Government internal audit answers to the public rather than to shareholders, publishes what it finds, works under standards that carry the force of law and audits an organization whose purpose is service rather than profit. Those differences change the job more than the vocabulary suggests. The auditor’s findings appear in newspapers and council meetings; the standards prescribe continuing education hours and peer reviews; the risk universe includes a jail, a water system, a pension fund, an election office and a snowplow fleet; the money being protected belongs to taxpayers and grantors who attach conditions to every dollar; and independence must be defended against elected officials who appointed the auditor and may not enjoy the report. It is, by most practitioners’ account, the most varied internal audit job there is, and the one with the clearest public purpose.
This guide explains how the function works across the public sector: why government audit is different, the audit bodies, the standards and frameworks, the performance audit as the signature engagement, the risk universe of a government, independence and the politics around it, fraud, waste and abuse programs, what the governing body and the public see, careers and pay, the failures that recur, and a worked example from Pemberton County, the county government used in the public-sector examples on this site. The Yellow Book vs IIA Standards guide maps the two standards frameworks a government auditor works under, and the higher education and nonprofits guide covers the grant-funded institutions that share much of this environment.
In this guide
- Why government internal audit is different
- Who audits government: the public-sector audit bodies
- Standards and frameworks
- The performance audit: the signature engagement
- The risk universe of a government
- Grants, the Single Audit and federal funds
- Public procurement
- Independence and the politics around it
- Fraud, waste and abuse programs
- What the governing body and the public see
- Careers and pay in government internal audit
- Failures that recur
- A worked example: Pemberton County’s FY26 audit year
- Questions about internal audit in government
- Related guides
Why government internal audit is different
Six features shape the function. Accountability runs to the public: the governing body is elected, meetings and records are open by law, reports are published, and the auditor’s work is a public good rather than a management service, which changes how findings are written and how management responds. Standards have legal force: the Yellow Book is required by statute, charter or funding condition for most government audit organizations, with prescribed independence documentation, continuing education and triennial peer review, and the IIA’s Standards sit alongside for functions that adopt them. Money arrives with conditions: taxes must be levied and spent according to law, federal and state grants carry allowable cost rules, matching requirements and reporting, bonds carry covenants and tax law, and fees for enterprise services (water, parking, permits) must be set and used within statute. Service is the product: effectiveness and efficiency, not profit, are the objectives, so the performance audit (did the program achieve its purpose at reasonable cost?) is the central engagement and criteria must often be constructed from law, policy and benchmarks rather than read from a standard. Independence is structural and political: the auditor is appointed by, and reports to, elected officials or their appointees, and the protections (term, removal only for cause, budget set by the governing body) are written into ordinances and charters because they are tested. Resources are constrained and visible: audit budgets are line items debated in public, staff are paid on civil service scales, and the function is expected to recover more than it costs. The internal audit beyond banks guide covers the broader non-financial-services context.
Who audits government: the public-sector audit bodies
| Body | Who they are | Mandate and standards | Relationship to internal audit |
|---|---|---|---|
| Federal inspectors general | Statutory offices in federal departments and agencies under the Inspector General Act of 1978, coordinated by the Council of the Inspectors General on Integrity and Efficiency (CIGIE) | Audits, inspections, evaluations and investigations of their agencies’ programs; report to the agency head and Congress; follow GAGAS and CIGIE’s quality standards; semiannual reports to Congress | The federal equivalent of internal audit with investigative powers and statutory independence; agency management control programs under OMB Circular A-123 are the first and second line they assess |
| Government Accountability Office | Congress’s audit arm, headed by the Comptroller General | Audits and evaluations of federal programs for Congress; issues the Yellow Book and the Green Book; the federal consolidated financial statement audit | Standard-setter; external auditor of the federal government |
| State auditors and legislative audit offices | Elected or appointed state auditors; legislative audit bureaus or committees | Financial audits of the state and its units; performance audits of state programs; Single Audits; oversight of local governments in many states; GAGAS | External to state agencies; agency internal audit units report to agency heads and coordinate with them |
| Agency internal audit units (federal and state) | Internal audit functions inside departments, authorities and enterprises | Management-facing internal audit; GAGAS or IIA Standards or both; A-123 internal control assessments at the federal level | Internal audit proper; independence depends on reporting lines within the agency |
| County and city auditors | Charter or ordinance offices, appointed by the council or board or elected; the Association of Local Government Auditors (ALGA) is their professional body and peer review program | Performance and compliance audits of local government operations; sometimes financial pre-audit or payment approval functions (a conflict the profession has worked to remove); GAGAS by charter in most | Internal audit with a public face; Pemberton County’s office is one |
| School district, transit, utility and special district auditors | Internal audit functions in large special-purpose governments | As above, with sector regulation (education funding formulas, Federal Transit Administration requirements, utility rate regulation) | Internal audit with sector programs in the universe |
| Supreme audit institutions abroad (UK National Audit Office; Canada’s Auditor General; Australia’s ANAO; the European Court of Auditors) | National external auditors under INTOSAI standards | Financial and performance audit of national governments | External; national internal audit standards (the UK’s public sector internal audit standards, aligned to the IIA’s framework) govern internal audit units |
Standards and frameworks
Government auditors work with a shelf of documents that corporate auditors never open. The Yellow Book (GAO’s Government Auditing Standards, 2024 revision, effective for periods beginning on or after 15 December 2025) sets the standards for financial, attestation and performance audits, with independence, competence (80 hours of continuing education every two years, 24 in government subjects), a system of quality management and triennial peer review; the Yellow Book vs IIA Standards guide maps it to the Global Internal Audit Standards, which many government functions follow alongside. The Green Book (GAO’s Standards for Internal Control in the Federal Government, 2025 revision effective fiscal year 2026, adapting COSO’s five components and seventeen principles with new emphasis on fraud risk, improper payments and information security) is the internal control framework federal agencies must follow and many state and local governments adopt; it is the criteria document for most control findings. OMB Circular A-123 requires federal agencies to establish, assess and report on internal control (the Federal Managers’ Financial Integrity Act assurance statement), with appendices on financial reporting controls, payment integrity and enterprise risk management. The Uniform Guidance (2 CFR 200) governs federal grants, and its Single Audit requirement (for entities expending $1,000,000 or more of federal awards in a fiscal year, raised from $750,000 for fiscal years beginning on or after 1 October 2024) produces the annual compliance audit every grant-funded government undergoes. Accounting standards come from GASB for state and local governments (fund accounting, modified accrual, the government-wide statements, pension and OPEB liabilities under Statements 68 and 75, leases under 87, subscription-based IT under 96) and FASAB for the federal government. State law adds procurement codes, public records and open meetings acts, budget law, ethics statutes and local government audit requirements. The function’s methodology must cite the right criteria for each engagement, and a planning memo in government names the law before it names the risk; the operational audit criteria guide covers constructing criteria where none is written.
The performance audit: the signature engagement
A performance audit, in the Yellow Book’s definition, provides objective analysis, findings and conclusions to assist management and those charged with governance in improving program performance and operations, reducing costs, facilitating decision making and contributing to public accountability. Its objectives are chosen by the auditor and range across program effectiveness (is the program achieving its intended results?), economy and efficiency (at what cost, with what productivity, compared with what?), internal control (are the controls that should assure results in place and working?), compliance (are legal requirements met?) and prospective analysis (what would a proposed change do?). It differs from the corporate internal audit’s process review in three ways: the criteria are often constructed (from law, policy, professional standards, benchmarks of comparable governments and the program’s own stated goals) rather than read from a control framework; the evidence is often outcome data (wait times, case closures, cost per unit, condition ratings) gathered and analyzed by the auditors rather than control evidence supplied by management; and the report is public and must be written for a reader who is a citizen and a council member rather than a controller. The method is otherwise familiar (objectives, scope and methodology; a risk-based plan; sufficient appropriate evidence; findings with criteria, condition, cause and effect; recommendations and management’s response), and the operational audit criteria, audit evidence and 5 Cs guides apply directly. A performance audit of a permitting office, a jail medical contract or a street maintenance program typically runs 600 to 1,500 hours, includes data analysis and site observation, and produces a report of twenty to forty pages with an executive summary a reporter can quote accurately.
| Dimension | Corporate process audit | Government performance audit |
|---|---|---|
| Question | Are the controls over this process designed and operating? | Is this program achieving its purpose, at reasonable cost, within the law? |
| Criteria | Control frameworks, policies, the process design | Constructed: statute and ordinance, policy, professional standards, benchmarks of comparable governments, the program’s stated goals |
| Evidence | Control evidence supplied by management; samples of transactions | Outcome and operating data gathered and analyzed by the auditors; observation; surveys; samples |
| Standards | IIA Standards | Yellow Book chapters 8 and 9, often with the IIA Standards alongside |
| Report | Internal; to management and the audit committee | Public; to the governing body, the press and residents, with management’s response and a methodology section |
| Typical size | 200 to 600 hours | 600 to 1,500 hours |
| Follow-up | Issue tracking; validation | Published annual follow-up report on every recommendation |
The risk universe of a government
| Area | Representative entities (Pemberton County, 94 in total) | Why it matters |
|---|---|---|
| Revenue (9) | Property tax assessment and collection; sales and use tax distributions; fees and permits (building, health, recreation); fines and court collections; utility billing (water and sewer enterprise fund); grant revenue; investment of idle funds; cash handling at 31 collection points; delinquent accounts | Public money collected by many hands; equity and legality of charges; cash theft |
| Procurement and contracts (8) | Procurement code compliance and competitive bidding; contract administration and change orders; purchasing cards (1,100 cards); construction contracts; professional services; cooperative purchasing; vendor master; disadvantaged business programs | The largest fraud and legal exposure; bid protests; public scrutiny |
| Grants and federal funds (7) | Grants management and the Schedule of Expenditures of Federal Awards; subrecipient monitoring; allowable costs and time and effort; federal disaster assistance (FEMA) reimbursements; state pass-through programs; housing and community development funds; grant closeouts | Conditions on every dollar; Single Audit findings; repayment risk |
| People and pensions (8) | Payroll for 4,200 employees; overtime and shift differentials (sheriff, fire, public works); timekeeping; pension plan contributions and reporting; retiree health (OPEB); workers’ compensation; hiring and classification; separation and leave payouts | The largest expense; collective bargaining rules; unfunded liabilities |
| Programs and services (18) | Jail operations and the medical services contract; sheriff’s evidence and property room; courts and probation fees; public health clinics; social services eligibility and benefits; child welfare contracts; permitting and inspections; parks and recreation; libraries; elections administration; animal services; veterans services; emergency management; public defender; solid waste; transit contract; housing authority relationship; 911 dispatch | The county’s purpose; performance audit subjects; vulnerable populations |
| Infrastructure and assets (10) | Capital improvement program and construction; road and bridge maintenance; fleet (1,400 vehicles); facilities; water and sewer utility operations; real property and leases; fuel; inventory of materials; asset condition assessment; bond proceeds and covenants | Long-lived assets; deferred maintenance; large contracts |
| Technology (12) | Cybersecurity program; identity and access; ERP and financial systems; public safety systems; election systems security; data privacy and public records technology; disaster recovery; vendor technology; GIS and data; payment systems (PCI); email and records retention; AI use | Local governments are prime ransomware targets; continuity of essential services |
| Governance and administration (22) | Budget development and monitoring; financial reporting (GASB) and the external audit; debt management; internal control program (Green Book adoption); ethics and conflicts of interest; public records and open meetings compliance; risk management and insurance; legal and claims; fraud, waste and abuse hotline; board and committee governance; strategic plan; performance measurement; emergency procurement authority; interlocal agreements; component units; the audit office’s own quality program; and others | The control environment; transparency obligations; the audit office itself |
Grants, the Single Audit and federal funds
Federal and state grants fund a large share of what local governments do (public health, housing, transportation, social services, disaster recovery), and every dollar carries the Uniform Guidance’s conditions: allowable costs (necessary, reasonable, allocable, consistently treated, adequately documented, with specific prohibitions), procurement standards for grant-funded purchases, time and effort documentation for personnel charged to awards, equipment and property management (with the capitalization threshold at $10,000 since the 2024 revision), subrecipient monitoring (risk assessment, agreements with required terms, monitoring and audit follow-up of every subrecipient), financial and performance reporting on time, matching and program income rules, and closeout. The Single Audit, performed by the external auditor under GAGAS and the Uniform Guidance’s Subpart F, tests compliance with these requirements for major programs each year and reports findings that go to the federal clearinghouse, where grantors read them. Internal audit’s grants work prevents those findings: a grants management audit tests the grants inventory’s completeness against the Schedule of Expenditures of Federal Awards and the ledger, the allowable cost controls for a sample of charges, time and effort documentation, subrecipient monitoring evidence, reporting timeliness, and closeouts; program-specific audits follow the money into the program (a housing voucher program’s eligibility files; a disaster assistance project’s documentation for FEMA reimbursement, which is the area where governments most often lose money by failing to document costs the way FEMA requires). The higher education and nonprofits guide covers the same rules in institutions where research grants dominate.
Public procurement
Public procurement is governed by law (state procurement codes, local ordinances, federal standards for grant-funded buys) whose purpose is fairness and transparency as much as value: competitive sealed bidding or proposals above thresholds, public notice, documented evaluation, award to the lowest responsive and responsible bidder or the best-value proposal under published criteria, protest rights, and limits on sole-source and emergency purchases. The audit tests compliance with each step for a sample of solicitations, the use of exceptions (sole source, emergency, cooperative contracts, piggybacking) and their justifications, threshold splitting, contract administration after award (scope, change orders, performance, payment against contract terms), purchasing card programs (where the common finding is personal and split purchases with weak review), vendor master integrity, conflicts of interest and ethics disclosures by officials and evaluators, disadvantaged and local business preference programs, and the construction contracts that dominate capital spending (the capital projects guide). Procurement is also where government fraud concentrates (bid rigging, kickbacks, conflicts, phantom vendors), and the analytics in the procurement fraud analytics guide apply with the public records of vendor ownership as an added data source. The procurement and purchasing cards guides give the general programs.
Independence and the politics around it
A government auditor’s independence is designed into law because it will be tested. The structural protections that work: appointment by the governing body (the council, board or legislature) rather than by the executive, for a fixed term with removal only for cause by a supermajority; a budget set by the governing body and protected from executive reduction; an audit committee of the governing body with public members who bring financial expertise and continuity across election cycles; access rights to all records and personnel written into the ordinance or charter; a plan approved by the committee and published; and the authority to publish reports without executive approval. GAGAS’s structural threat analysis recognizes these arrangements, and the Yellow Book vs IIA Standards guide maps them to the Standards’ functional reporting. The threats that remain are political: a mayor or administrator who wants a report delayed past an election, a council member who wants an audit of a rival’s department, pressure to soften language about a popular program, and the quieter pressure of budget time. The defenses are the ordinance, the committee, a risk-based plan the auditor can point to, consistent public reporting (every report published on the same terms), and the professional discipline of writing findings that are evidenced and plain. The independence and objectivity guide covers the principles and the audit charter guide the public-sector charter clauses.
Fraud, waste and abuse programs
Most government audit offices run or oversee a fraud, waste and abuse hotline, which is both a source of audit work and an engagement subject. Running it well means intake through multiple channels with anonymity protected, triage against defined criteria (fraud and abuse to investigation; waste and inefficiency to audit planning; personnel grievances to human resources), a case management system with documentation standards, coordination with law enforcement and the district attorney where crimes are indicated (and with the inspector general where one exists), whistleblower protection under state law, public reporting of statistics and outcomes, and a feedback loop into the risk assessment. Governments also carry a fraud risk that corporate auditors rarely meet: improper payments in benefit and reimbursement programs (eligibility errors, duplicate payments, payments to deceased or ineligible recipients), which the Green Book’s 2025 revision made an explicit internal control concern and which data matching (death records, incarceration records, other benefit rolls, vendor and employee overlaps) detects efficiently. The fraud risk assessment, first 48 hours and fraud red flags guides cover the general discipline; the public-sector additions are the legal referral obligations and the publicity.
What the governing body and the public see
Government audit reports are public documents, usually posted on the audit office’s website and presented at a public meeting of the audit committee or governing body, with management’s written response included as GAGAS requires. That audience shapes the writing: an executive summary in plain language that a resident can read and a reporter can quote accurately; findings with the criteria (the law or policy), the condition (what the auditors found, with numbers), the cause and the effect in terms of public money or service; recommendations that are specific enough to track; and management’s response, with the auditor’s rejoinder where management disagrees. The audit committee receives the plan, the reports, the follow-up status (most offices publish an annual follow-up report on the implementation of prior recommendations, which is often the most read document they produce), the office’s performance measures and the peer review results; the full governing body receives the summaries and the annual report. The anatomy of an internal audit report and executive summary guides cover the craft, and the evaluating management responses guide the handling of disagreement, which in government happens in public.
Careers and pay in government internal audit
Government audit offices hire accountants and auditors like every sector and add public administration graduates, policy analysts, data analysts and former program staff who understand the services being audited; the CIA, CPA and CFE are the common credentials, with the Certified Government Auditing Professional (CGAP) and the Certified Government Financial Manager (CGFM) as the sector’s own, and the Yellow Book’s continuing education requirements shaping every auditor’s training year. Pay follows civil service scales: below the private sector at the entry and senior levels (the salary guide‘s government figures sit 10 to 20 percent under the general market), closer at the manager level in large jurisdictions, with defined-benefit pensions, job security and predictable hours as the offset, and with the elected or appointed head of a large audit office paid as a senior executive. Career paths run upward within audit offices (staff auditor to senior to supervisor to deputy to county or city auditor), across to other governments and to state audit offices, into program management and finance leadership within the government, and to the inspector general community at the federal level. The work’s public purpose and variety are the recruiting pitch, and the is internal audit a good career guide’s argument applies with the added point that a government auditor’s reports can change how a community is served.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Independence on paper only | Auditor appointed by the administrator; reports cleared before release; budget cut after a critical report | Ordinance protections; audit committee with public members; publication authority |
| Pre-audit and payment approval duties | The audit office approves payments it later audits | Separate the control function; GAGAS’s management participation threat |
| Compliance without performance | Every audit asks whether rules were followed; none asks whether the program worked | Performance audits with outcome data in the plan |
| Grants audited only by the Single Audit | Repeat Single Audit findings; FEMA reimbursements denied for documentation | Grants management and program audits before the external auditor arrives |
| Follow-up unpublished | Recommendations accepted and never implemented | Annual public follow-up report |
| Cyber treated as IT’s problem | Ransomware shuts services; backups unrecoverable | Cybersecurity and recovery in the universe as High; recovery tests observed |
| Cash handling unaudited at the edges | Theft at a parks counter or a court clerk’s window found by a tip years later | Rotating cash handling audits with surprise counts |
| Political plan | Audits requested by officials displace the risk-based plan | Committee-approved plan with a reserve for requests; requests documented and declined on the record where appropriate |
| Reports written for auditors | Forty pages of methodology; the finding on page 27 | Public-facing executive summaries; plain language |
A worked example: Pemberton County’s FY26 audit year
Pemberton County, the county government used in the public-sector examples on this site, serves about 480,000 residents with a $1.6 billion annual budget and 4,200 employees across a sheriff’s office and jail, courts, public health, social services, public works, a water and sewer utility, parks and the usual administrative departments. Its Office of Internal Audit, created by ordinance in 2014, is headed by a county auditor appointed by the board of county commissioners for a five-year term and removable only by supermajority, reports to an audit committee of three commissioners and two public members, follows both GAGAS and the Global Internal Audit Standards (the Yellow Book vs IIA Standards guide describes the arrangement and the 2026 peer review), and has a staff of nine with a 94-entity universe. The FY26 plan covered 16 entities and the hotline in about 13,000 hours, with 400 hours co-sourced for a cybersecurity assessment, and every report was published and presented in open session.
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| Performance audit: building permit and inspection services (1,300) | Median permit turnaround 41 days against a published 20-day goal, with 34 percent of applications waiting on a single plan reviewer’s queue; inspection scheduling by phone only; fees last reviewed in 2017 and recovering 68 percent of cost against an ordinance requiring full recovery; no performance reporting to the board | Nine recommendations; the department added a reviewer, moved scheduling online and proposed a fee study; the board adopted quarterly performance reporting; local press covered the report |
| Jail medical services contract (900) | $14.2 million annual contract; staffing invoiced at contracted levels while the vendor’s own schedules showed 11 percent of nursing shifts unfilled over the year ($610,000 billed for unfilled hours); required quality reports delivered late in eight of twelve months; no contract monitor assigned | Credit of $610,000 negotiated; staffing verification against schedules added; a contract monitor assigned; the finding referred to the county attorney for the contract’s remedies |
| Grants management and FEMA disaster reimbursements (800) | Grants inventory complete against the ledger; time and effort documentation missing for 6 of 40 sampled personnel charges; a 2024 storm’s debris removal costs ($3.8 million) documented with contractor invoices but without the load tickets and monitoring records FEMA requires for reimbursement | High; documentation reconstructed from contractor and monitor records before the FEMA closeout; a disaster cost documentation procedure adopted; time and effort certifications enforced |
| Purchasing card program (520) | 1,100 cards, $9.4 million spend; analytics found 212 split transactions below the $5,000 limit, 38 purchases from personal-use merchant categories, and 61 cards with no transactions in a year still active; reviewer approvals performed by the cardholder’s subordinate in two departments | Medium; cards canceled; merchant category blocks; approval hierarchy fixed; three cases referred to human resources |
| Cash handling rotation: parks and recreation, animal services, court clerk (600) | Surprise counts reconciled at all nine sites; one recreation center’s deposits lagged collections by up to twelve days with voided transactions unexplained; the court clerk’s system allowed post-receipt edits without a log | Medium; daily deposit enforced; void review; system logging enabled; the recreation center’s prior year transactions reviewed by the sheriff’s financial crimes unit (no theft substantiated; practice corrected) |
| Sheriff’s office overtime (700) | $11.6 million of overtime; 14 deputies with more than 1,000 overtime hours each; one deputy’s overtime and regular hours exceeded 24 in a day on nine dates; court appearance overtime claimed on dates with no docket entry for 23 claims | High; the 23 claims investigated by the sheriff’s professional standards unit; scheduling controls and a fatigue policy adopted under the bargaining agreement |
| Cybersecurity program (co-sourced assessment, 400 plus 300 internal) | Multifactor authentication complete for remote access, incomplete for 14 internal systems including the property tax system; backups of the ERP tested; backups of the jail management system never restore-tested; incident response plan exercised in 2023 | High; MFA roadmap funded; jail system restore tested within the quarter; annual exercise adopted |
| Pension contributions and reporting (380) | Employer and employee contributions remitted accurately and on time; pensionable earnings included a shift differential the plan excluded for one bargaining unit, overstating contributions and benefits for 140 employees | Medium; corrected with the retirement system; prior-year adjustments |
| Fraud, waste and abuse hotline (standing, 500) | 187 contacts; 61 referred to investigation (14 substantiated, including a public works employee selling scrap metal from county projects); 48 to departments; 78 closed as outside scope or unsubstantiated; median triage time four days | Published annual hotline report; the scrap finding led to a scrap sales audit in FY27 |
| Follow-up on prior recommendations (annual, 600) | 112 open recommendations from FY23 to FY25; 71 implemented, 29 in progress, 12 not started, of which 5 were over two years old | Published follow-up report; the 5 oldest escalated to the board with department heads attending |
The county auditor’s annual report to the board summarized the year in public terms: about $1.3 million of credits, recoveries and corrected charges, a permit process residents could now track online, a disaster reimbursement protected, and three referrals to investigation. The audit committee’s public members pressed the administration on the twelve unimplemented recommendations, which was the design working as intended. The Yellow Book vs IIA Standards guide tells how the office satisfies both frameworks, and the capital projects guide covers the construction audits the county’s capital program needs.
Questions about internal audit in government
What does a government internal auditor do?
Audits a government’s programs, finances and operations under the Yellow Book and often the IIA’s Standards: performance audits of services, compliance audits of grants and procurement, cash handling and payroll audits, cybersecurity reviews, contract audits and fraud, waste and abuse investigations, with reports published to the governing body and the public and followed up annually.
What is the difference between an inspector general and internal audit?
Federal inspectors general are statutory offices under the Inspector General Act with audit, evaluation and investigative powers, reporting to the agency head and Congress. Internal audit units inside agencies and local governments are management- or governing-body-facing functions without statutory investigative powers, though many run hotlines and refer cases. Both follow GAGAS; the IIA’s Standards apply to internal audit units that adopt them.
What is a performance audit?
An engagement under the Yellow Book’s chapters 8 and 9 that assesses a program’s effectiveness, economy and efficiency, internal control or compliance against criteria the auditor constructs from law, policy, standards and benchmarks, using outcome data as evidence, and reports publicly with findings, recommendations and management’s response. It is the government auditor’s signature engagement.
How is a government auditor’s independence protected?
By ordinance or charter: appointment by the governing body for a fixed term with removal only for cause, a protected budget, an audit committee with public members, access rights to all records, a committee-approved published plan and the authority to publish reports without executive approval. The Yellow Book’s structural threat analysis and the IIA’s functional reporting requirements both recognize these arrangements.
What is the Single Audit?
The annual audit of federal award compliance required by the Uniform Guidance for entities expending $1,000,000 or more of federal awards in a fiscal year (raised from $750,000 for fiscal years beginning on or after 1 October 2024), performed by the external auditor under GAGAS, with findings reported to the federal clearinghouse. Internal audit’s grants work prevents the findings it would otherwise produce.
How does government internal audit pay compare?
Civil service scales put government auditors 10 to 20 percent below the private sector at entry and senior levels, closer at manager level in large jurisdictions, with defined-benefit pensions, job security and predictable hours as the offset. The head of a large audit office is paid as a senior executive.
Related guides
- Yellow Book vs IIA Standards — the two frameworks mapped, with Pemberton County’s peer review.
- Internal audit in higher education and nonprofits — the grant-funded institutions next door.
- How to audit capital projects and construction — the capital improvement program.
- How to audit procurement — the general program behind public procurement.
- How to audit purchasing cards — the card program.
- Procurement fraud analytics — bid rigging, splitting and vendor matching.
- How to audit payroll — 4,200 employees and their overtime.
- How to audit cash management — collection points and deposits.
- Fraud risk assessment — the public-sector fraud catalog.
- Internal audit finds fraud: the first 48 hours — referral and handling.
- Operational audit criteria — constructing criteria for performance audits.
- Independence and objectivity — the principles behind the ordinance.
- The internal audit charter — public-sector charter clauses.
- Anatomy of an internal audit report — the public report’s structure.
- Evaluating management responses — disagreement in public.
- Auditing cybersecurity programs — the ransomware target that local government is.
- Internal audit beyond banks — the non-financial-services context.
Leave a Reply