he SURS Audit

Exhibit 1
SURS Audit Committee Structure and Review
John Engstrom, Chair
November 10, 2009
1. I am now comfortable with the role of the audit committee as a part of
SURS Board governance. This has come about as a result of many
conversations and information provided by Steve Hayward, SURS Internal
Auditor, conversations with a number of other people, and research of the
literature, especially provided by the Institute of Internal Auditors (IIA) and
the American Institute of Certified Public Accountants (AICPA). As a CPA, I
have a professional responsibility to ensure that we meet IIA and AICPA
standards. Failure to provide oversight could have significant legal and
financial consequences to Board Members, in the event of a fiscal failure.
2. It is recommended that Audit Committees operate under a charter.
Effectively, our charter is Section 15.2 “Duties of the Audit Committee” of
the SURS By‐laws.
3. The AICPA has the AICPA Audit Committee Toolkit: Government
Organizations with information regarding how to create an audit
committee and to help its operations. The Toolkit has checklists,
questionnaires, and other useful information. This can be found on their
website, www.aicpa.org.
4. Most of the literature makes the assumption that the Audit Committee
manages the process of obtaining the external auditor and is the main point
of contact with the external auditor. In Illinois, certain constraints are in
place that modify what we can and should do. First, the external auditors of
all state agencies are employed by the State Auditor‐General and report to
that office, the Office of the Auditor General (OAG). With Steve Hayward’s
help, I now have contact with Mr. Tom Kizziah, our representative with
OAG. A second constraint is the open meetings act. Most of the audit
literature suggests frequent executive sessions with the external auditor
where frank and open discussions can result. The literature also suggests
that only audit committee members be in on these discussions; a third
constraint is the tradition of SURS that all Board members can attend, make

Exhibit 1
motions, and vote in all committee meetings (except the executive
committee). None of these constraints should keep us from exercising
oversight, in my judgment.
5. Our current auditor is McGladrey and Pullen, in the second year of a six
year contract. One responsibility of the audit committee is to respond to an
internal control set of questions (called a Statement on Auditing Standards
(SAS) 99 questionnaire). I responded to those questions by an audit
manager on Wednesday, October 14.
6. I will recommend that the Audit Committee meet with the external auditor
and the OAG representative to hear the results of the 2008‐9 financial and
compliance audits. This will happen when the OAG finalizes the audit
reports and releases them to the public. Procedurally, our (Acting?)
Executive Director will make the request to the State Auditor‐General. A
part of that meeting should be in executive session.
7. I have read the “Fiscal Control and Internal Auditing Act” provided by Steve
Hayward. This act requires that the internal auditor report to the chief
executive officer of each agency and provides for the adoption of two‐year
plans, etc. We meet those requirements. This Act also requires state
auditors to comply with Institute of Internal Auditors’ international
standards, ethics and other standards adopted by the State Internal Audit
Advisory Board. Recent law changes under SB 51 (PA 096‐0795) formally
bring the state pension boards under the act.
8. Steve Hayward has provided me with (a) SURS Fraud Policies and
Procedures, (b) SURS Internal Audit Charter and Policies and Procedures
Manual, (c) a letter from Judy Parker to Bill Holland, Auditor General,
reporting that an evaluation of the internal fiscal and administrative
controls was performed during the reporting period ending April 1, 2009,
and (d) report of external assessment of the SURS Internal Audit
Department to the IIA standards and the Fiscal Control and Internal
Auditing Act of the State of Illinois. The date of the report was September
6, 2006; the external audit was performed by the TRS Internal Audit
Manager.

Exhibit 1
9. I believe the internal audit function of the SURS staff is operating effectively
and in accordance with state regulations and professional standards. I
believe procedures are in place for the Audit Committee to be notified in
the event significant internal control problems are detected, either by the
external auditor, the OAG representative, or the SURS internal auditor.
10. In the future, I suggest that we have at least one formal meeting each year
with the external auditor and the OAG representative, that the audit
committee and other Board members read carefully the materials
presented by Steve Hayward in our meetings, and that we all adopt a
questioning attitude towards SURS actions in terms of their internal control
and potential fraud implications. In the words of an Institute of Internal
Auditors publication (The Audit Committee: Purpose, Process,
Professionalism) “noses in, fingers out.”