The URL can be used to link to this page

Home My WebLink About2023-02-07; City Council; ; Internal Audit Program UpdateCA Review GH Meeting Date: Feb. 7, 2023 To: Mayor and City Council From: Scott Chadwick, City Manager Staff Contact: Robert Threatt, Internal Audit Manager robert.threatt@carlsbadca.gov, 442-339-2418 Laura Rocha, Deputy City Manager, Administrative Services laura.rocha@carlsbadca.gov, 442-339-2415 Subject: Internal Audit Program Update District: All Recommended Action Receive a report on the status of recommendations from previously completed internal audits and an update regarding internal audit engagements identified in the city’s fiscal year 2022-23 Internal Audit Plan. Executive Summary The city’s Internal Audit Manager performs independent and objective assurance services to safeguard city resources and improve city operations. These services may include internal audits of any city department, division, function, or program, along with recommendations to tighten controls, increase efficiency or better comply with standards and regulations. This report provides the City Council with updates on: • The status of recommendations from previously completed internal audits • The internal audit engagements identified in the city’s fiscal year 2022-23 Internal Audit Plan (Exhibit 1) City Council Policy No. 89, Internal Audit Framework, requires the city’s internal auditor to present this update to the City Council twice a year. Explanation & Analysis Open internal audit recommendations At the conclusion of each internal audit engagement, an audit report is issued that includes the audit’s findings. The findings are accompanied by specific audit recommendations to be addressed by city management. The city’s internal auditor is responsible for monitoring city management’s progress with implementing the audit recommendations and with reporting progress to the City Manager and City Council. Feb. 7, 2023 Item #13 Page 1 of 7 During the previous update to City Council on August 16, 2022, there were two engagements with open audit recommendations: 2021‐01 City Credit Card Program Audit – Finance Department Recommendation: To ensure that lodging purchases made during city business- related travel are appropriate, the Finance Department should update its travel guidelines and procedures to adopt either the state or the federal government’s annual lodging rates by geographic location, and require employees to submit written justification when rates must exceed these established maximums. Status: Complete. The Finance Department has addressed this audit recommendation by incorporating the use of federal General Services Administration lodging rates in the city's travel policy. The policy has a provision that allows for the approval of exceptions, on a case by case basis. (The updated travel policy will be presented to City Council at tonight’s meeting). 2022‐02 Code Enforcement Audit Report ‐ Community Development Department Recommendation 1: The Code Enforcement Division should immediately begin the implementation of a code enforcement procedure manual to serve as both a training and operations resource for staff. Status: Complete. A code enforcement training manual was finalized in October 2022. The new training manual addresses core code enforcement topics ranging from code enforcement standards, field inspection protocols, compliance timelines, division policies and procedures, to uniform wear. Recommendation 2: To evaluate the performance of its code enforcement officers and to maximize the use of code enforcement data residing in EnerGov (the application used to track code enforcement actions), the Code Enforcement Division must identify and monitor key metrics. Once specific metrics are identified, code enforcement staff should coordinate with the Information Technology Department to determine how to best extract this information from EnerGov. If EnerGov is unable to support this activity, the city should prioritize the identification and procurement of a software application that can. Status: Complete. The Code Enforcement Division has been meeting with the city's Information Technology Department on a bi-weekly basis to develop and evaluate reports that utilize information that originates in the city's EnerGov application. After identifying key metrics, the Code Enforcement Division has now developed a core set of reports that enable them to monitor staff performance and code enforcement trends on an ongoing basis. Feb. 7, 2023 Item #13 Page 2 of 7 Internal audit activities update As required by City Council Policy No. 89, the City’s internal auditor is providing this status update regarding ongoing internal audit activities and progress in completing engagements identified in the fiscal year 2022-23 Internal Audit Plan. FISCAL YEAR 2022‐23 INTERNAL AUDIT ACTIVITIES No. Description Type of engagement Primary stakeholder/audit lead Status 1 Fraud & Ethics Hotline Program evaluation Staff/Internal Audit Manager Complete This was initially a project evaluation engagement in fiscal year 2021-22. The results and recommendations from that evaluation were presented to the City Council on April 5, 2022. At that meeting, the City Council approved the implementation of a third-party hosted fraud and ethics hotline. The city has since selected Navex Global, Inc. to implement the hotline. In coordination with Navex Global, Inc. the city established the hotline, implemented Administrative Order #93-Fraud and Ethics Hotline, developed a hotline intranet page and program resources and the hotline (for employee use only) officially went live on November 15, 2022. 2 Transient Occupancy Tax Review Review (agreed upon procedures) Various city hotels/External audit firm In process The city engaged a regional CPA firm, CliftonLarsonAllen, LLP, to perform a transient occupancy tax review of the city's transient occupancy tax revenues that are remitted by hotels operating within the city boundaries. The ongoing engagement includes a review of eleven hotels selected by the city's internal auditor. The engagement is nearing completion with 9 of 11 reviews complete. Once fully complete, the results will be reported to the City Council. 3 Procurement Program Audit Internal audit Various departments/Internal Audit Manager In process This engagement is in process and involves an audit of the city's procurement functions, including advertising, bid and award activities. The audit is designed to evaluate the city's compliance with federal, state and local guidelines (policies) as well as an evaluation of its best practices. 4 Vice Narcotics Investigative Unit "Buy Fund" Internal audit Police Department/Internal Audit Manager Pending This engagement will evaluate the Police Department's adherence to Buy Fund policies and procedures, and the safeguarding of the program’s cash balances. 5 Revenue Audit Internal audit Finance Department/Internal Audit Manager Pending This engagement will evaluate the city's processes for receiving, recording and collecting transient occupancy tax revenues received from hotels operating within the city. 6 Payroll Audit Internal audit Finance Department/Internal Audit Manager Pending This engagement will evaluate the city's payroll recordkeeping and data entry processes including the program's segregation of duties, which contribute to the city's internal control structure. 7 Business Application User Access Review Review Various departments/Internal Audit Manager Pending This engagement will evaluate the city's management of user access associated with its core business applications. Examples include the evaluation of access granted to Finance Enterprise, the city's financial enterprise system and EnerGov, which is the city's enterprise system for business licenses, permitting, and code enforcement, among others. Feb. 7, 2023 Item #13 Page 3 of 7 Fiscal Analysis There is no immediate fiscal impact to receiving the internal audit update. Next Steps The city’s internal audit manager will continue with ongoing internal audit engagements identified in the FY 2022-23 Internal Audit Plan and will return to the City Council with an update after end of fiscal year 2022-23. Environmental Evaluation This action does not require environmental review because it does not constitute a project within the meaning of the California Environmental Quality Act pursuant to California Public Resources Code Section 21065 in that it has no potential to cause either a direct physical change or a reasonably foreseeable indirect physical change in the environment. Exhibits 1. Fiscal Year 2022-23 Internal Audit Plan Feb. 7, 2023 Item #13 Page 4 of 7 Fiscal Year 2022-23 Internal Audit Plan Fiscal Year 2022-23 Internal Audit Plan Exhibit 1 Feb. 7, 2023 Item #13 Page 5 of 7 (city of Carlsbad Fiscal Year 2022-23 Internal Audit Plan OVERVIEW The City of Carlsbad’s internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Internal audits help to mitigate risks by recommending improvements to the city’s internal controls and governance, risk, and compliance processes. Potential audits may include any city department, division, function, or program administered by the city. The purpose of the annual internal audit plan is to outline audits and other value-added engagements the internal auditor proposes to conduct during the current fiscal year. This document serves as the primary work plan to carry out the responsibilities of the internal auditor. The basis for the audit plan comes from auditor observations, inquiries of management, audit requests from the City Council and senior management, and programs or processes with inherently higher risk levels. The internal auditor’s strategy in developing this plan seeks to identify, prioritize, and manage audits important to city operations, programs, and systems. Currently, the Internal Audit Division is comprised of one full-time internal auditor. The internal audit plan considers available staff hours, level of expertise and experience, the estimated size and complexity of audits, time allocated to satisfy continuing professional education requirements, time allocated to performing audit follow-up procedures, and use of external consultants/auditors. The internal audit plan is a working document. During the year, causes for changes to the audit plan may include an increase or decrease in audit scope, additional or pressing audit requests, or a threat to auditor independence. As such, projects initiated in the current year may carry over into the following fiscal year. The following page identifies the list of prioritized internal audit engagements for FY 2022-23, along with their preliminary objectives. At the beginning of each engagement, the internal auditor will establish familiarity with the department, function or process identified for audit. During that initial period, audit objectives may be refined, and the methodology will be established. Feb. 7, 2023 Item #13 Page 6 of 7 {city of Carlsbad Fiscal Year 2022-23 Internal Audit Plan Fiscal Year 2022-23 Internal Audit Engagements Entity, Function, Program or Process to Audit Type of Engagement Primary Stakeholder/Audit Lead Preliminary Objectives Carryover from FY 2021-22 Procurement Internal Audit Various departments/ Internal Audit Manager •To assess the city’s compliance with applicable procurement guidelines. •To evaluate whether the city’s procurement process is effective and adhered to. Vice Narcotics Intelligence Unit (VNIU) “Buy Fund” Internal Audit Police Department/Internal Audit Manager •To determine whether the fund was managed and accounted for in accordance with authorized policies and procedures. New for FY 2022-23 Transient Occupancy Tax Agreed Upon Procedure Various hotels as determined by city/External Audit Firm •To determine if hotels are properly reporting and remitting occupancy taxes in compliance with city ordinance. Revenue Audit Internal Audit Finance Department/Internal Audit Manager •Evaluate the city’s receipt and recordkeeping associated with its transient occupancy tax revenues. Payroll Audit Internal Audit Human Resources/Finance Department/Internal Audit Manager •Evaluate the city’s payroll recordkeeping and data entry. •Evaluate the city’s segregation of duties. Business Application User Access Internal Audit Information Technology Department/Internal Audit Manager •Evaluate the city’s management of user access across its enterprise resource planning systems and software applications. Feb. 7, 2023 Item #13 Page 7 of 7 {city of Carlsbad