Internal auditing is defined by the Institute of Internal Auditors (IIA) as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
Our mission is to help WSSC meet its objectives in a fiscally and ethically responsible manner, by striving to provide an independent and objective appraisal of WSSC's internal controls, risk management system, and compliance with laws, regulations, policies, and procedures.
"Oversight that inspires stakeholder confidence...ALWAYS."
Per the WSSC Bylaws, Rules and Regulations of May 2012, Article 1, Section 1.03
1. The Commissioners shall appoint an Internal Auditor to evaluate and improve the effectiveness of risk management, control, and governance processes.
2. The Internal Auditor shall be appointed by action taken in accordance with Article 2 of these Bylaws, Rules, and Regulations.
3. The Internal Auditor shall have such duties as the Commissioners may prescribe and/or as delegated in the Internal Audit Charter. "
The internal auditing function was established by the Washington Suburban Sanitary Commission (WSSC) in 1972 to evaluate the effectiveness of internal controls over fiscal, operational, and programmatic activities. The Internal Audit Charter (NR-GOV-IA-2015-001) defines the purpose, authority, and responsibility of the internal audit activity. Today, it is called the Internal Audit Office and viewed as a cornerstone of strong governance as it provides independent, objective assurance and advisory services.
Together, the aforementioned services evaluate and improve the Commission’s risk management, control, and governance operations. The operational/performance audits conducted by the internal audit department are essential to ensuring resources obtained from WSSC ratepayers are being used efficiently, effectively, economically, and ethically to achieve organizational goals and objectives.
To ensure independence, the Internal Audit Office reports directly to the six-member body of Commissioners (also known as the Audit Committee); three each appointed by the County Executives of Montgomery and Prince George’s. Additionally, internal auditors have no authority over, or responsibility for, any of the activities/operations audited, and shall not perform accounting or other operational functions outside their team that might require subsequent audit.
Internal auditors are experts in understanding organizational risks and internal controls available to mitigate these risks. They assist management in understanding these topics and provide recommendations for improvements. Due to our unique and objective perspective, in-depth organizational knowledge, and application of sound audit and consulting principles, we are well positioned to provide valuable support and assurance to the WSSC and its oversight entities.
As part of ensuring transparency, the Commission has established a Code of Ethics and an ethics program in keeping with the Maryland Public Ethics law. The program has an independent Board of Ethics comprised of residents of Montgomery and Prince George’s counties who are not affiliated with WSSC. The Commission employs a dedicated, full-time Ethics Officer to provide day-to-day direction to the Ethics Program and execute the Code of Ethics. The Ethics Officer reports administratively to the Internal Audit Director and functionally to the Board of Ethics, thereby maintaining independence. For more information about the WSSC Board of Ethics and Ethics Program, please click on this Board of Ethics link.
The WSSC Internal Audit Office is comprised of seven (7) Internal Auditors, one (1) Ethics Officer, and two (2) Administrative Assistants. To date, internal auditors have earned one or more of the following professional certifications: Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Fraud Examiner (CFE), Certified Information Systems Auditor (CISA), Certified Government Auditing Professional (CGAP), Certification in Control Self-Assessment (CCSA), and Certification in Risk Management Assurance (CRMA). The Ethics Officer is a licensed attorney and certified compliance professional.
All internal auditors are required to be CFEs in order to perform sensitive Fraud, Waste & Abuse Hotline investigations. Additionally, all internal auditors ranked Senior Internal Auditor or higher are required to be Certified Public Accountants in the State of Maryland.
Internal Audit and Ethics Office staff members are actively involved in the following professional organizations in an effort to stay abreast of the skills, knowledge, and abilities required to provide world-class services:
WSSC prohibits any conduct constituting fraud, waste, and abuse and encourages such known or suspected activities to be reported without fear of retaliation. The WSSC Fraud, Waste & Abuse Hotline is available to employees and the public 24 hours a day, 7 days per week, and 365 days per year. Allegations of fraud, waste, abuse or ethical improprieties can be reported anonymously via the telephone at 1-877-WSSCFWA (1-877-977-2392) or the web at www.reportlineweb.com/wssc.
Depending on the nature of the alleged fraud, waste, or abuse, different groups within the WSSC will have varying responsibilities and roles for detecting, reporting, investigating, and correcting the alleged irregularity.
Hotline investigations are primarily conducted by Internal Auditors, WSSC Police Department Investigative Unit, Ethics Office, and Equal Employment Opportunities (EEO) Office. Each investigator possesses the experience or has obtained training necessary to conduct such sensitive examinations.
The status of Hotline investigations is shared publicly during Commission and Audit Committee Meetings on a quarterly basis by the Director of Internal Audit.
The Internal Audit Office takes an enterprise-wide approach to assessing risk in order to determine the priorities of the internal audit activity. Each risk assessment undertaken contributes to the development of a risk-based audit work plan that helps the Commission mitigate risk and ultimately achieve its strategic objectives. A vital part of the risk assessment process entails gathering relevant information from various resources, assessing the associated risk factors, and weighting the information gathered through defined impact and likelihood calculations.
Although appointed by the six-member body of WSSC Commissioners, as required by IIA Performance Standard 2010, the Director of Internal Audit is solely responsible for developing each risk-based plan; as well as communicating the plans resource requirements, and ensuring that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan.
While providing value-adding services, we produce numerous confidential and public documents. Public documents are located on this web page. These documents include our Annual Risk-Based Audit Plan, internal audit and external audit reports issued, results of System Development Charges (SDC) audit requests, Blue Plains Operations & Maintenance Audit reports, and continuous auditing reviews. Please click on the “Internal Audit Services” link for detailed information regarding these public documents.
Each fiscal year a certified public accounting firm licensed to practice in the State audits the books and accounts of the Commission. In an effort to promote transparency, the results of each Commission audit is filed annually with the county executives and county councils of Montgomery County and Prince George’s County, the Montgomery County and Prince George’s County Senate and House delegations to the Maryland General Assembly, along with current financial statements. Additionally, these reports and financial statements are published on WSSC’s website for public viewing.
Due to WSSC’s ratepayer-funded water utility services, the Internal Audit Office upholds the Institute of Internal Auditors’ (IIA) International Standards for the Professional Practice of Internal Auditing (Standards). These Standards, specifically Standard 1312, requires that an external assessment is performed at least once every five years by a qualified, independent reviewer or review team from outside the organization.
All members of the assessment team who perform the external assessment are to be independent of WSSC and its internal auditing activity personnel. In particular, members of the assessment team are to have no real or perceived conflicts of interest with WSSC and/or its personnel.
The results of the 2016 External Quality Assessment confirms WSSC’s internal audit activity conforms with the Standards and is permitted to include the following world-class distinction statement in its issued audit reports: “WSSC’s internal audit activity conforms with the International Standards for the Professional Practice of Internal Auditing.”
According to Maryland Public Utilities Article §17-401 (b), the county council or county executive of Montgomery County or Prince George’s County may, in person or by a duly authorized agent, audit and examine the books and records of the Commission.
In its role as a duly authorized agent, the Montgomery County Inspector General’s Office periodically audits and examines the books and records of the WSSC. The results of its audits and/or examinations of the WSSC are currently published on its website under the Washington Suburban Sanitary Commission title in its “Reports & Work Plan” web page section.
In our continued effort to promote transparency, the Director of Internal Audit provides monthly Internal Audit and Ethics Office activity reports during each live video-streamed open session Commission Meeting. The information reported includes the status of Fraud, Waste & Abuse Hotline cases, audit projects, resources, and follow-up activities. Each IAO Monthly Activity Report is published on the web before each Commission Meeting and remain available as hyperlinks to Commission Meeting Agendas.