HomeMy WebLinkAbout2022-08-16; City Council; ; Fiscal Year 2022-23 Internal Audit Plan and Update on Audit ActivitiesCA Review CKM
Meeting Date: Aug. 16, 2022
To: Mayor and City Council
From: Scott Chadwick, City Manager
Staff Contact: Robert Threatt, Internal Audit Manager
robert.threatt@carlsbadca.gov, 442-339-2418
Laura Rocha, Deputy City Manager, Administrative Services
laura.rocha@carlsbadca.gov, 442-339-2415
Subject: Fiscal Year 2022-23 Internal Audit Plan and Update on Audit Activities
Recommended Action
1.Receive a report on the results of internal audit activities and the annual audit plan for
fiscal year 2021-22.
2.Adopt a resolution approving the Internal Audit Plan for fiscal year 2022-23.
Executive Summary
The city’s internal audit program examines city operations to ensure city resources are being
used effectively and appropriately and city procedures are being followed. The internal audit
plan for each fiscal year is developed for the City Council’s review and approval each fiscal year,
in accordance with City Council Policy No. 89. The plan is attached as Attachment A to Exhibit 1.
This policy also requires the city’s internal auditor to communicate progress on the annual audit
plan along with the status of any open recommendations from past audit engagements to the
City Manager and the City Council twice a year.
Reports on each audit are distributed to city management and the City Council as they are
completed during the year and are available to the public on the city’s internal audit webpage
(carlsbadca.gov/departments/internal-audits).
Discussion
Annual Internal Audit Plan
The city’s internal audit manager performs independent and objective assurance services to
safeguard city resources and improve city operations. Such services may include internal audits
of any city department, division, function or program. The audit plan outlines the internal
audits and other value-added engagements the internal audit manager proposes to conduct
during the fiscal year.
Aug. 16, 2022 Item #12 Page 1 of 9
The attached Internal Audit Plan for fiscal year 2022-23 includes information about the basis for
the audit engagements selected, their preliminary objectives, and the resources that will be
required. It includes two engagements carried over from the previous year’s audit plan and four
new engagement audits for the City Council’s consideration. Once approved, the internal audit
plan serves as the operating roadmap for the city’s internal audit manager.
Each internal audit engagement is detailed in a report that summarizes the auditor’s findings
and recommends corrective actions to city departments, when necessary. An engagement
could be a detailed audit of a major city program or a less comprehensive “agreed-upon-
procedures review,” which examines certain specified aspects of city operations.
Proposed internal audit engagements in FY 2022-23
Carried over from FY 2021-22
• Procurement program audit
• Vice Narcotics Intelligence Unit “Buy Fund” compliance review
New for FY 2022-23
• Transient occupancy tax agreed-upon-procedures review engagement
• Payroll recordkeeping, data entry and segregation of duties audit
• City’s intake process associated with transient occupancy tax revenue receipts and
recordkeeping audit
• Information technology system user access audit
Annual internal audit update
Two audit engagements were discussed during the last update to the City Council, on March 22,
2022. The first was the city’s credit card program audit, performed in FY 2020-21. At the time of
the update, there were two audit recommendations that remained open.
The second was the code enforcement program audit. That engagement had just been
completed and consisted of four open audit recommendations. The status of the referenced
audit recommendations is detailed in Exhibit 2.
A summary of the fiscal year 2021-22 internal audit activities is provided as Exhibit 3.
Fiscal Analysis
There is no immediate fiscal impact to approving the fiscal year 2022-23 Internal Audit Plan as
there is sufficient funding in the fiscal year 2022-23 budget to execute the proposed Internal
Audit Plan.
Next Steps
If accepted as presented, the city’s internal audit manager will conduct the engagements as
cited in the fiscal year 2022-23 Internal Audit Plan.
Environmental Evaluation
This action does not constitute a project within the meaning of the California Environmental
Quality Act under California Public Resources Code Section 21065 in that it has no potential to
cause either a direct physical change in the environment or a reasonably foreseeable indirect
physical change in the environment and therefore does not require environmental review.
Aug. 16, 2022 Item #12 Page 2 of 9
Public Notification
This item was noticed in accordance with the Ralph M. Brown Act and was available for viewing
at least 72 hours prior to the scheduled meeting date.
Exhibits
1.City Council resolution
2.Open audit recommendations status update
3.Fiscal year 2021-2022 audit activities
Aug. 16, 2022 Item #12 Page 3 of 9
RESOLUTION NO. 2022-207
A RESOLUTION OF THE CITY COUNPL OF THE CITY OF CARLSBAD,
CALIFORNIA, APPROVING THE FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN
WHEREAS, the city's internal audit manager performs independent and objective assurance
services to safeguard city resources and improve city operations; and
WHEREAS, the services provided may include internal audits of any city department, division,
function or program; and
WHEREAS, as required by City Council Policy No. 89, the internal audit manager has presented
a Fiscal Year (FY) 2022-23 Internal Audit Plan (Attachment A) for the City Council's review and approval;
and
WHEREAS, the purpose of the FY 2022-23 Internal Audit Plan is to outline internal audits and
other value-added engagements the internal audit manager proposes to conduct during the fiscal year;
and
WHEREAS, the FY 2022-23 Internal Audit Plan includes information about the basis for the audit
engagements selected, preliminary objectives and the consideration of resources; and
WHEREAS, once approved, the FY 2022-23 Internal Audit Plan will serve as the operating
roadmap for the city's internal audit manager.
NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as
follows:
1.That the above recitations are true and correct.
2.That the City Council approves the FY 2022-23 Internal Audit Plan as shown in
Attachment A.
PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of
Carlsbad on the 16th day of August, 2022, by the following vote, to wit:
AYES:
NAYS:
ABSENT:
Hall, Blackburn, Bhat-Patel, Acosta, Norby.
None.
None.
� FAVIOLA MEDINA, City Clerk Services Manager
(SEAL)
Exhibit 1
Aug. 16, 2022 Item #12 Page 4 of 9
MATT H::;1-ff M ~ ------
t1vL
Attachment A
Fiscal Year 2019-20 Internal Audit Plan
Fiscal Year
2022-23
Internal Audit
Plan
Aug. 16, 2022 Item #12 Page 5 of 9
(city of
Carlsbad
Attachment A
Fiscal Year 2022-23 Internal Audit Plan
OVERVIEW
The City of Carlsbad’s internal auditor performs independent and objective assurance services to
safeguard city resources and improve city operations. Internal audits help to mitigate risks by
recommending improvements to the city’s internal controls and governance, risk, and compliance
processes. Potential audits may include any city department, division, function, or program
administered by the city.
The purpose of the annual internal audit plan is to outline audits and other value-added engagements
the internal auditor proposes to conduct during the current fiscal year. This document serves as the
primary work plan to carry out the responsibilities of the internal auditor. The basis for the audit plan
comes from auditor observations, inquiries of management, audit requests from the City Council and
senior management, and programs or processes with inherently higher risk levels. The internal
auditor’s strategy in developing this plan seeks to identify, prioritize, and manage audits important to
city operations, programs, and systems.
Currently, the Internal Audit Division is comprised of one full-time internal auditor. The internal audit plan considers available staff hours, level of expertise and experience, the estimated size and
complexity of audits, time allocated to satisfy continuing professional education requirements, time
allocated to performing audit follow-up procedures, and use of external consultants/auditors.
The internal audit plan is a working document. During the year, causes for changes to the audit plan
may include an increase or decrease in audit scope, additional or pressing audit requests, or a threat
to auditor independence. As such, projects initiated in the current year may carry over into the
following fiscal year.
The following page identifies the list of prioritized internal audit engagements for FY 2022-23, along
with their preliminary objectives. At the beginning of each engagement, the internal auditor will
establish familiarity with the department, function or process identified for audit. During that initial
period, audit objectives may be refined, and the methodology will be established.
Aug. 16, 2022 Item #12 Page 6 of 9
{city of
Carlsbad
Attachment A
Fiscal Year 2022-23 Internal Audit Plan
Fiscal Year 2022-23 Internal Audit Engagements
Entity, Function,
Program or
Process to Audit
Type of
Engagement
Primary
Stakeholder/Audit
Lead
Preliminary Objectives
Carryover from FY 2021-22
Procurement Internal Audit Various
departments/
Internal Audit
Manager
• To assess the city’s compliance with
applicable procurement guidelines.
• To evaluate whether the city’s
procurement process is effective and
adhered to.
Vice Narcotics
Intelligence Unit
(VNIU) “Buy
Fund”
Internal Audit Police
Department/Internal
Audit Manager
• To determine whether the fund was
managed and accounted for in
accordance with authorized policies
and procedures.
New for FY 2022-23
Transient
Occupancy Tax
Agreed Upon
Procedure
Various hotels as
determined by
city/External Audit
Firm
• To determine if hotels are properly
reporting and remitting occupancy
taxes in compliance with city
ordinance.
Revenue Audit Internal Audit Finance
Department/Internal
Audit Manager
• Evaluate the city’s receipt and
recordkeeping associated with its
transient occupancy tax revenues.
Payroll Audit Internal Audit Human
Resources/Finance
Department/Internal
Audit Manager
• Evaluate the city’s payroll
recordkeeping and data entry.
• Evaluate the city’s segregation of
duties.
Business
Application User
Access
Internal Audit Information
Technology
Department/Internal
Audit Manager
• Evaluate the city’s management of
user access across its enterprise
resource planning systems and
software applications.
Aug. 16, 2022 Item #12 Page 7 of 9
{city of
Carlsbad
City of Carlsbad
Status of Open Internal Audit Recommendations
Audit Engagements: 2021-01 City Credit Card Program Audit and 2022-01 Code Enforcement Program Audit
City Council Date: August 16, 2022
No.Recommendation Department Status
1 The Finance Department should communicate guidance citywide about the taxability of
employee appreciation related items and gifts to ensure that city departments give and
report them in compliance with the Internal Revenue Code.
Finance Department Complete - The Finance Department sent out a city-wide
email on June 16, 2022 titled, "Employee Taxable Benefits
Guidance" which addresses this item.
2 To ensure that lodging purchases made during city business-related travel are
appropriate, the Finance Department should update its travel guidelines and procedures
to adopt either the state or the federal government’s annual lodging rates by
geographic location, and require employees to submit written justification when rates
must exceed these established maximums.
Finance Department In progress - The Finance Department is incorporating this
recommendation into an update of the city's travel policy.
The specific audit recommendation will be addressed by
adopting the federal GSA rates while allowing the approval
of exceptions with justification.
No.Recommendation Department Status
1 The Code Enforcement Division should immediately begin the implementation of a code
enforcement procedure manual to serve as both a training and operations resource for
staff.
Community Development In progress - The code enforcement procedure manual is in
final review with City Attorney's Office.
2 Management should identify a code enforcement officer to serve as a training
coordinator for the division. Identifying such a role will help ensure the code
enforcement officers continue to maintain their uniform approach to addressing
complaints and serving the city’s residents. The uniformity will result in part from having
a single point of contact for training and from the implementation of a code
enforcement procedure manual as noted in recommendation #1.
Community Development Complete - The code enforcement division has hired a
senior code enforcement officer who is serving in this
capacity.
3 To evaluate the performance of its code enforcement officers and to maximize the use
of code enforcement data residing in EnerGov, the Code Enforcement Division must
identify and monitor key metrics. Once specific metrics are identified, code enforcement
staff should coordinate with the Information Technology Department to determine how
to best extract this information from EnerGov. If EnerGov is unable to support this
activity, the city should prioritize the identification or procurement of a software
application that can.
Community Development In progress - The Code Enforcement Division is finalizing a
technical specification that identifies the data (metrics)
they are seeking to track. They will present that request to
the IT Department staff to determine if EnerGov can
provide the necessary data and reports. If EnerGov is
unable to, they will ask IT to recommend a system that can.
4 The auditor recommends that the IT and Community Development Departments
coordinate a recurring meeting (bi-monthly, monthly, etc.) that brings together all
divisions within Community Development to discuss and prioritize ServiceNow requests
that originated during the period related to the EnerGov system.
Community Development Complete - The divisions within Community Development
meet with the Information Technology Department staff on
a bi-monthly basis to discuss open tickets and to facilitate
resolutions.
2021-01 City Credit Card Program Audit
2022-02 Code Enforcement Audit Report Exhibit 2Aug. 16, 2022Item #12 Page 8 of 9
Fiscal Year 2021‐22, Internal Audit Activities UpdateCity of Carlsbad, CA Exhibit 3No.Entity, Unit or Program Type of Engagement Primary Stakeholder/Audit Lead Status1Code Enforcement AuditInternal Audit Community Development/Internal Audit Manager Complete 2Fraud & Ethics Hotline Program EvaluationInternal Audit Manager Complete 3Transient Occupancy Tax Agreed Upon Procedures Various hotels/External audit firm In Process4City of Carlsbad Risk Assessment Various departments/Internal Audit Manager In Process6Procurement Internal Audit Various departments/Internal Audit Manager Rolled to fiscal year 2022‐235 Vice Narcotics Investigative Unit (VNIU) Internal Audit Police Department/Internal Audit Manager Rolled to fiscal year 2022‐23123456Fiscal Year 2021‐22 Internal Audit Activities This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan. The code enforcement audit was completed in fiscal year 2021‐22 and the results were presented to the City Council on March 22, 2022. Status Notes: The fraud and ethics hotline evaluation was completed in fiscal year 2021‐22. City staff presented recommendations to the City Council on April 5, 2022. At that meeting, City Council approved the implementation of a 3rd party hosted fraud and ethics hotline. The city has since selected Navex Global Inc. to implement the hotline. The hotline has been fully developed and the fraud and ethics hotline administrative order is undergoing final review. Following the completion of the administrative order, the City will go live with the hotline. The city's annual transient occupancy tax review engagement is performed by an external CPA firm. This engagement is 90% complete and the audit firm is wrapping up their review procedures. The citywide risk assessment engagement is 50% complete. The survey questions have been prepared and the survey is ready to be assigned to the leadership team for completion. Following the completion of the survey, the city's internal auditor will meet one on one with management to discuss their responses and then finally all inputs will be scored and a risk ranking applied to the city's different programs. The risk assessment will aide the city in developing future internal audit plans and prioritizing future internal audit engagements. This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan. Audit planning has begun for this engagement. Exhibit 3
Aug. 16, 2022 Item #12 Page 9 of 9
Internal Audit Update and
Fiscal Year 2022-23 Internal
Audit Plan
Robert Threatt, Internal Audit Manager
Administrative Services Branch
August 16, 2022
TODAY’S PRESENTATION
•Overview
•Status of open internal audit recommendations
•Update on fiscal year 2021-22 internal audit activities
•Present fiscal year 2022-23 internal audit plan
ITEM 12: Internal Audit Update and Plan
PROPOSED ACTION
Adopt resolution approving the fiscal
year 2022-23 Internal Audit Plan.
ITEM 12: Internal Audit Update and Plan
STATUS: INTERNAL AUDIT RECOMMENDATIONS
•For business related travel,city should follow state or
federal guidelines to ensure appropriateness
•In-process:As part of a travel policy update,the
Finance Department is adopting federal General
Services Administration guidelines for travel
reimbursements
Credit Card Program Audit
STATUS: INTERNAL AUDIT RECOMMENDATIONS
•Using data maintained in the EnerGov system,identify
and monitor key metrics for trend analysis and staff
development purposes
•In-process:Technical specification being developed,
and staff will coordinate with Information
Technology Department to develop reports or
queries that provided the required metrics
Code Enforcement Program Audit
FISCAL YEAR 2021-22 AUDIT ACTIVITIES
•Status of internal audit engagements
•Completed (2): Code enforcement audit & fraud
and ethics hotline evaluation and recommendation
•Ongoing (2): Transient Occupancy Tax review and
citywide risk assessment
•Included in fiscal year 2022-23 Internal Audit Plan
(2): Procurement program audit and Vice Narcotics
Intelligence Unit “Buy Fund” review
Annual Update
FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN
•Procurement program audit*
•Vice Narcotics Intelligence Unit “Buy Fund” policy
review*
•Transient Occupancy Tax review
•Payroll process audit
•Revenue audit
•Business application user access review
(*Engagements from fiscal year 2021-22)
Proposed Audit Engagements
PROPOSED ACTION
Adopt resolution approving the fiscal
year 2022-23 Internal Audit Plan.
ITEM 12: Internal Audit Plan and Update