Loading...
HomeMy WebLinkAbout2019-11-12; City Council; ; Consideration of City Council Policy No. 89. - Internal Audit Framework and Audit Plan for the Remainder of Fiscal Year 2019-20.CA Review LvG ~ CITY COUNCIL ~ Staff Report Meeting Date: To: From: Staff Contact: Subject: Nov. 12, 2019 Mayor and City Council Scott Chadwick, City Manager Brigid Okyere, Internal Auditor Brigid.Okyere@carlsbadca.gov, 760-602-2429 Laura Rocha, Deputy City Manager, Administrative Services Laura.Rocha@carlsbadca.gov, 760-602-2415 Consideration of City Council Policy No. 89. -Internal Audit Framework and Audit Plan for the Remainder of Fiscal Year 2019-20. Recommended Action Adopt a Resolution approving City Council Policy No. 89 establishing the framework for an effective internal audit function and approving the Internal Audit Plan for the remainder of fiscal year 2019-20. Executive Summary Effective internal audit activity is established through an internal audit framework (framework). The attached City Council Policy No. 89 creates this framework for stating the Internal Audit Divisions' role and responsibilities. Additionally, at the Aug. 27, 2019, City Council meeting, the City Council received an informational presentation describing options for auditing The Crossings at Carlsbad Golf . Course (The Crossings). At the end of the presentation, the City Council directed staff to add criteria to the work plan of the internal auditor to perform an audit that includes standards of performance, internal controls, departmental oversight with The Crossings and the management of the restaurant and pro shop. The attached Internal Audit Plan proposes the internal audit activities for the remainder of fiscal year 2019-20, including the internal audit of The Crossings. Discussion Internal Audit Framework Previously, the city's internal auditor performed work as determined by the deputy city manager of administrative services and the finance director. The results of audit activities were not discussed publicly, and the internal auditor was not necessarily independent of the work under audit. The city's executive leadership recently modified the role of the internal auditor, focusing on independence and transparency. Nov. 12, 2019 Item #10 Page 1 of 10 The Association of Local Government Auditors' model legislation guidelines recommends a document, or framework, that sets forth the qualifications, duties, powers and manner of securing the office of the internal auditor. This framework helps ensure the internal auditor can report freely and provides public confidence that those reports are objective, fair and complete. The attached policy statement establishes a framework covering key aspects of an effective internal audit function. It describes the internal audit function's mission statement, access and authority, independence, professionalism and responsibilities. The responsibilities section describes the reporting of audit results and frequency of communication with the City Council. Annual Internal Audit Plan The city's internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Potential audits may include any city department, division, function or program administered by the city. The purpose of the fiscal year 2019-20 Internal Audit Plan is to outline audits and other activities the internal auditor proposes to conduct during the remainder of the fiscal year. The Internal Audit Plan serves as the primary work plan to carry out the responsibilities of the internal auditor. The attached Internal Audit Plan includes information about the basis for audit topics selected, potential objectives and the consideration of resources. Fiscal Analysis There is no immediate fiscal impact to adopting and approving City Council Policy No. 89 - Internal Audit Framework and the fiscal year 2019-20 Internal Audit Plan. Establishing an internal audit framework formalizes the responsibilities, reporting lines and protocols of the Internal Audit Division within the city. Next Steps If adopted by the City Council, City Council Policy No. 89 will be implemented by staff and the internal auditor will conduct the activities as cited in the fiscal year 2019-20 Internal Audit Plan. Environmental Evaluation (CEQA) Purs_uant to Public Resources Code section 21065, this action does not constitute a "project" within the meaning of CEQA in that it has no potential to cause either a direct physical change or a reasonably foreseeable indirect physical change in the environment, and therefore does not require environmental review. Public Notification and Outreach This item was noticed in accordance with the Ralph M. Brown Act and was available for viewing at least 72 hours prior to the scheduled meeting date. Exhibits 1. City Council Resolution. Nov. 12, 2019 Item #10 Page 2 of 10 RESOLUTION NO. 2019-227 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF CARLSBAD, CALIFORNIA, APPROVING CITY COUNCIL POLICY NO. 89 ESTABLISHING THE FRAMEWORK FOR AN EFFECTIVE INTERNAL AUDIT FUNCTION AND APPROVING THE AUDIT PLAN FOR THE REMAINDER OF FISCAL YEAR 2019-20 WHEREAS, the City Council of the City of Carlsbad, California has determined that internal audit activity adds value to the city's operations and goals; and WHEREAS, the City Council desires to establish a policy documenting the internal audit framework that sets forth the qualifications, duties, and powers of the city's internal auditor; and WHEREAS, the City Council shall review and approve an annual Internal Audit Plan that provides visibility of the City of Carlsbad's overall internal audit effort. NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows: 1. That the above recitations are true and correct. 2. That the City Council hereby approves the new City Council Policy No. 89 titled Internal Audit Framework as shown in Attachment A. 3. That the City Council hereby approves the Internal Audit Plan for fiscal year 2019- 20 as shown in Attachment B. PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 12th day of November 2019, by the following vote, to wit: AYES: Hall, Blackburn, Bhat-Patel, Schumacher. NAYS: None. ABSENT: None. f ~ He.ct« 6,1"Je71 ~ 1~1' BARBARA ENGLESON, City Clerk t i°1j (SEAL) CJeo./ Nov. 12, 2019 Item #10 Page 3 of 10 Ccicyof Policy No. 89 Date Issued: 11-12-19 Carlsbad Effective Date: 11-12-19 Resolution No. 2019-227 Cancellation Date: N/A Supersedes No. N/A Council Policy Statement Category: INTERNAL AUDIT Specific Subject: Internal Audit Framework PURPOSE: To establish a City Council policy formalizing the responsibilities, reporting lines, and protocols of internal audit within the structure of the city. BACKGROUND: Internal audit is governed by an Internal Audit Framework (framework) that defines the requirements, audit standards, and responsibilities for internal audit activities. An Internal Audit Framework is a formal document that establishes the internal document activity's position within the organization, including the nature of the internal auditor's functional reporting relationship with City Council; it authorizes access to records, personnel, and physical properties relevant to the performance of engagements; and it defines the scope of internal audit activities. Final approval of the Internal Audit Framework resides with the City Council. This framework defines the mission, scope, commitment to quality, authority and accountability, independence and responsibility of the city's Internal Audit Division. POLICY: Mission The city's Internal Audit Division provides highly reliable, independent, objective assurance and consulting services designed to safeguard city resources and improve city operations. The Internal Audit Division accomplishes this by bringing a systematic, disciplined approach to evaluating and recommending improvements to the effectiveness of risk management, controls and governance processes. Scope The scope of the Internal Audit Division's authority includes all operations under the direction of the City Council and the city manager. It encompasses the examination and evaluation of the adequacy and effectiveness of the city's systems of internal controls and the quality of performance in carrying out assigned responsibilities. The scope of work performed by the Internal Audit Division is to determine whether the city's network of risk management, control and governance processes as designed and represented by management, is adequate and functioning to ensure: • Risks are appropriately identified and managed; • Significant financial, managerial, and operating information is accurate, reliable and timely; Page 1 of 4 Nov. 12, 2019 Item #10 Page 4 of 10 Policy No. 89 • The process to acquire resources is economical, used efficiently, and are adequately protected; • Programs, plans, and projects are operated within the fiduciary standards and regulatory requirements, are compliant with city policies and stated objectives are achieved; • Quality service and continued improvement are fostered within the city's control process; • Significant legislative and regulatory issues impacting the city are recognized, addressed appropriately, and interaction with governance groups occurs; • Employees' actions comply with policies, standards, procedures, and applicable laws and regulations; • Contractors are meeting contract requirements in conformance with applicable laws, regulations, policies, procedures, and best practices; • Existing policies and procedures are appropriate, updated and being followed; and • Opportunities for improving management control, streamlining processes, and improving public perception are implemented. Access & Authority The Internal Audit Division has the authority to audit all areas of the city and is authorized to: • Have full, free, and unrestricted access to all records, functions, operations, systems, property, and personnel pertinent to carrying out any engagement. The Internal Audit Division will maintain confidentiality of all information provided subject to legal requirements. Documents provided to the Internal Audit Division will be handled in the same prudent manner as by those employees normally accountable for them. • Select audit topics, set audit frequencies, determine scope of work, and apply the techniques required to accomplish audit objectives. • Conduct investigations of any suspected inappropriate activity, including suspected fraudulent acts. • Have access to the necessary city personnel in functions where audits are being performed, as well as external consultants that provide other specialized services. Access to third parties will be handled in accordance with contractual terms. All employees will cooperate fully in making available material or information requested by the Internal Audit Division or any external auditors managed by the Internal Audit Division. The Internal Audit Division is not authorized to: • Initiate or approve accounting transactions external to internal audit; or • Direct the activities of any employee not part of the Internal Audit Division except to the extent such employees have been appropriately assigned to auditing teams. Independence and Objectivity To be structurally independent, the Internal Audit Division is set up to report functionally to the City Council and administratively to the Deputy City Manager of Administrative Services. The City Council members are elected to office, and thus, responsible to the citizens and taxpayers of the city. The Internal Audit Division is not part of any department that the Deputy City Manager of Administrative Services oversees. The Internal Audit Division has no direct responsibility to, or authority over, any area subject to its audit, review, or investigation. Therefore, the Internal Audit Division is organizationally independent from those areas that it reviews, audits, and/or investigates. The Internal Audit Division will report results and have direct access to the City Council. The Internal Audit Division will report any impairment to independence, or unjustified restriction or limitation to Page 2 of 4 Nov. 12, 2019 Item #10 Page 5 of 10 Policy No. 89 audit selection, scope, procedures, frequency, timing, or report content promptly to the city manager and the City Council. These reporting relationships not only ensure independence, but also assure comprehensive audit coverage and adequate consideration of audit recommendations. Additionally, the City Council will be notified upon any appointment, replacement, or dismissal of the internal auditor. The position of internal auditor fulfills the independence requirement by separating the duty from the Deputy City Manager of Administrative Services. As such, the internal auditor will sign all official correspondence including, but not limited to final audit reports, audit announcement letters, and letters of communication to other city departments and elected officials. The Internal Audit Division will exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. The Internal Audit Division will make balanced assessments of all the relevant circumstances and not be unduly influenced by personal interests or by others in forming judgments. Professionalism The Internal Audit Division is guided by government auditing standards and determines the processes for operating and conducting its work according to government auditing standards in its policies and procedures manual. The Internal Audit Division will perform and report on all audit activities with due professional care in accordance with its policies and procedures manual. Responsibility The Internal Audit Division is responsible for all internal auditing activities for the City of Carlsbad. Its primary responsibility is to conduct performance audits that improve the economy, efficiency, and effectiveness of city government. The Internal Audit Division will also conduct other non-audit services that are advisory in nature, if these services do not impair the auditor's independence. Additionally, the Internal Audit Division is responsible for the following: • Develop and perform work based on a flexible annual audit plan, considering risks and control concerns expressed by management and/or the City Council, submitted to the city manager and the City Council for review and approval each year. This provides the City Council with an opportunity to approve the annual internal audit plan or to provide comments and feedback for modification of the schedule projects. • Review and adjust the annual audit plan as necessary in response to changes in the city's operations, programs, controls, and/or identified risks. The city internal auditor will communicate significant revisions to the annual audit plan to the city manager and the City Council for review and approval. The city manager has authority to approve minor changes or insignificant modifications to the annual audit plan through an expedited process. • Report audit findings to appropriate personnel, including the city manager, the City Council, and city personnel responsible for implementing recommendations. • Communicate results of audit activities and progress on the annual audit plan twice a year to the city manager and the City Council. • Provide management with adequate time to respond to audit findings and include management's response in the audit report. • Follow up on audit findings recommendations and provide periodic follow up reports summarizing the status of corrective actions taken. • Ensure that staff participating in internal audit activities possess the knowledge, skills, and other competencies needed to meet the requirements of this framework. Page 3 of 4 Nov. 12, 2019 Item #10 Page 6 of 10 Policy No. 89 • Ensure that staff participating in internal audit activities are independent during any period of time that falls within the period covered by the subject matter of the audit and the period of the professional engagement. City management is responsible for the following: • Maintain an effective system of internal controls, document policy and procedures, and ensure information is accurate, timely, and reliable. • Cooperate with the Internal Audit Division and promptly reply to requests and recommendations. • Respond to audit findings and recommendations. • Assure timely implementation of agreed-upon corrective actions to audit recommendations or accept the risk of non-implementation. Any changes made to this document must be approved by the City Council. Page 4 of 4 Nov. 12, 2019 Item #10 Page 7 of 10 Internal Audit Division Attachment B Fiscal Year 2019-20 Internal Audit Plan (city of Carlsbad Nov. 12, 2019 Item #10 Page 8 of 10 OVERVIEW The City of Carlsbad's internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Internal audits help to mitigate risks by recommending specific improvements to city processes and controls. Potential audits may include any city department, division, function, or program administered by the city. The purpose of the fiscal year 2019-20 internal audit plan (audit plan) is to outline audits and other activities the internal auditor proposes to conduct during the fiscal year. This document serves as the primary work plan tb carry out the responsibilities of the internal auditor. The basis for the plan comes from auditor observations, inquiries with management, audit requests from the City Council and city management, and potential areas of risk. The internal auditor's strategy in developing this plan seeks to identify, prioritize and manage audits deemed critical to city operations, programs and systems. Currently, the Internal Audit Division is comprised of one full-time internal auditor. The audit plan considers available staff hours, level of expertise and experience, estimated size and complexity of audits, time allocated to satisfy continuing professional education requirements, time allocated to performing audit follow-up procedures, and use of external consultants/auditors. The audit plan is a working document. During the year, causes for changes to the audit plan may include an increase or decrease in audit scope, additional or pressing audit requests, or an excessive threat to auditor independence. As such, projects initiated in the current year may carry over into the following fiscal year. Planned audits are listed on the following page with potential objectives. During the preliminary work period, the internal auditor will establish familiarity with the department and/or function by conducting background interviews and research. At that time, audit objectives may be refined and methodology will be developed. Fiscal Year 2019-20 Internal Audit Plan (city of Carlsbad Nov. 12, 2019 Item #10 Page 9 of 10 Fiscal Year 2019-20 (Remainder) Planned Audits Audit Topic Performed Audited Entity by Citywide Cash Internal Various Count Auditor departments The Crossings Internal The Crossings at at Carlsbad Auditor Carlsbad Golf Golf Course Course; JC Resorts Management; City of Carlsbad Finance Department, Parks & Recreation Department, and other departments as necessary Transient External Various hotels as .Occupancy firm determined by city Tax City Credit Internal Various Cards Auditor departments Fiscal Year 2019-20 Internal Audit Plan • • • • • • • • Potential Objectives To count the cash at various city departments and compare with city records. To assess JC Resorts Management's compliance with city's sexual harassment policies and procedures and other mandated guidelines. To assess the financial performance of the pro shop and food and beverage. To review The Crossings' overall financial health against comparable nearby golf courses and the general golf market to assess financial sustainability. To determine whether various city departments provide adequate oversight of and services to The Crossings. To determine if a hotel is properly reporting and remitting the tax in compliance with city ordinance. To determine whether the city's credit card policies and procedures function as management intended and comply with applicable state and federal laws. To assess individual and departmental transaction, purchase, and issuance compliance. {city of Carlsbad Nov. 12, 2019 Item #10 Page 10 of 10 Establishing an Effective Internal Audit Function & Presenting the Annual Audit Plan Brigid Okyere, Internal Auditor Laura Rocha, Deputy City Manager, Administrative Services Nov. 12, 2019 Internal Audit Framework •The Association of Local Government Auditors recommends a document or “framework” that sets forth the qualifications, duties, powers and manner of securing the office of the internal auditor. •Helps ensure the internal auditor can report freely •Offers public confidence that those reports are objective, fair, and complete 2 Internal Audit Framework Contents •Mission statement •Auditing standards •Independence •Other key elements Mission Statement The city’s Internal Audit Division provides highly reliable, independent, objective assurance and consulting services designed to safeguard city resources and improve city operations. 4 Audit Standards •Establish attributes for a quality audit •Independence, planning, conducting, reporting, quality •Government Auditing Standards –“Yellow Book” •The Internal Audit Manual guides operations and aligns with the Yellow Book 5 GOVERNMENT AUDITING STANDARDS 2018 Revision Independence •Accountable to the deputy city manager of administrative services •Report results to both the deputy city manager and the City Council •Located organizationally outside of the staff of any department that may be audited •Access to the City Council •Removed from pressures; ability to conduct engagements objectively without fear of reprisal 6 Independence 7 City Council City Manager Chief Operations Officer Deputy City Manager, Admin. Services Finance Human Resources Information Technology Internal Auditor Establishes Other Key Elements •Authority and access •Frequency and content of communication to the City Council –Receive results of audit activities twice a year –Approve annual audit plan •Management’s response to audits & follow-up •Responsibilities of internal auditor •City management’s responsibility and cooperation 8 Annual Audit Plan •Covers the remainder of FY 2019-20 •Internal auditor will propose FY 2020-21 audit plan in April 2020 9 10 Topic Auditor Potential Objectives Citywide cash count Internal auditor •To count the cash at various city department facilities and compare with city records. The Crossings at Carlsbad Golf Course Internal auditor •To assess golf course/management company’s compliance with city’s sexual harassment policies and procedures and other mandated guidelines. •To assess the financial performance of the pro shop and food and beverage. •To review the golf course’s overall financial performance against comparable nearby golf courses and the golf market to assess financial sustainability. •To determine whether various city departments provide adequate oversight of and services to the golf course. The city’s credit card program Internal auditor •To determine whether the city’s credit card policies and procedures are function as management intended and comply with applicable state and federal laws. •To assess individual and departmental transaction, purchase, and issuance compliance. Transient occupancy tax External audit firm To determine if a hotel is properly reporting and remitting the tax in compliance with city ordinance. Recommendation •That the City Council adopt a Resolution approving: –The City Council Policy No. 89 establishing the Internal Audit Framework –the Internal Audit Plan for the remainder of FY 2019-20 Thank You