Legislative Post Audit Process

The information presented here is intended to provide you with a broad understanding of the role of the Legislative Division of Post Audit and its procedures for conducting performance audits.

Who we are.

The Legislative Division of Post Audit is a staff agency of the Kansas Legislature. The Division works under the direction of the Legislative Post Auditor, who is appointed by the Legislative Post Audit Committee. The Legislative Post Audit Committee is a 10-member bipartisan committee of the Kansas Legislature. The Committee considers performance audit topics submitted by Committee members, other legislators, and legislative committees. Performance audits are carried out by the Division only at the direction of the Legislative Post Audit Committee.

What we do.

The Legislative Division of Post Audit conducts performance audits to determine the efficiency, effectiveness, economy, or results of governmental agencies or programs, or to provide other specific information about those agencies or programs. Performance audits provide the Legislature and agency management with independent analysis, evaluation, and recommendations regarding the performance of the audited activities. The Legislative Division of Post Audit follows all requirements for conducting performance audits established by the U.S. General Accounting Office. Statutes governing the Division's authority are set out in K.S.A. 46-1101 et seq.

Access to information.

Kansas law (K.S.A. 46-1106 and 46-1114(d)) gives the Legislative Division of Post Audit access to agency or program records including all books, accounts, records, files, documents, and correspondence, confidential or otherwise, for the purpose of conducting performance audits. Audit staff are subject to the same penalties as agency staff regarding any unauthorized release of confidential information.

Further, federal law specifically authorizes auditor access to health information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA): 45 CFR 512(d)(1) states that a “... covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; ...or other activities necessary for appropriate oversight...”

Performance audit process.

Most audits take about 6-16 weeks, and consist of a series of distinct stages:

Preliminary planning: Once Legislative Post Audit is assigned a topic by the Legislative Post Audit Committee, appropriate agency heads are notified and sent a copy of the approved audit "scope statement," a brief document that describes the questions the audit will seek to answer. Division staff then begin gathering background information and planning the audit. Division staff and management also meet with agency officials. The purpose of the meeting is to allow agency officials to learn about the audit, meet audit staff, discuss any scheduling conflicts, suggest particular areas for audit and investigation, and designate an agency contact person.
Field Work: Once the work plan has been approved, the audit team collects information, observes activities, reviews and tests agency data or processes, and evaluates the results of the various analyses. Often the audit team can retrieve data from files and computer records with minimal assistance from the agency staff. In other cases, field work involves observing staff while on the job, interviewing staff and clients, and other techniques that may require agency staff time. The audit team prepares working papers to document its findings. These working papers are kept confidential in the Division's offices during the audit process. After an audit is completed and has been presented to the Committee, as explained below, the working papers become public documents. However, the public working papers don't contain any information that remains confidential by law.
Report: Once the field work is completed, the audit team and the audit manager meet with agency officials to describe the major findings disclosed by the field work, and possible recommendations. At that meeting, the agency officials should inform the auditors of any perceived errors in fact or conclusions. This can help clarify important information.

After the meeting, the draft report is sent to the agency for review. This review period gives the agency an opportunity to point out any errors of fact, call attention to additional information that might have been overlooked, and review conclusions and recommendations. The agency then is asked to prepare a formal, written response to the audit. The written response is an important part of the audit process; agency comments are analyzed carefully and are included as an appendix to the completed audit report. In some cases, the agency may wish to review the audit team's working papers before writing the response. The Division permits review of the working papers, at the written request of the agency head, but the working papers may not be taken out of the Division's offices, nor may they be photocopied until the audit becomes public.

All information in the audit working papers and in the draft report is confidential until the final report is presented to the Legislative Post Audit Committee. Audit staff notify the agency of the time and place of the Committee meeting. Once the audit is presented to the Committee, the report and the working papers (except the confidential ones) become public documents. Committee review usually includes a formal presentation by the audit supervisor, and a response by the agency head or other senior official of the audited agency. Audits often will be presented to other legislative committees as well.

The Division's completed performance audits are widely distributed. Copies of every audit are sent to the Legislative Post Audit Committee, the audited agency, and the requesting legislator or legislative committee. Reports also are made available free of charge to the public.
Follow-Up: When the draft report is sent to the agency for review, agency officials are requested to respond to each identified recommendation in the audit report. Legislative Post Audit Committee members generally pay close attention to agency responses to the auditors' recommendations.

Committee rules require the Legislative Post Auditor to report each year on whether each agency audited during the previous year has complied with the recommendations. Consequently, several months after the audit is concluded, the agency will be asked for an update on its implementation of the audit recommendations.

Who selects audit topics?

The Committee considers requests for audits at its meetings and decides which audits should be conducted. Suggestions for audit topics come from a variety of sources. The most common are:

Legislative Post Audit Committee members
Other legislators
Other legislative committees

How is confidential information safeguarded?

The audit team will safeguard documents they examine, and will not remove any original documents without permission. Confidential information in our audit workpaper files is never made public. To the extent the audit team needs to review confidential records during an audit, we eliminate any names or other identifying information that would allow anyone looking at our workpapers to know who the information relates to.

Audit standards require the Division to keep sufficient information to be able to recreate our audit work if it were questioned or challenged. Therefore, any names or other confidential information we would need to recreate our audit work is kept in our office safe in a locked room, apart from our public workpapers. We keep all confidential information locked in the safe for a period of 3-5 years after an audit has been completed. When confidential information needs to be disposed of, the audit staff follows the same procedures as the agency. For example, if the agency normally shreds confidential information, the audit staff will return the documents to the agency to be shredded. If the agency simply puts sensitive material in the trash, the auditor may do the same.

What are audited agencies' responsibilities?

In accordance with State law, the agency must provide the auditors access to all books, records, correspondence, and staff. The agency is expected to accommodate auditor requests for information, records, explanations, and assistance. However, ever effort is made to minimize agency staff time. For example, audit staff are instructed to obtain as much program information as possible from records and documents, before interviewing agency officials.