Mr. Vernon M. Arrell Commissioner Texas Rehabilitation Commission 4900 North Lamar Blvd. Austin, Texas 78751-2316
Re: Applicability of the provisions of the Texas Internal Auditing Act, article 6252-5d, V.T.C.S., to the Texas Rehabilitation Commission (RQ-1869)
Dear Mr. Arrell:
You ask several questions about the application of the Texas Internal Auditing Act [hereinafter the act]. V.T.C.S. art. 6252-5d. The legislature passed the act in May 1989, and it became effective September 1, 1989. H.B. 2728, Acts 1989, 71st Leg., ch. 787, at 3568.
You first ask whether an agency may have an internal audit program different from the program described in the act as long as the agency's program reflects the intent of the act. Section 2 of the act provides in part:
The purpose of this Act is to establish guidelines for a program of internal auditing to assist agency administrators by furnishing independent analyses . . . of performance in carrying out assigned responsibilities.
You suggest that the use of the word "guidelines" in section 2 indicates the legislature did not intend to make the provisions of the act mandatory.
We disagree. Read as a whole, the act unambiguously indicates that the legislature intended an agency covered by the act to establish and maintain a program that conforms to the requirements of the act. In contrast to section 2, which merely states the general purpose of the act, the sections of the act that describe in detail the internal auditing program and its functions contain mandatory language. For instance, section 4 states that each agency "shall establish a full-time program of internal auditing which shall include" an annual audit plan and audits of various systems and controls. Section 5 provides that an internal auditor shall be appointed, while section 6 lists the required duties of that auditor. Section 8 and 9 also contain mandatory language. Section 8 states that the program "shall conform" to various professional standards, and section 9 requires the state auditor to provide technical assistance and training opportunities to agency internal auditors.
Given the legislature's dominant use of mandatory language in the implementing sections of the act and the detailed requirements in the act for the program and needed personnel, we believe that a court would conclude that an agency covered by the act must establish and maintain a program that complies with the terms of the act as well as its intent. Construing the act as mandatory is also consistent with a dictionary definition of "guideline" as an indication of future conduct. See Webster's Third New International Dictionary of the English Language (Unabridged) 1009 (1969); see also Board of Educ. v. School Comm. of Amesbury,452 N.E.2d 302, 306 (Mass.App.Ct. 1983) ("guideline" implies some instruction for future conduct); Gov't Code § 312.002(a) (words shall generally be given their ordinary meaning). The narrow and detailed "guidelines" described above are mandatory and are drafted to ensure agency action that complies with the act. Finally, construing the act as mandatory on or after its effective date is consistent with the 1988 legislative interim report that recommended passage of legislation requiring certain agencies to establish internal auditing programs with appropriate personnel and independence. See Governor's Task Force, Findings and Recommendations of the Accounting, Auditing and Financial Reporting Task Force 5, 10-11 (December 1988); see also Office of the State Auditor, Statewide Report on Internal Auditing: A Report to the Legislative Audit Committee 3-4 (May 1988) (major state agencies should establish internal audit programs).
You next ask whether an agency must appoint a certified public accountant (CPA) or certified internal auditor (CIA) as the internal auditor if the position is occupied by an individual who is neither a CPA nor a CIA. Section 5 of the act provides as follows:
The governing board of an agency or its designee, or the administrator of an agency without a governing board, shall appoint an internal auditor, who shall be either a certified public accountant or a certified internal auditor and who shall have at least three years of auditing experience. The agency shall employ such additional professional and support staff as the agency administrator determines are necessary to implement an effective program of internal auditing.
You have not mentioned and we are unaware of any other state statute describing the qualifications of an agency internal auditor, and thus we interpret your question as meaning whether your agency must appoint a CPA or CIA to perform the duties imposed on an internal auditor by the act.
Neither the terms of the act nor the legislative history of the act indicate whether individuals employed as internal auditors for state agencies who are not CPAs or CIAs should continue in employment as state internal auditors after the effective date of the act. The effective date clause states only that the act takes effect on September 1, 1989. We interpret the absence of legislative guidance on this issue as an indication that state agencies may continue such individuals in their employ on the internal audit staff unless otherwise prohibited. Nevertheless, section 5 of the act does require a covered state agency to appoint a CPA or CIA as the internal auditor, and other sections of the act require that certified auditor to carry out the responsibilities of the act. In particular, the certified auditor must develop the agency's annual audit plan and conduct agency audits in accordance with the annual plan. V.T.C.S. art. 6252-5d, § 6(2)-(3). Additional professional and support staff may be employed as deemed necessary by the agency administrator to implement the required internal audit program. Id. § 5. Thus, while an agency may continue in its employ as an internal auditor an individual who is neither a CPA nor a CIA as of September 1, 1989, neither the agency, its designee, nor the agency administrator of an agency without a governing board may appoint that individual as the internal auditor to carry out the requirements of the act.
Your third question concerns section 6(1) of the act. Section 6(1) of the act requires the internal auditor to report directly to the agency's governing board or to the commission. You ask whether section 6(1) is consistent with other laws and regulations governing the operation of state agencies. You do not provide us with any instances of inconsistency; nor were we able to find any in the statutes applicable to internal audits of the Texas Rehabilitation Commission. See, e.g., Gov't Code §§321.005, 321.013, 321.0131-321.0136; Hum.Res. Code §§ 111.001-111.058; V.T.C.S. art. 4348e. Section 111.018 of the Human Resources Code requires the commissioner of the Texas Rehabilitation Commission to make regulations governing personnel standards and to develop a career ladder program. Section 111.020 requires the commissioner to appoint the personnel needed to carry out agency functions. Neither of those sections, however, conflicts on the surface with section 6(1) of the act. Those sections merely enable the commissioner to supervise and promote the personnel required to do agency work, while the act authorizes an internal auditor to conduct independent reviews of the work performed by such personnel to ensure that the work is performed economically and efficiently.1
Your last question concerns section 6(6) of the act. Section 6(6) provides that the internal auditor shall be free of any operational or management responsibility that would impair the independent review of the agency's operations. You ask whether management or the internal auditor alone or both together are to decide when compliance with a particular responsibility would impair the auditor's independence. In the case of the Texas Rehabilitation Commission, we construe your reference to management to mean the agency's commissioner as well as deputy or assistant commissioners or other executive administrators. Acts 1989, 71st Leg., ch. 1263, art. II-68, at 5503 (provisions of the General Appropriations Act concerning the commission's key administrators).
Section 7 of the act states that the internal auditor "may consult with the agency's governing board or commission, the governor's office, the state auditor, and other legislative agencies or committees concerning matters affecting duties and responsibilities under this Act." Section 6(6) of the act describes as one of the internal auditor's duties the obligation to be free of certain responsibilities that would impair the independent review of agency operations.
Significantly absent from the list in section 7 is the agency administrator who is defined in the act as the executive head of the agency. V.T.C.S. art. 6252-5d, § 3(2). We conclude from this absence first, that the agency's commissioner and deputies or assistants may not decide when the internal auditor's compliance with an operational or a management responsibility would impair the independent review of agency operations and second, that the internal auditor may not consult with those individuals in making that determination.2 The independent auditor may, if he chooses, consult with the entities listed in section 7 of the act in making the determination, but the auditor is not required by that section to do so.3 This construction of the act effectuates the primary purpose of the act: the provision of unbiased reports to the agency's governing board or commission about all agency work, including the work performed by the agency's executive personnel. See V.T.C.S. art. 6252-5d, §§ 2 (purpose is to furnish independent analyses), 4(2) (requirement for audits of administrative systems and controls), 6(6) (requirement for independent reviews of all agency operations); see also Statewide Report on Internal Auditing: A Report to the Legislative Audit Committee 11-12 (internal audit groups should be located outside of the management functions subject to audit so that organizational status enhances independence).
SUMMARY The provisions of the Texas Internal Auditing Act are mandatory. The internal auditor appointed by an agency to carry out the act must be a certified public accountant or certified internal auditor. That auditor shall report directly to the agency's governing board or commission. That auditor is also not required to consult with the executive head of the agency to determine when compliance with a particular responsibility would impair the independent review of agency operations. Instead, the auditor may make the decision alone or consult with the agency's governing board or commission or certain other entities outside the agency.
Very truly yours,
Jim Mattox Attorney General of Texas
Mary Keller First Assistant Attorney General
Lou McCreary Executive Assistant Attorney General
Judge Zollie Steakley Special Assistant Attorney General
Renea Hicks Special Assistant Attorney General
Rick Gilpin Chairman Opinion Committee
Prepared by Celeste A. Baker Assistant Attorney General
1 You do not pose nor do we address a situation in which a particular personnel standard conflicts with the duties imposed by the act on the internal auditor. Furthermore, if a situation of conflict does arise that concerns an operational or management responsibility described in section 6(6) of the act, the internal auditor may choose to consult with the entities listed in section 7 of the act.
2 The governing board of the Texas Rehabilitation Commission is composed of six members appointed by the governor. Hum.Res. Code § 1111.013. Our conclusion therefore is limited to multi-member boards and commissions composed of appointed members, and we do not address the situation of an agency overseen by a single appointed or elected official or by a board or commission of elected officials.
3 Section 8 of the act suggests that the internal auditor in making this determination may use various professional standards and codes, including the Certified Internal Auditor Code of Professional Ethics and the Standards for the Professional Practice of Internal Auditing.