HomeMy WebLinkAbout2023-11-16; Internal Audit Manager Staffing Update (Districts - All); Rocha, LauraTo the members of the :
CITY COUNCI~
Date 11/ \\., j.23 CA _v_ CC v:: /
CM V::--ACM vDCM (3) _V_
November 16, 2023
Council Memorandum
To:
From:
Via:
Honorable Mayor Blackburn and Members of the City Council
Laura Rocha, Deputy City Manager, A~~trative Services
Geoff Patnoe, Assistant City Manage~
Re: Internal Audit Manager Staffing Update (Districts -All)
{city of
Carlsbad
Memo ID# 2023118
This memorandum provides information regarding the status of the city's Internal Audit Manager
staffing position.
Background
On July 1, 2019, the city hired Ms. Brigid Drury as an Internal Auditor and shortly thereafter,
established an Internal Audit Framework and Council Policy No. 89, Attachment A. Ms. Drury
assumed the role as Internal Auditor until January 4, 2021. Staff immediately conducted an
internal and external recruitment for the vacant position and subsequently hired Mr. Robert
Threatt on June 21, 2021, as Internal Audit Manager. On October 27, 2023, Mr. Threatt
submitted his resignation of employment. Mr. Threatt's last day with the city was
November 9, 2023.
Discussion
The city's Internal Audit Manager performs independent and objective audit engagements
designed to safeguard city resources and improve city operations. Internal audits accomplish this
by bringing a systematic, disciplined approach to evaluating and recommending improvements to
the effectiveness of risk management, controls, and governance processes.
Council Policy No. 89 establishes the internal audit framework that sets forth the qualifications,
duties, and powers of the city's Internal Audit Manager.
The Internal Audit Manager develops and performs work based on a flexible annual audit plan
submitted to the City Council for review and approval each year. The Internal Audit Manager
communicates results of audit activities and progress on the annual audit plan at least twice a
year to the City Council.
At this time, the city will not pursue a recruitment for the vacant Internal Audit Manager
position. Finance staff will oversee the work being done by Davis Farr, LLP, an audit firm
contracted with the city to perform Transient Occupancy Tax audits for fiscal years 2022-23 and
2023-24. The remaining work related to the audit work plan for fiscal year 2023-24 will be on
hold until further resources become available.
Administrative Services Branch
Administrative Services Administration
1635 Faraday Avenue I Carlsbad, CA 92008 I 442-339-2450 t
Council Memo -Internal Audit Manager Staffing Update (Districts -All)
November 16, 2023
Page 2
Next Steps
Staff will begin to evaluate opportunities to increase the effectiveness and efficiency of the city's
internal audit program. At a future meeting, staff will present options for staffing the position as
well as the potential use of outside contracting for audit activities for City Council consideration.
Attachment: A. Internal Audit -Council Policy Statement No. 89
cc: Scott Chadwick, City Manager
Cindie McMahon, City Attorney
Paz Gomez, Deputy City Manager, Public Works
Gary Barberio, Deputy City Manager, Community Services
Zach Korach, Finance Director
Judy Von Kalinowski, Human Resources Director
Ccicyof
Carlsbad
Council Policy Statement
Category: INTERNAL AUDIT
Specific Subject: Internal Audit Framework
PURPOSE:
Attachment A
Policy No. 89
Date Issued: 11-12-19
Effective Date: 11-12-19
Resolution No. 2019-227
Cancellation Date: N/A
Supersedes No. N/A
To establish a City Council policy formalizing the responsibilities, reporting lines, and protocols of
internal audit within the structure of the city.
BACKGROUND:
Internal audit is governed by an Internal Audit Framework (framework) that defines the requirements,
audit standards, and responsibilities for internal audit activities. An Internal Audit Framework is a
formal document that establishes the internal document activity's position within the organization,
including the nature of the internal auditor's functional reporting relationship with City Council; it
authorizes access to records, personnel, and physical properties relevant to the performance of
engagements; and it defines the scope of internal audit activities. Final approval of the Internal Audit
Framework resides with the City Council.
This framework defines the mission, scope, commitment to quality, authority and accountability,
independence and responsibility of the city's Internal Audit Division.
POLICY:
Mission
The city's Internal Audit Division provides highly reliable, independent, objective assurance and
consulting services designed to safeguard city resources and improve city operations. The Internal Audit
Division accomplishes this by bringing a systematic, disciplined approach to evaluating and
recommending improvements to the effectiveness of risk management, controls and governance
processes.
Scope
The scope of the Internal Audit Division's authority includes all operations under the direction of the City
Council and the city manager. It encompasses the examination and evaluation of the adequacy and
effectiveness of the city's systems of internal controls and the quality of performance in carrying out
assigned responsibilities.
The scope of work performed by the Internal Audit Division is to determine whether the city's network
of risk management, control and governance processes as designed and represented by management, is
adequate and functioning to ensure:
• Risks are appropriately identified and managed;
• Significant financial, managerial, and operating information is accurate, reliable and timely;
Page 1 of 4
Policy No. 89
• The process to acquire resources is economical, used efficiently, and are adequately protected;
• Programs, plans, and projects are operated within the fiduciary standards and regulatory
requirements, are compliant with city policies and stated objectives are achieved;
• Quality service and continued improvement are fostered within the city's control process;
• Significant legislative and regulatory issues impacting the city are recognized, addressed
appropriately, and interaction with governance groups occurs;
• Employees' actions comply with policies, standards, procedures, and applicable laws and
regulations;
• Contractors are meeting contract requirements in conformance with applicable laws,
regulations, policies, procedures, and best practices;
• Existing policies and procedures are appropriate, updated and being followed; and
• Opportunities for improving management control, streamlining processes, and improving public
perception are implemented.
Access & Authority
The Internal Audit Division has the authority to audit all areas of the city and is authorized to:
• Have full, free, and unrestricted access to all records, functions, operations, systems, property,
and personnel pertinent to carrying out any engagement. The Internal Audit Division will
maintain confidentiality of all information provided subject to legal requirements. Documents
provided to the Internal Audit Division will be handled in the same prudent manner as by those
employees normally accountable for them.
• Select audit topics, set audit frequencies, determine scope of work, and apply the techniques
required to accomplish audit objectives.
• Conduct investigations of any suspected inappropriate activity, including suspected fraudulent
acts.
• Have access to the necessary city personnel in functions where audits are being performed, as
well as external consultants that provide other specialized services. Access to third parties will
be handled in accordance with contractual terms. All employees will cooperate fully in making
available material or information requested by the Internal Audit Division or any external
auditors managed by the Internal Audit Division.
The Internal Audit Division is not authorized to:
• Initiate or approve accounting transactions external to internal audit; or
• Direct the activities of any employee not part of the Internal Audit Division except to the extent
such employees have been appropriately assigned to auditing teams.
Independence and Objectivity
To be structurally independent, the Internal Audit Division is set up to report functionally to the City
Council and administratively to the Deputy City Manager of Administrative Services. The City Council
members are elected to office, and thus, responsible to the citizens and taxpayers of the city. The
Internal Audit Division is not part of any department that the Deputy City Manager of Administrative
Services oversees. The Internal Audit Division has no direct responsibility to, or authority over, any area
subject to its audit, review, or investigation. Therefore, the Internal Audit Division is organizationally
independent from those areas that it reviews, audits, and/or investigates.
The Internal Audit Division will report results and have direct access to the City Council. The Internal
Audit Division will report any impairment to independence, or unjustified restriction or limitation to
Page 2 of 4
Policy No. 89
audit selection, scope, procedures, frequency, timing, or report content promptly to the city manager
and the City Council. These reporting relationships not only ensure independence, but also assure
comprehensive audit coverage and adequate consideration of audit recommendations. Additionally, the
City Council will be notified upon any appointment, replacement, or dismissal of the internal auditor.
The position of internal auditor fulfills the independence requirement by separating the duty from the
Deputy City Manager of Administrative Services. As such, the internal auditor will sign all official
correspondence including, but not limited to final audit reports, audit announcement letters, and letters
of communication to other city departments and elected officials.
The Internal Audit Division will exhibit the highest level of professional objectivity in gathering,
evaluating, and communicating information about the activity or process being examined. The Internal
Audit Division will make balanced assessments of all the relevant circumstances and not be unduly
influenced by personal interests or by others in forming judgments.
Professionalism
The Internal Audit Division is guided by government auditing standards and determines the processes
for operating and conducting its work according to government auditing standards in its policies and
procedures manual. The Internal Audit Division will perform and report on all audit activities with due
professional care in accordance with its policies and procedures manual.
Responsibility
The Internal Audit Division is responsible for all internal auditing activities for the City of Carlsbad. Its
primary responsibility is to conduct performance audits that improve the economy, efficiency, and
effectiveness of city government. The Internal Audit Division will also conduct other non-audit services
that are advisory in nature, if these services do not impair the auditor's independence. Additionally, the
Internal Audit Division is responsible for the following:
• Develop and perform work based on a flexible annual audit plan, considering risks and control
concerns expressed by management and/or the City Council, submitted to the city manager and
the City Council for review and approval each year. This provides the City Council with an
opportunity to approve the annual internal audit plan or to provide comments and feedback for
modification of the schedule projects.
• Review and adjust the annual audit plan as necessary in response to changes in the city's
operations, programs, controls, and/or identified risks. The city internal auditor will
communicate significant revisions to the annual audit plan to the city manager and the City
Council for review and approval. The city manager has authority to approve minor changes or
insignificant modifications to the annual audit plan through an expedited process.
• Report audit findings to appropriate personnel, including the city manager, the City Council, and
city personnel responsible for implementing recommendations.
• Communicate results of audit activities and progress on the annual audit plan twice a year to the
city manager and the City Council.
• Provide management with adequate time to respond to audit findings and include
management's response in the audit report.
• Follow up on audit findings recommendations and provide periodic follow up reports
summarizing the status of corrective actions taken.
• Ensure that staff participating in internal audit activities possess the knowledge, skills, and other
competencies needed to meet the requirements of this framework.
Page 3 of 4
Policy No. 89
• Ensure that staff participating in internal audit activities are independent during any period of
time that falls within the period covered by the subject matter of the audit and the period of the
professional engagement.
City management is responsible for the following:
• Maintain an effective system of internal controls, document policy and procedures, and ensure
information is accurate, timely, and reliable.
• Cooperate with the Internal Audit Division and promptly reply to requests and
recommendations.
• Respond to audit findings and recommendations.
• Assure timely implementation of agreed-upon corrective actions to audit recommendations or
accept the risk of non-implementation.
Any changes made to this document must be approved by the City Council.
Page 4 of 4