Audit Committee

AGENDA Audit Committee Wednesday, September 11, 2019 6:00 pm – 7:30 pm City Hall, Room 301 A. Review and approval of the Wednesday, August 14, 2019 Meeting Minutes B. Update — 2018 Work Plan Update  Public Utilities Department — Water Business Office  Central Services Department — Fleet Management Program  Sheriff’s Office — Inmate medical services C. Audit selection  Risk Assessment Presentation  Alignment with Mayor and Commission approved strategic objectives (FY20)  Potential Audits  Multi-year Audit Plan D. Audit process for Departments under the Manager’s Office and Elected and Constitutional Officials E. Items for Discussion at next meeting The next meeting is scheduled for Wednesday, October 9, 2019 Note: The Audit Committee Meeting is open to the public. However, public comments are not received unless the Committee Chair requests that an individual provide information to the Committee. O FFI CE O F O P ER A TI O N AL A N AL YSI S T H E U NI F I E D G O V E R NM E N T O F A T H E NS -C L A R K E C O UN T Y , G E O R G I A 300 College Avenue, Suite 202  Athens, Georgia 30601  (706) 613-3012 www. at h en sc lar k e c o unt y. c o m / 2 3 6 / O per at i on al - An al ys is - Of f i ce  AUDIT STATUS REPORT DATE: September 11, 2019 TO: Mayor and Commission FROM: Stephanie Maddox, Internal Auditor Office of Operational Analysis (formerly, the Auditor’s Office) SUBJECT: Status of 2018 Work Plan Activity The following table summarizes the current status of each audit according to audit stages. A description of the audit stages is below the table. WORK IN PROGRESS Status Completion Audit Percentage indicates completion level Forecast Operational Audit of the Pre-Audit Planning – 100 % *Final report submitted to March 2019 Clarke County Sheriff’s Discovery Stage – 100% Clerk of Commission for Office Analysis – 100 % acceptance at the August 2, Conclusions – 100% 2019, Mayor and Commission Recommendations – 100% Meeting. *Work session scheduled to TBD present the Findings and Recommendations of the Sheriff’s Office audit. NOTE: Audit report completed March 2019; final responses from the Sheriff’s Office received May 2019 Public Utilities Department – Pre-Audit Planning – 100 % *Additional follow-up September Water Business Office Discovery Stage – 100% interviews completed with 2019 Analysis – 100% WBO supervisory staff; audit Conclusions – 95% report writing near Recommendations – 95% completion. *Draft report is 90% complete. Central Services Department – Pre-Audit Planning – 100% *Audit plan finalized; survey October 2019 Fleet Management Program Discovery Stage – 75% results received; review and Analysis – 25% analysis underway; interviews Conclusions – 0% anticipated to start August Recommendations – 0% 2019. *Request for documents September submitted to audit client, HR, 2019 and Finance. Audit Stages PRE-AUDIT PLANNING: OOA staff conducts literature reviews, identifies benchmark communities, research best practices, develops pre-audit survey(s), and requests documents related to the audit client. OOA staff conducts pre- conference meeting with the audit client/department (Dept. Director); discuss the audit process, the timing of fieldwork, and answer any questions. DISCOVERY: Interviews, information validation, observations and surveys. As this stage is critical to the preparation of a complete and meaningful audit, it consumes the majority of time involved. ANALYSIS: Assigning meaning/value to the information; determining what it reveals related to the scope of the audit. Defines systems, processes and practices in terms of effectiveness and efficiency. CONCLUSIONS: Identifies and describes constraints and opportunities regarding developments and implementation of needed improvements. RECOMMENDATIONS: Suggests action that can be taken in consideration of the constraints and opportunities.  An Alternative approach to making audit selections Risk Assessment UNIFIED GOVERNMENT OF ATHENS- CLARKE COUNTY OFFICE OF OPERATIONAL ANALYSIS SEPT EMBER 2019 Objectives 1. Review Internal Auditing Standards 2. Define Risk Assessment and its purpose 3. Overview of the Risk Assessment Process 4. Characteristics of a Risk Assessment 5. Difference between an Internal Audit risk assessment and the work that Safety and Risk does 6. Risk Factors 7. Criteria  Professional Standards for Internal Auditing Professional Performance Standards set by the Institute of Internal Auditors (IIA) state audit selections must be based on a documented risk assessment, undertaken at least annually. Additionally, 1. The internal auditing activity must evaluate risk exposure 2. Focus on the achievement of organizational strategic goals and objectives  What is a risk assessment? A risk assessment takes subjective perspectives and puts them through an objective, organized framework that will help to determine where to best allocate resources. Risk Assessment Process Overview Identify Risks Measure Risks Prioritize Risks Select Audits  Risk Assessment or Risk Management? Risk Assessment The focus of a risk assessment is to identify and assess operational risks and to determine audit necessity. Risk Management A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives. Very Similar  In a nutshell, they are the same An Internal Audit Risk Assessment (Management) is the • identification, • measurement, and • prioritization of risks for the purpose of selecting and developing auditable areas.  Does the Office of Operational Analysis (OOA) need to conduct risk assessments if the Safety & Risk Division of HR seemingly do the same thing? The Safety & Risk Division in Human Resources primarily focus is: • Employee and property safety • Managing insurance, injury, and illness claims for damage to persons and ACC property, • Provides safety training (e.g. Defensive Driving, CPR, and First Aid, etc.), • Conducts safety audits of ACC facilities, and • Handles workers compensationclaims.  Criteria References the significance of a risk being evaluated. Criteria should be based on organizational goals and objectives. Audit selection should be informed by the following criteria: • Risk • Impact • Importance • Materiality • Auditability • Previous audit Severity (Impact) Criteria used to determine the severity or impact of the identified risks: • What could go wrong? What could go right? • What are the opportunities associated with the risk? What are the threats? • Who will be affected? How? How will they react? • Will the impact enhance the entity’s ability to achieve its objectives? • Will the impact threaten the entity’s ability to achieve its objectives?  Sample Risk Factors • Compliance with • Handling of Cash Regulations, Laws, Policies and SOPs • Instances of Fraud, • Objectives/Projects Waste, & Abuse • Publicity/Reputation • Departmental Changes • Audit History, Prior Audit • Information Technology Results Changes Likelihood (Possibility) Example criteria used to determine the likelihood of an identified risk: 1. Is the risk internal or external? 2. What is the history of occurrence? 3. Has an event occurred recently? 4. What are the predictions for occurrence in the future. Responses to the questions above the likelihood can be asses as High (Almost certain): expected in almost all circumstances Medium-High (Likely): will probably occur; Medium (Possible): could occur at some time; Medium-Low (Unlikely): not expected to occur; and Low (Rare): exceptional circumstances only. Risk Categories There are three common risk categories: 1. Financial Risk – Impact related to revenues, expenditures, assets, liabilities, and equity decisions. 2. Operational Risk – Risk is exposed if operating objectives are not being met through the effective and efficient use of resources. This includes potential for fraud, business disruptions, customer service, and safety. 3. Compliance Risk – Risk is exposed if operating (or potentially operating) outside of applicable laws and regulations. Step 1: Identify Risks What is included in a Risk Assessment? • A questionnaire is developed to compile information on the potential departments to be audited (auditable units) and to address all risk factors. • The following information may be requested from the departments in the questionnaire: Step 2: Measure Risks Risk Assessment Criteria • The primary purpose of a risk assessment is to identify risks, assess them, and reduce them to an acceptable level. • Before operational risks can be assessed, the risk criteria and risk factors from which to measure and score must be established and defined. • To achieve this, a measurement system that includes a baseline (an organization’s acceptable risk level) and a method of scoring (a risk scoring system) must be established. • The criteria are derived from the organization’s culture and industry, external and internal context or controls, applicable laws, standards and other requirements. Step 3: Prioritize Risks Risk Identification Some categories in which to identify risk: • Employment practices and • Fraud. workplace safety. • Turnover rates • Internal fraud • External fraud • Vacancy rates (position vacancies and time vacant) • Compliance with laws, regulations, contracts, policies, and procedures. • Reliance on key staff and • External/criminal threats management succession Step 4: Select and Develop Audits Audit Selection • Develop Questionnaires to be completed by departments • Using established risk factors and criteria • Audit Committee prioritizes risks identified and the level of severity. • Audit Committee selects audits to be conducted byOOA.