Loading...
HomeMy WebLinkAbout2022-08-16; City Council; ; Fiscal Year 2022-23 Internal Audit Plan and Update on Audit ActivitiesCA Review CKM Meeting Date: Aug. 16, 2022 To: Mayor and City Council From: Scott Chadwick, City Manager Staff Contact: Robert Threatt, Internal Audit Manager robert.threatt@carlsbadca.gov, 442-339-2418 Laura Rocha, Deputy City Manager, Administrative Services laura.rocha@carlsbadca.gov, 442-339-2415 Subject: Fiscal Year 2022-23 Internal Audit Plan and Update on Audit Activities Recommended Action 1.Receive a report on the results of internal audit activities and the annual audit plan for fiscal year 2021-22. 2.Adopt a resolution approving the Internal Audit Plan for fiscal year 2022-23. Executive Summary The city’s internal audit program examines city operations to ensure city resources are being used effectively and appropriately and city procedures are being followed. The internal audit plan for each fiscal year is developed for the City Council’s review and approval each fiscal year, in accordance with City Council Policy No. 89. The plan is attached as Attachment A to Exhibit 1. This policy also requires the city’s internal auditor to communicate progress on the annual audit plan along with the status of any open recommendations from past audit engagements to the City Manager and the City Council twice a year. Reports on each audit are distributed to city management and the City Council as they are completed during the year and are available to the public on the city’s internal audit webpage (carlsbadca.gov/departments/internal-audits). Discussion Annual Internal Audit Plan The city’s internal audit manager performs independent and objective assurance services to safeguard city resources and improve city operations. Such services may include internal audits of any city department, division, function or program. The audit plan outlines the internal audits and other value-added engagements the internal audit manager proposes to conduct during the fiscal year. Aug. 16, 2022 Item #12 Page 1 of 9 The attached Internal Audit Plan for fiscal year 2022-23 includes information about the basis for the audit engagements selected, their preliminary objectives, and the resources that will be required. It includes two engagements carried over from the previous year’s audit plan and four new engagement audits for the City Council’s consideration. Once approved, the internal audit plan serves as the operating roadmap for the city’s internal audit manager. Each internal audit engagement is detailed in a report that summarizes the auditor’s findings and recommends corrective actions to city departments, when necessary. An engagement could be a detailed audit of a major city program or a less comprehensive “agreed-upon- procedures review,” which examines certain specified aspects of city operations. Proposed internal audit engagements in FY 2022-23 Carried over from FY 2021-22 • Procurement program audit • Vice Narcotics Intelligence Unit “Buy Fund” compliance review New for FY 2022-23 • Transient occupancy tax agreed-upon-procedures review engagement • Payroll recordkeeping, data entry and segregation of duties audit • City’s intake process associated with transient occupancy tax revenue receipts and recordkeeping audit • Information technology system user access audit Annual internal audit update Two audit engagements were discussed during the last update to the City Council, on March 22, 2022. The first was the city’s credit card program audit, performed in FY 2020-21. At the time of the update, there were two audit recommendations that remained open. The second was the code enforcement program audit. That engagement had just been completed and consisted of four open audit recommendations. The status of the referenced audit recommendations is detailed in Exhibit 2. A summary of the fiscal year 2021-22 internal audit activities is provided as Exhibit 3. Fiscal Analysis There is no immediate fiscal impact to approving the fiscal year 2022-23 Internal Audit Plan as there is sufficient funding in the fiscal year 2022-23 budget to execute the proposed Internal Audit Plan. Next Steps If accepted as presented, the city’s internal audit manager will conduct the engagements as cited in the fiscal year 2022-23 Internal Audit Plan. Environmental Evaluation This action does not constitute a project within the meaning of the California Environmental Quality Act under California Public Resources Code Section 21065 in that it has no potential to cause either a direct physical change in the environment or a reasonably foreseeable indirect physical change in the environment and therefore does not require environmental review. Aug. 16, 2022 Item #12 Page 2 of 9 Public Notification This item was noticed in accordance with the Ralph M. Brown Act and was available for viewing at least 72 hours prior to the scheduled meeting date. Exhibits 1.City Council resolution 2.Open audit recommendations status update 3.Fiscal year 2021-2022 audit activities Aug. 16, 2022 Item #12 Page 3 of 9 RESOLUTION NO. 2022-207 A RESOLUTION OF THE CITY COUNPL OF THE CITY OF CARLSBAD, CALIFORNIA, APPROVING THE FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN WHEREAS, the city's internal audit manager performs independent and objective assurance services to safeguard city resources and improve city operations; and WHEREAS, the services provided may include internal audits of any city department, division, function or program; and WHEREAS, as required by City Council Policy No. 89, the internal audit manager has presented a Fiscal Year (FY) 2022-23 Internal Audit Plan (Attachment A) for the City Council's review and approval; and WHEREAS, the purpose of the FY 2022-23 Internal Audit Plan is to outline internal audits and other value-added engagements the internal audit manager proposes to conduct during the fiscal year; and WHEREAS, the FY 2022-23 Internal Audit Plan includes information about the basis for the audit engagements selected, preliminary objectives and the consideration of resources; and WHEREAS, once approved, the FY 2022-23 Internal Audit Plan will serve as the operating roadmap for the city's internal audit manager. NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows: 1.That the above recitations are true and correct. 2.That the City Council approves the FY 2022-23 Internal Audit Plan as shown in Attachment A. PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 16th day of August, 2022, by the following vote, to wit: AYES: NAYS: ABSENT: Hall, Blackburn, Bhat-Patel, Acosta, Norby. None. None. � FAVIOLA MEDINA, City Clerk Services Manager (SEAL) Exhibit 1 Aug. 16, 2022 Item #12 Page 4 of 9 MATT H::;1-ff M ~ ------ t1vL Attachment A Fiscal Year 2019-20 Internal Audit Plan Fiscal Year 2022-23 Internal Audit Plan Aug. 16, 2022 Item #12 Page 5 of 9 (city of Carlsbad Attachment A Fiscal Year 2022-23 Internal Audit Plan OVERVIEW The City of Carlsbad’s internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Internal audits help to mitigate risks by recommending improvements to the city’s internal controls and governance, risk, and compliance processes. Potential audits may include any city department, division, function, or program administered by the city. The purpose of the annual internal audit plan is to outline audits and other value-added engagements the internal auditor proposes to conduct during the current fiscal year. This document serves as the primary work plan to carry out the responsibilities of the internal auditor. The basis for the audit plan comes from auditor observations, inquiries of management, audit requests from the City Council and senior management, and programs or processes with inherently higher risk levels. The internal auditor’s strategy in developing this plan seeks to identify, prioritize, and manage audits important to city operations, programs, and systems. Currently, the Internal Audit Division is comprised of one full-time internal auditor. The internal audit plan considers available staff hours, level of expertise and experience, the estimated size and complexity of audits, time allocated to satisfy continuing professional education requirements, time allocated to performing audit follow-up procedures, and use of external consultants/auditors. The internal audit plan is a working document. During the year, causes for changes to the audit plan may include an increase or decrease in audit scope, additional or pressing audit requests, or a threat to auditor independence. As such, projects initiated in the current year may carry over into the following fiscal year. The following page identifies the list of prioritized internal audit engagements for FY 2022-23, along with their preliminary objectives. At the beginning of each engagement, the internal auditor will establish familiarity with the department, function or process identified for audit. During that initial period, audit objectives may be refined, and the methodology will be established. Aug. 16, 2022 Item #12 Page 6 of 9 {city of Carlsbad Attachment A Fiscal Year 2022-23 Internal Audit Plan Fiscal Year 2022-23 Internal Audit Engagements Entity, Function, Program or Process to Audit Type of Engagement Primary Stakeholder/Audit Lead Preliminary Objectives Carryover from FY 2021-22 Procurement Internal Audit Various departments/ Internal Audit Manager • To assess the city’s compliance with applicable procurement guidelines. • To evaluate whether the city’s procurement process is effective and adhered to. Vice Narcotics Intelligence Unit (VNIU) “Buy Fund” Internal Audit Police Department/Internal Audit Manager • To determine whether the fund was managed and accounted for in accordance with authorized policies and procedures. New for FY 2022-23 Transient Occupancy Tax Agreed Upon Procedure Various hotels as determined by city/External Audit Firm • To determine if hotels are properly reporting and remitting occupancy taxes in compliance with city ordinance. Revenue Audit Internal Audit Finance Department/Internal Audit Manager • Evaluate the city’s receipt and recordkeeping associated with its transient occupancy tax revenues. Payroll Audit Internal Audit Human Resources/Finance Department/Internal Audit Manager • Evaluate the city’s payroll recordkeeping and data entry. • Evaluate the city’s segregation of duties. Business Application User Access Internal Audit Information Technology Department/Internal Audit Manager • Evaluate the city’s management of user access across its enterprise resource planning systems and software applications. Aug. 16, 2022 Item #12 Page 7 of 9 {city of Carlsbad City of Carlsbad Status of Open Internal Audit Recommendations Audit Engagements: 2021-01 City Credit Card Program Audit and 2022-01 Code Enforcement Program Audit City Council Date: August 16, 2022 No.Recommendation Department Status 1 The Finance Department should communicate guidance citywide about the taxability of employee appreciation related items and gifts to ensure that city departments give and report them in compliance with the Internal Revenue Code. Finance Department Complete - The Finance Department sent out a city-wide email on June 16, 2022 titled, "Employee Taxable Benefits Guidance" which addresses this item. 2 To ensure that lodging purchases made during city business-related travel are appropriate, the Finance Department should update its travel guidelines and procedures to adopt either the state or the federal government’s annual lodging rates by geographic location, and require employees to submit written justification when rates must exceed these established maximums. Finance Department In progress - The Finance Department is incorporating this recommendation into an update of the city's travel policy. The specific audit recommendation will be addressed by adopting the federal GSA rates while allowing the approval of exceptions with justification. No.Recommendation Department Status 1 The Code Enforcement Division should immediately begin the implementation of a code enforcement procedure manual to serve as both a training and operations resource for staff. Community Development In progress - The code enforcement procedure manual is in final review with City Attorney's Office. 2 Management should identify a code enforcement officer to serve as a training coordinator for the division. Identifying such a role will help ensure the code enforcement officers continue to maintain their uniform approach to addressing complaints and serving the city’s residents. The uniformity will result in part from having a single point of contact for training and from the implementation of a code enforcement procedure manual as noted in recommendation #1. Community Development Complete - The code enforcement division has hired a senior code enforcement officer who is serving in this capacity. 3 To evaluate the performance of its code enforcement officers and to maximize the use of code enforcement data residing in EnerGov, the Code Enforcement Division must identify and monitor key metrics. Once specific metrics are identified, code enforcement staff should coordinate with the Information Technology Department to determine how to best extract this information from EnerGov. If EnerGov is unable to support this activity, the city should prioritize the identification or procurement of a software application that can. Community Development In progress - The Code Enforcement Division is finalizing a technical specification that identifies the data (metrics) they are seeking to track. They will present that request to the IT Department staff to determine if EnerGov can provide the necessary data and reports. If EnerGov is unable to, they will ask IT to recommend a system that can. 4 The auditor recommends that the IT and Community Development Departments coordinate a recurring meeting (bi-monthly, monthly, etc.) that brings together all divisions within Community Development to discuss and prioritize ServiceNow requests that originated during the period related to the EnerGov system. Community Development Complete - The divisions within Community Development meet with the Information Technology Department staff on a bi-monthly basis to discuss open tickets and to facilitate resolutions. 2021-01 City Credit Card Program Audit 2022-02 Code Enforcement Audit Report Exhibit 2Aug. 16, 2022Item #12 Page 8 of 9 Fiscal Year 2021‐22, Internal Audit Activities UpdateCity of Carlsbad, CA Exhibit 3No.Entity, Unit or Program Type of Engagement Primary Stakeholder/Audit Lead  Status1Code Enforcement AuditInternal Audit Community Development/Internal Audit Manager Complete 2Fraud & Ethics Hotline  Program EvaluationInternal Audit Manager Complete 3Transient Occupancy Tax Agreed Upon Procedures Various hotels/External audit firm In Process4City of Carlsbad Risk Assessment Various departments/Internal Audit Manager In Process6Procurement Internal Audit Various departments/Internal Audit Manager Rolled to fiscal year 2022‐235 Vice Narcotics Investigative Unit (VNIU) Internal Audit Police Department/Internal Audit Manager Rolled to fiscal year 2022‐23123456Fiscal Year 2021‐22 Internal Audit Activities This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan. The code enforcement audit was completed in fiscal year 2021‐22 and the results were presented to the City Council on March 22, 2022.  Status Notes: The fraud and ethics hotline evaluation was completed in fiscal year 2021‐22. City staff presented recommendations to the City Council on April 5, 2022.  At that meeting, City Council approved the implementation of a 3rd party hosted fraud and ethics hotline.  The city has since selected Navex Global Inc. to implement the hotline. The hotline has been fully developed and the fraud and ethics hotline administrative order is undergoing final review.  Following the completion of the administrative order, the City will go live with the hotline.    The city's annual transient occupancy tax review engagement is performed by an external CPA firm. This engagement is 90% complete and the audit firm is wrapping up their review procedures.    The citywide risk assessment engagement is 50% complete. The survey questions have been prepared and the survey is ready to be assigned to the leadership team for completion.  Following the completion of the survey, the city's internal auditor will meet one on one with management to discuss their responses and then finally all inputs will be scored and a risk ranking applied to the city's different programs. The risk assessment will aide the city in developing future internal audit plans and prioritizing future internal audit engagements.  This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan.  Audit planning has begun for this engagement. Exhibit 3 Aug. 16, 2022 Item #12 Page 9 of 9 Internal Audit Update and Fiscal Year 2022-23 Internal Audit Plan Robert Threatt, Internal Audit Manager Administrative Services Branch August 16, 2022 TODAY’S PRESENTATION •Overview •Status of open internal audit recommendations •Update on fiscal year 2021-22 internal audit activities •Present fiscal year 2022-23 internal audit plan ITEM 12: Internal Audit Update and Plan PROPOSED ACTION Adopt resolution approving the fiscal year 2022-23 Internal Audit Plan. ITEM 12: Internal Audit Update and Plan STATUS: INTERNAL AUDIT RECOMMENDATIONS •For business related travel,city should follow state or federal guidelines to ensure appropriateness •In-process:As part of a travel policy update,the Finance Department is adopting federal General Services Administration guidelines for travel reimbursements Credit Card Program Audit STATUS: INTERNAL AUDIT RECOMMENDATIONS •Using data maintained in the EnerGov system,identify and monitor key metrics for trend analysis and staff development purposes •In-process:Technical specification being developed, and staff will coordinate with Information Technology Department to develop reports or queries that provided the required metrics Code Enforcement Program Audit FISCAL YEAR 2021-22 AUDIT ACTIVITIES •Status of internal audit engagements •Completed (2): Code enforcement audit & fraud and ethics hotline evaluation and recommendation •Ongoing (2): Transient Occupancy Tax review and citywide risk assessment •Included in fiscal year 2022-23 Internal Audit Plan (2): Procurement program audit and Vice Narcotics Intelligence Unit “Buy Fund” review Annual Update FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN •Procurement program audit* •Vice Narcotics Intelligence Unit “Buy Fund” policy review* •Transient Occupancy Tax review •Payroll process audit •Revenue audit •Business application user access review (*Engagements from fiscal year 2021-22) Proposed Audit Engagements PROPOSED ACTION Adopt resolution approving the fiscal year 2022-23 Internal Audit Plan. ITEM 12: Internal Audit Plan and Update