Does the Texas Internal Auditing Act require state agencies to follow its rules, or are they just suggestions?

Texas AG Opinion JM-1183: Is the Texas Internal Auditing Act Mandatory or Just a Guideline?

Plain-English summary

The Commissioner of the Texas Rehabilitation Commission asked the Attorney General to interpret the newly enacted Texas Internal Auditing Act, effective September 1, 1989. He first asked whether the act's use of the word "guidelines" to describe its purpose meant an agency could adopt its own internal-audit program as long as it reflected the act's general intent, rather than following the act's specific requirements. He also asked whether an agency had to appoint a certified public accountant (CPA) or certified internal auditor (CIA) as its internal auditor even if the position was already filled by someone who was neither, and who decides, agency management or the auditor, when a particular duty would compromise the auditor's independence.

The Attorney General concluded the act's requirements are mandatory. Although section 2 describes the act's purpose using the word "guidelines," the opinion read the act as a whole and found that the sections spelling out the internal auditing program use consistently mandatory language, agencies "shall" establish a full-time program, an auditor "shall" be appointed, and audits "shall" conform to professional standards, which the opinion treated as controlling over the more general word "guidelines." On the CPA/CIA question, the opinion concluded an agency could keep an existing internal auditor who is neither a CPA nor a CIA in that job, but could not thereafter appoint that person, or anyone else who isn't a CPA or CIA, as the internal auditor responsible for the act's duties. Finally, on independence, the opinion concluded that because the act's list of entities an auditor may consult (the agency's board, the governor's office, the state auditor, and legislative bodies) pointedly omits the agency's own administrator, neither the administrator nor other agency management may decide when a duty would impair the auditor's independence, that decision belongs to the auditor alone, who may (but need not) consult the listed outside entities.

Currency note

This opinion was issued in 1990. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule mentioned here.

Who this opinion affected (as of 1990)

State agency commissioners and governing boards covered by the act: The opinion meant they could not treat the Internal Auditing Act's requirements as optional or substitute a different internal-audit program of their own design, and that appointing a new internal auditor required choosing a CPA or CIA.

Internal auditors at covered state agencies: The opinion confirmed that the decision whether a particular management responsibility would compromise the auditor's independence belonged to the auditor, not to agency administrators, and that the auditor could consult outside entities like the state auditor or the governor's office but was not required to.

Existing agency employees serving as internal auditor without CPA or CIA credentials: The opinion allowed such an employee to remain in that role for the time being, but held the agency could not reappoint or newly appoint a non-CPA, non-CIA employee to carry out the act's internal auditor duties going forward.

Common questions

Is the Texas Internal Auditing Act just a set of suggestions for state agencies?
No. The opinion concluded that although section 2 of the act describes its purpose using the word "guidelines," the act's operative sections use mandatory language throughout, requiring agencies to establish a full-time internal auditing program, appoint an internal auditor, and meet specified professional standards.

Does a state agency have to hire a CPA or a certified internal auditor as its internal auditor?
Yes, going forward. The opinion read section 5 of the act to require that the internal auditor be either a certified public accountant or a certified internal auditor with at least three years of auditing experience, though an agency could continue employing an existing non-CPA, non-CIA internal auditor already on staff as of the act's effective date.

Who decides if a task would compromise the internal auditor's independence, the auditor or agency management?
The auditor decides. The opinion found that section 7 of the act, which lists the entities an auditor may consult (the agency's governing board or commission, the governor's office, the state auditor, and legislative agencies or committees), notably leaves out the agency administrator, meaning agency management does not get a say in that determination.

Background and statutory framework

The Texas Legislature passed the Internal Auditing Act, V.T.C.S. art. 6252-5d, in May 1989, effective September 1, 1989. Section 2 states the act's purpose is "to establish guidelines for a program of internal auditing to assist agency administrators by furnishing independent analyses . . . of performance in carrying out assigned responsibilities." The commissioner argued that "guidelines" signaled the legislature did not intend the act's provisions to be mandatory.

The opinion disagreed, reading the act as a whole. Section 4 requires that each agency "shall establish a full-time program of internal auditing which shall include" an annual audit plan and audits of specified systems and controls. Section 5 requires that an internal auditor "shall" be appointed, and section 6 lists the auditor's required duties. Sections 8 and 9 likewise use mandatory language, requiring the program to "conform" to professional standards and requiring the state auditor to provide technical assistance. Given this pervasive mandatory language and the act's detailed program and personnel requirements, the opinion concluded a covered agency must establish and maintain a program that complies with both the act's terms and its intent, consistent with a dictionary definition of "guideline" as an indication of future conduct and with Government Code section 312.002(a)'s instruction that words be given their ordinary meaning. The opinion cited Board of Educ. v. School Comm. of Amesbury for the proposition that "guideline" implies some instruction for future conduct, and noted the construction was consistent with a 1988 legislative interim report recommending that certain agencies be required to establish internal auditing programs with appropriate personnel and independence.

On the CPA/CIA question, section 5 requires the governing board of an agency, its designee, or the administrator of an agency without a governing board to appoint an internal auditor who is either a CPA or a CIA with at least three years of auditing experience. Because the act's effective-date clause was silent on individuals already serving as internal auditor who held neither credential, the opinion read that silence as permitting an agency to keep such an individual in that role, but held that section 5 nonetheless required a covered agency to appoint a CPA or CIA when appointing (or reappointing) someone as the internal auditor charged with carrying out the act's duties, including developing the agency's annual audit plan and conducting audits under section 6(2)-(3).

On the independence question, section 6(6) requires the internal auditor to be free of any operational or management responsibility that would impair independent review of the agency's operations. Section 7 separately authorizes the internal auditor to consult with the agency's governing board or commission, the governor's office, the state auditor, and other legislative agencies or committees on matters affecting duties under the act. The opinion found the agency administrator's conspicuous absence from that list significant: neither the agency's commissioner nor its deputies or assistant commissioners may decide when compliance with an operational or management responsibility would impair the auditor's independence, and the auditor need not consult those individuals in making that determination, though the auditor may choose to consult the outside entities section 7 does list. The opinion limited this conclusion to multi-member boards and commissions of appointed members, consistent with the six-member, governor-appointed Texas Rehabilitation Commission board under Human Resources Code section 111.013, and did not address single-official or elected-board agencies. The opinion found nothing in the Rehabilitation Commission's own statutes, including Human Resources Code sections 111.018 (personnel standards and career ladder) and 111.020 (appointment of agency personnel), in conflict with this reading of the act.

Citations

Statutes:

• V.T.C.S. art. 6252-5d
• V.T.C.S. art. 6252-5d, § 2
• V.T.C.S. art. 6252-5d, § 4
• V.T.C.S. art. 6252-5d, § 5
• V.T.C.S. art. 6252-5d, § 5(2)
• V.T.C.S. art. 6252-5d, § 6
• V.T.C.S. art. 6252-5d, § 6(1)
• V.T.C.S. art. 6252-5d, § 6(2)-(3)
• V.T.C.S. art. 6252-5d, § 6(6)
• V.T.C.S. art. 6252-5d, § 7
• V.T.C.S. art. 6252-5d, § 8
• V.T.C.S. art. 6252-5d, § 9
• Gov't Code §§ 321.005, 321.013, 321.0131-321.0136
• Hum. Res. Code §§ 111.001-111.058
• Hum. Res. Code § 111.013
• Hum. Res. Code § 111.018
• Hum. Res. Code § 111.020
• V.T.C.S. art. 4348e
• Gov't Code § 312.002(a)

Cases:

• Board of Educ. v. School Comm. of Amesbury, 452 N.E.2d 302, 306 (Mass. App. Ct. 1983)

Source

• Landing page: https://www.texasattorneygeneral.gov/opinions/jim-mattox/jm-1183
• Original PDF: https://www.texasattorneygeneral.gov/sites/default/files/opinion-files/opinion/1990/jm1183.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain, the linked PDF is authoritative.

July 5, 1990

Mr. Vernon M. Arrell
Commissioner
Texas Rehabilitation Commission
4900 North Lamar Blvd.
Austin, Texas 78751-2316

Opinion No. JM-1183

Re: Applicability of the provisions of the Texas Internal Auditing Act, article 6252-5d, V.T.C.S., to the Texas Rehabilitation Commission (RQ-1869)

Dear Mr. Arrell:

You ask several questions about the application of the Texas Internal Auditing Act [hereinafter the act]. V.T.C.S. art. 6252-5d. The legislature passed the act in May 1989, and it became effective September 1, 1989. H.B. 2728, Acts 1989, 71st Leg., ch. 787, at 3568.

You first ask whether an agency may have an internal audit program different from the program described in the act as long as the agency's program reflects the intent of the act. Section 2 of the act provides in part:

The purpose of this Act is to establish guidelines for a program of internal auditing to assist agency administrators by furnishing independent analyses . . . of performance in carrying out assigned responsibilities.

You suggest that the use of the word "guidelines" in section 2 indicates the legislature did not intend to make the provisions of the act mandatory.

We disagree. Read as a whole, the act unambiguously indicates that the legislature intended an agency covered by the act to establish and maintain a program that conforms to the requirements of the act. In contrast to section 2, which merely states the general purpose of the act, the sections of the act that describe in detail the internal auditing program and its functions contain mandatory language. For instance, section 4 states that each agency "shall establish a full-time program of internal auditing which shall include" an annual audit plan and audits of various systems and controls. Section 5 provides that an internal auditor shall be appointed, while section 6 lists the required duties of that auditor. Sections 8 and 9 also contain mandatory language. Section 8 states that the program "shall conform" to various professional standards, and section 9 requires the state auditor to provide technical assistance and training opportunities to agency internal auditors.

Given the legislature's dominant use of mandatory language in the implementing sections of the act and the detailed requirements in the act for the program and needed personnel, we believe that a court would conclude that an agency covered by the act must establish and maintain a program that complies with the terms of the act as well as its intent. Construing the act as mandatory is also consistent with a dictionary definition of "guideline" as an indication of future conduct. See Webster's Third New International Dictionary of the English Language (Unabridged) 1009 (1969); see also Board of Educ. v. School Comm. of Amesbury, 452 N.E.2d 302, 306 (Mass. App. Ct. 1983) ("guideline" implies some instruction for future conduct); Gov't Code § 312.002(a) (words shall generally be given their ordinary meaning). The narrow and detailed "guidelines" described above are mandatory and are drafted to ensure agency action that complies with the act. Finally, construing the act as mandatory on or after its effective date is consistent with the 1988 legislative interim report that recommended passage of legislation requiring certain agencies to establish internal auditing programs with appropriate personnel and independence. See Governor's Task Force, Findings and Recommendations of the Accounting, Auditing and Financial Reporting Task Force 5, 10-11 (December 1988); see also Office of the State Auditor, Statewide Report on Internal Auditing: A Report to the Legislative Audit Committee 3-4 (May 1988) (major state agencies should establish internal audit programs).

You next ask whether an agency must appoint a certified public accountant (CPA) or certified internal auditor (CIA) as the internal auditor if the position is occupied by an individual who is neither a CPA nor a CIA. Section 5 of the act provides as follows:

The governing board of an agency or its designee, or the administrator of an agency without a governing board, shall appoint an internal auditor, who shall be either a certified public accountant or a certified internal auditor and who shall have at least three years of auditing experience. The agency shall employ such additional professional and support staff as the agency administrator determines are necessary to implement an effective program of internal auditing.

You have not mentioned and we are unaware of any other state statute describing the qualifications of an agency internal auditor, and thus we interpret your question as meaning whether your agency must appoint a CPA or CIA to perform the duties imposed on an internal auditor by the act.

Neither the terms of the act nor the legislative history of the act indicate whether individuals employed as internal auditors for state agencies who are not CPAs or CIAs should continue in employment as state internal auditors after the effective date of the act. The effective date clause states only that the act takes effect on September 1, 1989. We interpret the absence of legislative guidance on this issue as an indication that state agencies may continue such individuals in their employ on the internal audit staff unless otherwise prohibited. Nevertheless, section 5 of the act does require a covered state agency to appoint a CPA or CIA as the internal auditor, and other sections of the act require that certified auditor to carry out the responsibilities of the act. In particular, the certified auditor must develop the agency's annual audit plan and conduct agency audits in accordance with the annual plan. V.T.C.S. art. 6252-5d, § 6(2)-(3). Additional professional and support staff may be employed as deemed necessary by the agency administrator to implement the required internal audit program. Id. § 5. Thus, while an agency may continue in its employ as an internal auditor an individual who is neither a CPA nor a CIA as of September 1, 1989, neither the agency, its designee, nor the agency administrator of an agency without a governing board may appoint that individual as the internal auditor to carry out the requirements of the act.

Your third question concerns section 6(1) of the act. Section 6(1) of the act requires the internal auditor to report directly to the agency's governing board or to the commission. You ask whether section 6(1) is consistent with other laws and regulations governing the operation of state agencies. You do not provide us with any instances of inconsistency; nor were we able to find any in the statutes applicable to internal audits of the Texas Rehabilitation Commission. See, e.g., Gov't Code §§ 321.005, 321.013, 321.0131-321.0136; Hum. Res. Code §§ 111.001-111.058; V.T.C.S. art. 4348e. Section 111.018 of the Human Resources Code requires the commissioner of the Texas Rehabilitation Commission to make regulations governing personnel standards and to develop a career ladder program. Section 111.020 requires the commissioner to appoint the personnel needed to carry out agency functions. Neither of those sections, however, conflicts on the surface with section 6(1) of the act. Those sections merely enable the commissioner to supervise and promote the personnel required to do agency work, while the act authorizes an internal auditor to conduct independent reviews of the work performed by such personnel to ensure that the work is performed economically and efficiently.[1]

Your last question concerns section 6(6) of the act. Section 6(6) provides that the internal auditor shall be free of any operational or management responsibility that would impair the independent review of the agency's operations. You ask whether management or the internal auditor alone or both together are to decide when compliance with a particular responsibility would impair the auditor's independence. In the case of the Texas Rehabilitation Commission, we construe your reference to management to mean the agency's commissioner as well as deputy or assistant commissioners or other executive administrators. Acts 1989, 71st Leg., ch. 1263, art. II-68, at 5503 (provisions of the General Appropriations Act concerning the commission's key administrators).

Section 7 of the act states that the internal auditor "may consult with the agency's governing board or commission, the governor's office, the state auditor, and other legislative agencies or committees concerning matters affecting duties and responsibilities under this Act." Section 6(6) of the act describes as one of the internal auditor's duties the obligation to be free of certain responsibilities that would impair the independent review of agency operations.

1. You do not pose nor do we address a situation in which a particular personnel standard conflicts with the duties imposed by the act on the internal auditor. Furthermore, if a situation of conflict does arise that concerns an operational or management responsibility described in section 6(6) of the act, the internal auditor may choose to consult with the entities listed in section 7 of the act.

Significantly absent from the list in section 7 is the agency administrator who is defined in the act as the executive head of the agency. V.T.C.S. art. 6252-5d, § 5(2). We conclude from this absence first, that the agency's commissioner and deputies or assistants may not decide when the internal auditor's compliance with an operational or a management responsibility would impair the independent review of agency operations and second, that the internal auditor may not consult with those individuals in making that determination.[2] The independent auditor may, if he chooses, consult with the entities listed in section 7 of the act in making the determination, but the auditor is not required by that section to do so.[3] This construction of the act effectuates the primary purpose of the act: the provision of unbiased reports to the agency's governing board or commission about all agency work, including the work performed by the agency's executive personnel. See V.T.C.S. art. 6252-5d, §§ 2 (purpose is to furnish independent analyses), 4(2) (requirement for audits of administrative systems and controls), 6(6) (requirement for independent reviews of agency operations); see also Statewide Report on Internal Auditing: A Report to the Legislative Audit Committee 11-12 (internal audit groups should be located outside of the management functions subject to audit so that organizational status enhances independence).

2. The governing board of the Texas Rehabilitation Commission is composed of six members appointed by the governor. Hum. Res. Code § 111.013. Our conclusion therefore is limited to multi-member boards and commissions composed of appointed members, and we do not address the situation of an agency overseen by a single appointed or elected official or by a board or commission of elected officials.

3. Section 8 of the act suggests that the internal auditor in making this determination may use various professional standards and codes, including the Certified Internal Auditor Code of Professional Ethics and the Standards for the Professional Practice of Internal Auditing.

SUMMARY

The provisions of the Texas Internal Auditing Act are mandatory. The internal auditor appointed by an agency to carry out the act must be a certified public accountant or certified internal auditor. That auditor shall report directly to the agency's governing board or commission. That auditor is also not required to consult with the executive head of the agency to determine when compliance with a particular responsibility would impair the independent review of agency operations. Instead, the auditor may make the decision alone or consult with the agency's governing board or commission or certain other entities outside the agency.

JIM MATTOX
Attorney General of Texas

MARY KELLER
First Assistant Attorney General

LOU MCCREARY
Executive Assistant Attorney General

JUDGE ZOLLIE STEAKLEY
Special Assistant Attorney General

RENEA HICKS
Special Assistant Attorney General

RICK GILPIN
Chairman, Opinion Committee

Prepared by Celeste A. Baker
Assistant Attorney General