Oregon’s latest “Annual report of statewide internal audit activities” might be a perfect sleep aid. But that annual report is a really good idea.
That is, it’s a really good idea if it’s done right.
Big state agencies in Oregon are basically required by law to take a hard, objective look at themselves every year and figure out what they might need to do better. It could lead to improvement in government. And the audits improve transparency. They give Oregonians a window into how government agencies are doing.
This year, the executive summary of the report is packed with good news. Agencies completed 56 audits. Three agencies got top marks from “external quality reviews.” Fully 21 of the state internal auditors hold advanced degrees. And the highlight reel goes on with more.
Read just that executive summary and it seems like it’s going great. Dig deeper, though, and the state actually met only one of its goals for internal audits. Some agencies didn’t even do them. There are, of course, excuses for not doing them. There always are.
One goal is that 100% of state agencies comply with ORS 184.360. That’s the state law that requires internal audits. The state didn’t hit it.
Only 79% of the required agencies produced a risk assessment of the agency that conforms to national standards.
Only 72% completed at least one audit per year based on its annual report.
Only 69% completed a governance or risk management audit in the last five years.
The state also aims for a goal that 75% of state agencies complete an annual audit plan each year. Only 55% of agencies did.
The state’s final two goals for internal audits have to do with using audits to improve government. One is that agencies do surveys after an audit to figure out ways to improve how they do audits. Only 83% did.
We had to chuckle when we saw the one goal that the state achieved. It’s related to that last goal of conducting surveys after an audit. The state hopes that at least 90% of survey responses affirmatively state that the audit provided value to the organization. Fully 100% percent believed the audit work had value — now if only more agencies would actually do the audits as required.
If this report is to be truly useful, shouldn’t the executive summary highlight that actually, year after year, many state agencies don’t get these audits done? Shouldn’t there be a brief summary about what each internal audit did find?