ensure the budget for the Internal Audit Department is presented to the Board for approval annually as well as any recommendations for spending needs to fulfill its mission.
  • Regularly review the Audit Committee and the internal audit charter, which includes the internal audit mandate and the scope and types of internal audit services.
  • Review the internal audit charter periodically with the Director of Internal Audit to consider changes affecting the organization, such as employment of a new Director of Internal Audit or changes in the type, severity, and interdependencies of risks to the organization, and approve the internal audit charter periodically.
  • Be informed by the Executive Director of Human Resources of the process used to fill vacancies in the Director of Internal Audit position. The Committee will assess its role in the selection process, with the understanding that it will have the authority to approve the job offer to the final candidate. Additionally, the Committee will authorize the termination of the Director of Internal Audit.
  • Be informed by the Vice Chancellor for Administration and Finance of the compensation and performance of the Director of Internal Audit.
  • Collaborate with senior management to determine the qualifications and competencies the organization expects in a Director of Internal Audit, as described in the Global Internal Audit Standards.
  • Approve the risk-based internal audit plan and review progress towards the annual audit plan.
  • Make appropriate inquiries of senior management and the Director of Internal Audit, to determine whether there is inappropriate scope or resource limitations and remedy the situation when possible.
  • Ensure a quality assurance and improvement program has been established.
  • Review the results of the quality assurance and improvement annually.
  • Review Financial Reporting with senior management and the independent auditor at the completion of the annual audit:
    • The annual financial statements, management’s discussion and analysis, related footnotes, compliance report, findings, and auditors’ report.
    • All alternative treatments of financial information that have been discussed with management.
    • Critical accounting policies and practices that are in place.
    • All significant written communications between the auditor and management such as management letter comments and the schedule of unadjusted differences.
    • Any significant changes required in the independent accountant’s audit plan.
    • Other matters related to conduct, which should be communicated to the Committee under generally accepted auditing standards.

The Audit Committee further works with independent auditors for an annual External Audit to:

  • Review the scope and approach of the annual audit with the independent auditors.
  • Assess the external auditor’s process for identifying and responding to key audit and internal control risks.
  • The external auditor shall have direct access to the Committee and shall meet privately, without members of senior management present, at least once during the course of the audit.
  • Receive communication directly from the external auditor regarding any matters that arose during the course of their audit.

Duties of the Audit Committee Chair

The Audit Committee Chair shall:

  • Provide the Board with reports on the activities of the Internal Audit department.
  • Ensure the Audit Committee is provided training to fulfill its role.
  • Report whistleblower complaints, as necessary, to the Board Chair, in compliance with Board Policy 3-71, Whistleblower Protection.
  • Report regularly to the full Board any issues that arise with respect to:
    • The quality or integrity of the System’s financial statements, not to duplicate communications and activities reported through the external audit.
    • The System’s compliance with legal or regulatory requirements.
    • The performance of the internal audit function.
    • Any other matters in the Committee’s performance of its duties that the Committee views important to present to the full Board.

Meetings

In meeting its responsibilities, the Committee shall perform duties to include those noted within the following areas:

  • The Committee shall meet four times per year, or more frequently as circumstances require.
  • The Committee may include other ad hoc individuals, to include, but not limited to, the following: System Office leadership; contracted auditors; System Office auditors; and/or other personnel employed by CCCS.
  • The Committee will periodically meet with members of System Office leadership separately, in executive session, pursuant to Colorado law, to discuss matters relevant to the Audit Committee’s charge.

Financial Compliance and Operational Functions

  • Review any matters involving a conflict of interest or matters involving a breach of ethics if they involve personnel at a management level within the System.
  • Review and recommend for approval procedures for the receipt, retention, and treatment of whistleblower complaints received by the System.
  • Review, on a periodic basis, summary information documenting complaints submitted relating to accounting, internal controls, misuse, abuse, or misappropriation of resources and inappropriate personnel activity regardless of action taken or outcome of such action.
  • Review facts related to any fraud or misconduct committed by employees or senior management of the System Office or of the Colleges.
  • Review and evaluate the effectiveness of the System’s process for assessing significant risks or exposures and the steps management has taken to monitor and control such risks.
  • Inquire of senior management, Internal Audit, and the external auditor about risks facing the System.
  • Provide oversight of the Director of Internal Audit and the activities of the Internal Audit department.
  • Ensure the adequacy of procedures to protect confidentiality of information obtained through the activities of the Internal Audit department.
  • Periodically review Committee effectiveness.

Internal Audit Charter 

Purpose

The purpose of the Colorado Community College System’s (CCCS’s) Internal Audit department is to strengthen CCCS’s ability to create, protect, and sustain value by providing the State Board for Community Colleges and Occupational Education (SBCCOE or Board) and management with independent, risk-based, and objective assurance, advice, insight, and foresight.

The Internal Audit function enhances CCCS’s:

  • Successful achievement of its objectives.
  • Governance, risk management, and control processes.
  • Decision-making and oversight.
  • Reputation and credibility with its stakeholders.
  • Ability to serve the public interest.

CCCS’s Internal Audit function is most effective when:

  • Internal auditing is performed by competent professionals in conformance with the IIA’s Global Internal Audit Standards which are set in the public interest.
  • The Internal Audit function is independently positioned with direct accountability to the Board.
  • Internal auditors are free from undue influence and committed to making objective assessments.

The Internal Audit department’s mission is to provide independent value-added examination and analysis of the activities of the thirteen Colleges and the System Office. Internal Audit also performs required federal, state, and other audits and monitoring reviews of the recipients of Colorado Technical Act and Perkins funds.

Standards for the Professional Practice of Internal Auditing

The Internal Audit department will govern itself by adherence to the mandatory elements of the Institute of Internal Auditors’ (IIAs’) International Professional Practices Framework which are the Global Internal Audit Standards and Topical Requirements. The Director of Internal Audit will report periodically to senior management and the Audit Committee regarding the Internal Audit department’s conformance with the Standards, which will be assessed through a quality assurance and improvement program.

Mandate

The SBCCOE empowers the Internal Audit function to provide the Board and senior management with objective assurance, advice, insight, and foresight regarding all areas within the SBCCOE’s legal authority. The Internal Audit function will carry out this mandate by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of governance, risk management, and control processes throughout the organization.

Authority

The Audit Committee grants the Internal Audit function the mandate to provide the SBCCOE and senior management with objective assurance, advice, insight, and foresight.

The Director of Internal Audit will have unrestricted access to, and communicate and interact directly with, the Audit Committee, including in private meetings without management present.

The Audit Committee authorizes the Internal Audit department to:

  • Have full, free, and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out any engagement, subject to accountability for confidentiality and safeguarding of records and information.
  • Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques, and issue communications required to accomplish the function’s objectives.
  • Obtain assistance from the necessary personnel of CCCS, as well as other specialized services from within or outside CCCS, in order to complete Internal Audit services.

The Internal Audit function does not have authority over the Foundations or the Career and Technical Student Organizations as those entities are separate 501(c)(3) organizations.

Independence, Organizational Position, and Reporting Relationships

The Director of Internal Audit will be positioned at a level in the organization that enables Internal Audit services and responsibilities to be performed without interference from management (see “Mandate” section), thereby establishing the independence of the Internal Audit function. The Director of Internal Audit will report functionally to the Audit Committee and administratively (e.g., day-to-day operations) to the Vice Chancellor for Finance and Administration. This positioning provides the organizational authority and status to bring matters directly to senior management and escalate matters to the Board, when necessary, without interference, and supports the internal auditors’ ability to maintain objectivity.

The Director of Internal Audit will confirm to the Audit Committee at least annually, the organizational independence of the Internal Audit department. If the governance structure does not support organizational independence, the chief audit executive will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The Director of Internal Audit will disclose to the Audit Committee interference and related implications in determining the scope of internal auditing, performing work, and/or communicating results. The disclosure will include communicating the implications of such interference on the Internal Audit function’s effectiveness and ability to fulfill its mandate.

Changes to the Mandate and Charter

Circumstances may justify a follow-up discussion between the chief audit executive, Board, and senior management on the Internal Audit mandate or other aspects of the Internal Audit Charter. Such circumstances may include, but are not limited to:

  • A significant change in the Global Internal Audit Standards.
  • A significant reorganization within the organization.
  • Significant changes in the Internal Audit Director, SBCCOE, and/or senior management positions.
  • Significant changes to the organization’s strategies, objectives, risk profile, or the environment in which the organization operates.
  • New laws or regulations that may affect the nature and/or scope of Internal Audit services.

Scope and Types of Internal Audit Services

The scope of Internal Audit services covers the entire breadth of the organization, including all of CCCS’s activities, assets, and personnel. The scope of Internal Audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Board and management on the adequacy and effectiveness of governance, risk management, and control processes for CCCS.

Board Policy and System Procedure 9-73, Monitoring of State and Federal Programs, outlines the Internal Audit department’s responsibilities related to career and technical education monitoring responsibilities.

The nature and scope of advisory services may be agreed with the party requesting the service, provided the Internal Audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management.

Internal Audit assessments include evaluating whether:

  • Risks relating to the achievement of CCCS’s strategic objectives are appropriately identified and managed.
  • The actions of CCCS’s officers, directors, management, employees, and contractors are in compliance with CCCS’s policies, procedures, and applicable laws, regulations, and governance standards.
  • The results of operations or programs are consistent with established goals and objectives.
  • Operations or programs are being carried out effectively, efficiently, ethically and equitably.
  • Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact CCCS.
  • The integrity of information and the means used to identify, measure, analyze, classify, and report such information is reliable.
  • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately.

Responsibility

Ethics and Professionalism:
The Internal Audit Director will ensure that internal auditors:

  • Conform with the Global Internal Audit Standards, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality.
  • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organization and be able to recognize conduct that is contrary to those expectations.
  • Encourage and promote an ethics-based culture in the organization.
  • Report organizational behavior that is inconsistent with the organization’s ethical expectations, as described in applicable policies and procedures.

Objectivity:
The Director of Internal Audit will ensure that the Internal Audit department remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of audit selection, scope, procedures, frequency, timing, and communication. If the Director of Internal Audit determines that independence or objectivity may be impaired in fact or appearance, the details of impairment will be disclosed to appropriate parties.

Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively and in such a manner that they believe in their work product, that no quality compromises are made, and that they do not subordinate their judgment on audit matters to others, in fact or in appearance.

Internal auditors will have no direct operational responsibility or authority over any of the activities audited or reviewed. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, prepare records, or engage in any other activity that may impair their judgment, including:

  • Assessing specific operations for which they had responsibility within the previous year.
  • Performing any operational duties for CCCS or its affiliates.
  • Initiating or approving transactions external to the Internal Audit department.
  • Directing the activities of any CCCS employee not employed by the Internal Audit department, except to the extent that such employees have been appropriately assigned to auditing teams or to otherwise assist internal auditors.

Where the Director of Internal Audit has or is expected to have roles and/or responsibilities that fall outside of internal auditing, safeguards will be established to limit impairments to independence or objectivity.

Internal auditors will:

  • Disclose any impairment of independence or objectivity, in fact or appearance, to appropriate parties, such as the Director of Internal Audit, the Audit Committee, management, or others, at least annually.
  • Exhibit professional objectivity in gathering, evaluating, and communicating information.
  • Make balanced assessments of all available and relevant facts and circumstances.
  • Take necessary precautions to avoid being conflicts of interest, bias, and undue influence.

Managing the Internal Audit Function:
The Director of Internal Audit has the responsibility to:

  • Submit, at least annually, to senior management and the Audit Committee a risk-based internal audit plan for review and approval.
  • Communicate to senior management and the Audit Committee the impact of resource limitations on the Internal Audit plan.
  • Review and adjust the Internal Audit plan, as necessary, in response to changes in CCCS’s business, risks, operations, programs, systems, and controls.
  • Communicate to senior management and the Audit Committee any significant interim changes to the Internal Audit plan.
  • Ensure Internal Audit engagements are performed, documented, and communicated in accordance with the Global Audit Standards.
  • Follow up on engagement findings and corrective actions, and report periodically to senior management and the Audit Committee any corrective actions not effectively implemented.
  • Ensure the Internal Audit department collectively possesses or obtains the knowledge, skills, and other competencies needed to meet the requirements of the Global Internal Audit Standards and fulfill the mandate.
  • Identify and ensure trends and emerging issues that could impact CCCS are considered and communicated to senior management and the Audit Committee as appropriate.
  • Ensure emerging trends and successful practices in internal auditing are considered.
  • Establish and ensure adherence to methodologies designed to guide the Internal Audit department.
  • Ensure adherence to CCCS’s relevant policies and procedures unless such policies and procedures conflict with the Global Internal Audit Standards. Any such conflicts will be resolved or otherwise communicated to senior management and the Audit Committee.
  • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the Director of Internal Audit cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and, if necessary, escalated to the Board.

Communication with the Board and Senior Management:
The Director of Internal Audit will report periodically to senior management and the Audit Committee regarding:

  • The Internal Audit function’s mandate.
  • The Internal Audit department’s plan and performance relative to its plan.
  • Internal Audit budget.
  • Significant revisions to the Internal Audit plan and budget.
  • Potential impairments to independence, including relevant disclosures as applicable.
  • Results from the quality assurance and improvement program, which include the Internal Audit function’s conformance with the IIA’s Global Audit Standards and action plans to address the Internal Audit function’s deficiencies and opportunities for improvement.
  • Significant risk exposures and control issues, including fraud risks, governance issues, and other matters requiring the attention of, or requested by, the Audit Committee.
  • Results of assurance and advisory services.
  • Resource requirements.
  • Management’s responses to risk that the Internal Audit function determines may be unacceptable or acceptance of a risk that is beyond CCCS’s risk appetite.

Quality Assurance and Improvement Program

The Director of Internal Audit will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the Internal Audit function. The program will include external and internal assessments of the Internal Audit function’s conformance with the Global Internal Audit Standards, as well as performance measurement to assess the Internal Audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program also will assess, if applicable, compliance with laws and/or regulations relevant to internal auditing. Also, if applicable, the assessment will include plans to address the Internal Audit function’s deficiencies and opportunities for improvement.

Annually, the Director of Internal Audit will communicate with the Board and senior management about the Internal Audit function’s quality assurance and improvement program, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside CCCS; qualifications must include at least one assessor holding an active Certified Internal Auditor credential.