Skip to main content

Board of Education → Internal Audit Unit

Internal Audit Unit

Under the authority of the Montgomery County Board of Education and the Board-approved Internal Audit Unit Charter, the Internal Audit Unit serves as an independent and objective assurance and advisory function.

IAU has authority to review, evaluate, and report on MCPS programs, operations, financial activities, internal controls, risk management, governance processes, and the stewardship of public and student resources.

IAU supports MCPS by:

  • Applying a systematic and disciplined approach to evaluating and improving risk management, internal controls, governance, and compliance.
  • Conducting independent audits, analyses, and reviews of schools, offices, programs, and activities.
  • Providing practical, evidence-based recommendations that improve accountability, efficiency, and organizational performance.

Featured Resources

  • Report Fraud, Waste, or Abuse
  • View Audit Reports
    Review published school, departmental, operational, and systemwide audit reports.
  • IAU Charter
    Learn about IAU’s purpose, authority, independence, responsibilities, and reporting relationship.
  • Preparing for an Audit
    Understand what documents may be requested and what to expect throughout an audit engagement.
  • Frequently Asked Questions
    Find answers regarding audit selection, confidentiality, reports, findings, and follow-up procedures.

IAU Independence

Organizational independence is essential to credible and objective audit work.

The Internal Audit Unit reports to the Montgomery County Board of Education and performs its work independently from the management of the activities it audits.

IAU employees do not:

  • Make operational decisions for schools or offices.
  • Approve expenditures or budget allocations.
  • Establish management procedures.
  • Operate financial systems or processes.
  • Assume responsibility for implementing audit recommendations.
  • Direct employees outside the Internal Audit Unit.

IAU may advise management regarding risks, controls, and potential improvements. However, responsibility for decisions and implementation remains with management.

Services

  • Compliance Audits

    Compliance audits evaluate whether schools, offices, programs, and activities comply with Board policies, MCPS regulations and procedures, contractual requirements, and applicable federal and state laws.

    Recommendations generally address improvements needed to strengthen compliance, documentation, oversight, and accountability.

  • Financial Audits

    Financial audits examine the authorization, recording, reporting, receipt, safeguarding, and disbursement of funds.

    These audits may evaluate whether:

    • Transactions are properly approved and supported.
    • Financial records are accurate and complete.
    • Assets are appropriately safeguarded.
    • Revenues and expenditures are properly recorded.
    • Adequate segregation of duties and financial controls exist.

  • Operational and Performance Audits

    Operational audits evaluate whether programs, offices, and activities are operating effectively, efficiently, and in alignment with their established objectives.

    These reviews may include elements of financial, compliance, internal control, and performance auditing.

  • School Independent Activity Fund Audits

    IAU conducts periodic audits of school Independent Activity Funds to evaluate financial accountability, compliance, cash management, purchasing, disbursements, fundraising, account administration, and the safeguarding of student funds.

    The Financial Manual establishes that principals are ultimately responsible for school financial activities and for maintaining and monitoring appropriate internal controls.

  • Internal Control Reviews

    Internal control reviews assess whether financial and operational processes include appropriate safeguards to:

    • Protect assets and resources.
    • Produce reliable information.
    • Prevent or detect errors and irregularities.
    • Ensure appropriate authorization.
    • Support compliance with applicable requirements.
    • Promote effective and efficient operations.

  • Information Technology Audits

    Information technology audits evaluate controls over information systems, data, user access, cybersecurity, system changes, continuity planning, and the reliability of automated processes.

    These audits may be conducted independently or as part of a broader operational or financial audit.

  • Investigations and Special Reviews

    IAU reviews allegations involving suspected fraud, waste, abuse, financial misconduct, conflicts of interest, misuse of assets, or other matters within IAU’s authority.

    IAU may coordinate its work with the Office of General Counsel, Employee and Retiree Service Center, Department of Compliance and Investigations, law enforcement, or other appropriate offices.

  • External Audit Coordination

    IAU coordinates MCPS external audit activities, manages the external financial audit contract, assists with requests from external auditors, and serves as a liaison with the Maryland State Department of Education and other oversight organizations.

  • Advisory Services

    IAU may provide advice concerning risks, controls, governance, and accountability when doing so does not impair its independence.

    Management remains responsible for:

    • Making operational decisions.
    • Establishing procedures.
    • Implementing internal controls.
    • Accepting risk.
    • Carrying out corrective actions.

Internal Audit Process

IAU periodically evaluates risks across MCPS schools, offices, programs, systems, and activities.

Factors considered may include:

  • Financial significance.
  • Strategic and operational risks.
  • Prior audit findings.
  • Changes in systems, programs, or personnel.
  • Internal control concerns.
  • Legal and regulatory requirements.
  • Complaints or reported concerns.
  • Requests from the Board of Education.
  • Available audit resources.

The results inform IAU's annual and multiyear audit work plans.

IAU notifies the responsible principal, director, or other administrator that an audit has been scheduled.

The notification generally identifies:

  • The audit subject.
  • Preliminary scope and objectives.
  • Audit period.
  • Assigned audit staff.
  • Initial documents or information requested.
  • Expected timing.

IAU meets with responsible management to discuss:

  • Audit objectives and scope.
  • Relevant operations and processes.
  • Key personnel.
  • Significant changes or known concerns.
  • Records and systems needed for the audit.
  • Expected communication during the engagement.

Auditors obtain an understanding of the activity being reviewed and assess relevant risks and internal controls.

This may include:

  • Interviews.
  • Process walkthroughs.
  • Policy and procedure review.
  • Data analysis.
  • Review of prior reports.
  • Identification of key controls.
  • Selection of transactions or activities for testing.

IAU gathers and evaluates evidence to determine whether controls are appropriately designed and operating effectively.

Audit procedures may include:

  • Transaction testing.
  • Document inspection.
  • Data analysis.
  • Observation.
  • Confirmation.
  • Recalculation.
  • Interviews.
  • Physical inspection of assets or records.

Potential findings are discussed with responsible personnel to verify facts, obtain additional documentation, and ensure the condition and associated risk are accurately understood.

This process does not transfer responsibility for audit conclusions to management. Final conclusions remain the responsibility of IAU.

IAU prepares a draft report describing:

  • Audit objectives and scope.
  • Background information.
  • Audit conclusions.
  • Findings and associated risks.
  • Recommendations for corrective action.

Management is provided an opportunity to respond. After considering the response and any additional evidence, IAU issues the final report to the appropriate officials.

Management is responsible for developing and implementing corrective actions.

IAU may monitor reported progress and conduct follow-up procedures to determine whether:

  • Corrective actions were implemented.
  • Supporting documentation is sufficient.
  • The underlying risk was adequately addressed.
  • Further action is necessary.

Report Fraud, Waste, or Abuse

Employees and members of the public may report suspected fraud, waste, abuse, theft, financial misconduct, conflicts of interest, or misuse of MCPS resources through MCPS’s independent reporting service.

Reports may be submitted anonymously and are accepted 24 hours a day, seven days a week.

Submit an Online Report

Call 877-268-8620

The hotline is not intended for emergencies. Matters involving an immediate threat to student or employee safety should be reported to emergency services and the appropriate MCPS office.

Contact the Internal Audit Unit

Montgomery County Board of Education
Internal Audit Unit
15 West Gude Drive, Room 114
Rockville, Maryland 20850

Phone: 240-740-5686

Email: InternalAudit@mcpsmd.org

Audit Team

Staff Directory