§304A-321 Independent audit committee; established; powers; duties. (a) There is established within the board of regents of the University of Hawaii an advisory body to be known as the independent audit committee.

(b) The independent audit committee shall consist of at least three members but not more than five members who shall be appointed by the chairperson of the board of regents, from among the members of the board of regents, except as provided in this subsection. The chair of the independent audit committee shall be selected by and from among its members.

The independent audit committee shall include one or more individuals with financial expertise. If no member of the board of regents has the requisite skills, the board of regents shall execute other arrangements, which may include the appointment of members of the general public who possess the requisite financial expertise to the independent audit committee to ensure that the independent audit committee has the capacity to carry out its duties.

(c) The board of regents shall generally:

(1) Establish the charter of the independent audit committee and set forth its members' roles and responsibilities;

(2) Consider changes to the independent audit committee's charter that are necessary in response to new laws, regulations, and best practices; and

(3) Conduct an annual review of the independent audit committee's charter to reassess its adequacy and adopt any proposed and necessary changes to the charter.

(d) The independent audit committee shall be exempt from chapter 91 and part I of chapter 92 to the extent that the independent audit committee is engaging in discussions or proceedings arising from an investigation by the independent audit committee relating to potentially actionable civil or criminal conduct, whether or not the investigation is pending or outstanding.

(e) The independent audit committee shall undertake professional development to improve the financial expertise of the independent audit committee as a whole, including:

(1) Attendance at seminars and conferences;

(2) Attendance at educational sessions including special speakers; and

(3) The study of analytical tools for audit committees.

(f) The independent audit committee shall engage in operations relating to enterprise risk management including:

(1) Providing oversight of risk management, which shall include determining overall strategy and influencing the university's risk philosophy;

(2) Inquiring of the president of the University of Hawaii, the chief financial officer of the university, and external auditors about significant risks or exposures faced by the university;

(3) Assessing steps that the president of the University of Hawaii has taken or proposes to take to minimize those risks to the university and periodically reviewing compliance with those steps; and

(4) Reviewing with the general counsel of the University of Hawaii, external auditors, external counsel, and the chief financial officer of the university legal and regulatory matters that, in the opinion of the president of the University of Hawaii, may have a material impact upon the financial statements, related organization compliance policies, and programs and reports received from regulators.

(g) The independent audit committee shall hold meetings as needed to address matters on its agenda, not less frequently than twice per year. The independent audit committee may request the president of the University of Hawaii or others to attend its meetings or to provide pertinent information as necessary. The board of regents shall provide in the charter of the independent audit committee for the independent audit committee to take action between meetings by unanimous consent.

(h) The independent audit committee shall review its effectiveness annually and shall prepare, or oversee the preparation of, an annual report to the board of regents.

(i) The annual report of the independent audit committee shall address other matters affecting the management and organization of the University of Hawaii by engaging in functions, including:

(1) Reviewing with the president of the University of Hawaii and an external auditor retained pursuant to subsection (r) the effect of any regulatory and accounting initiatives and unique transactions, including relationships with legally separate entities, to determine whether the accounting for those transactions applied best practices;

(2) Reviewing significant related party transactions;

(3) Reviewing with the president of the University of Hawaii and the chief financial officer of the university, any interim financial reports or reports on internal control issued with respect to the university since the last meeting of the independent audit committee; and

(4) Reviewing with an external auditor who performs an audit the following:

(A) All critical accounting policies and practices used by the external auditor; provided that:

(i) All alternative treatments of financial information within generally accepted accounting principles have been discussed with the president of the University of Hawaii;

(ii) The ramifications of each alternative are discussed; and

(iii) The treatment preferred by the university is discussed;

(B) Any consultation with audit firms other than the external auditor, including the reasons for, and results of, the consultation; and

(C) Any other information relating to significant estimates and judgments.

(j) The independent audit committee shall also review with any external auditor and the chief financial officer of the university matters affecting internal control and an internal audit, including:

(1) The adequacy of the University of Hawaii's internal control, including computerized information system controls and security; and

(2) Any related significant findings and recommendations of the internal and external auditors, together with the responses of the president of the University of Hawaii.

(k) The independent audit committee shall also review matters affecting the accounting policies and procedures of the University of Hawaii by:

(1) Ensuring that accounting policies, procedures, and related controls are documented and reviewed with the independent audit committee;

(2) Reviewing accounting controls annually;

(3) Reviewing with the president of the University of Hawaii policies and procedures with respect to officers, key employees, and disqualified persons as defined under section 4958 of the Internal Revenue Code of 1986, as amended; and

(4) Inquiring of the president of the University of Hawaii and the chief financial officer regarding the financial health of the university.

(l) The independent audit committee shall review the University of Hawaii's antifraud programs and controls and aid in discovering and remedying incidences of fraud.

(m) Notwithstanding part V of chapter 378, the independent audit committee shall review:

(1) Procedures for the receipt, retention, and treatment of complaints received by the University of Hawaii regarding accounting, internal accounting controls, auditing matters, or suspected fraud that may be submitted by any party internal or external to the university; and

(2) As the independent audit committee deems necessary, complaints that may have been received, the current status of such complaints, and the resolution of such complaints, if any resolution has been reached;

provided that any person who makes a complaint covered by this section shall be accorded the same protections as under part V of chapter 378.

(n) With regard to internal control and any internal audit, the independent audit committee shall also:

(1) Review with any external auditor, the chief financial officer of the university, and the comptroller the audit scope and plan of the internal auditors;

(2) Address the coordination of audit efforts to ensure the completeness of coverage, reduction of redundant efforts, and the effective use of audit resources; and

(3) Discuss with the chief financial officer of the university and the external auditor opportunities for reliance by the external auditor on the audit activities of any internal audit.

(o) For internal audits, the independent audit committee shall review the following with the president of the University of Hawaii and the chief financial officer of the university:

(1) Significant findings of internal audits conducted during the university's previous and current fiscal year and the president's responses;

(2) Whether internal auditors have encountered difficulties in discharging their responsibilities in the course of their audits, such as any restrictions on the scope of their work or access to required information;

(3) Any changes required in the scope of internal audits;

(4) The budget and staffing of internal audit operations;

(5) An audit plan to govern internal audits; and

(6) The compliance of internal audits with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing.

(p) Internal auditors shall meet separately with any external auditor to coordinate audit plans to optimize the ability of the external auditor to rely upon the results of the internal audit team.

(q) The independent audit committee shall annually evaluate the performance of any internal audit, including:

(1) The adequacy of the audit plan;

(2) The management of the execution of the audit plan;

(3) The adequacy of human and other resources available to execute the audit plan;

(4) The ability of any external auditor to rely upon the internal audit work product in the annual audit performed by an external auditor retained pursuant to subsection (r); and

(5) The nature of the findings or results of any internal audits.

(r) Subject to approval by the board of regents, the independent audit committee shall select one or more external auditors to be retained by the University of Hawaii. The independent audit committee shall:

(1) Approve an audit plan;

(2) Establish the audit fees of any external auditor;

(3) Pre-approve any non-audit services provided by the external auditor, including tax services, before such services are rendered;

(4) Review with the president of the University of Hawaii the significance of contracting out audit services; and

(5) Ensure that single audit obligations are incorporated into an annual audit plan.

(s) The independent audit committee shall review all material written communications between any external auditor and the president of the University of Hawaii, including any management letter or schedule of unadjusted differences.

(t) The independent audit committee shall annually evaluate any external auditor; provided that communications with the external auditor in the evaluation shall be done so as to maintain the open flow of communication between the external auditor and the independent audit committee.

(u) The independent audit committee shall review the following matters relating to any annual audit with the president of the University of Hawaii and any external auditor:

(1) The university's annual financial statements and related footnotes;

(2) The external auditor's audit of the financial statements and the external auditor's report;

(3) The external auditor's judgments about the quality of the university's accounting principles as applied in the university's financial reporting;

(4) Any significant changes required in the external auditor's audit plan;

(5) Any serious difficulties or disputes with the president of the University of Hawaii encountered during the audit; and

(6) Matters to be discussed by the Statement on Auditing Standards No. 114, The Auditor's Communication with those Charged with Governance (AICPA, Professional Standards), related to the conduct of any annual audit.

(v) The independent audit committee may hire external auditors, legal counsel, or other consultants as necessary, to address any issues arising from:

(1) The execution of the whistleblower protection procedures subject to subsection (m);

(2) Any statutory or contractual procedures when engaging external resources; and

(3) The detection of fraud.

(w) The independent audit committee shall submit an annual report to the board of regents and the legislature no later than twenty days prior to the convening of each regular session of the legislature on matters that include the following:

(1) All instances of material weakness in internal control, including the responses of university management; and

(2) All instances of fraud, including the responses of university management. [L 2013, c 87, §5]