Audit Committee

AGENDA Audit Committee Friday, October 11, 2019 1:00 – 2:00 pm City Hall, Room 301 A. Review and approval of the Wednesday, September 11, 2019 Meeting Minutes B. Audit Status Update  Public Utilities Department — Water Business Office  Central Services Department — Fleet Management Program  Sheriff’s Office — Inmate Medical Services  Animal Services Department — Animal Control C. Risk Assessment Demo – Live Simulation D. Items for Discussion at next meeting The next meeting is scheduled for Friday, November 8, 2019 Note: The Audit Committee Meeting is open to the public. However, public comments are not received unless the Committee Chair requests that an individual provide information to the Committee. O FFI CE O F O P ER A TI O N AL A N AL YSI S T H E U NI F I E D G O V E R NM E N T O F A T H E NS -C L A R K E C O UN T Y , G E O R G I A 300 College Avenue, Suite 202  Athens, Georgia 30601  (706) 613-3012 www. at h en sc lar k e c o unt y. c o m / 2 3 6 / O per at i on al - An al ys is - Of f i ce  AUDIT STATUS REPORT DATE: October 11, 2019 TO: Mayor and Commission FROM: Stephanie Maddox, Internal Auditor Office of Operational Analysis (formerly, the Auditor’s Office) SUBJECT: Status of Work Plan Activity The following table summarizes the current status of each audit according to audit stages. A description of the audit stages is below the table. WORK IN PROGRESS Status Completion Audit Percentage indicates completion level Forecast Clarke County Sheriff’s Office – Pre-Audit Planning – 100% *Inmates to be interviewed are November 2019 Inmate Medical Services Discovery Stage – 50% being determined. Analysis – 0% *Inmate interviews will start in Conclusions – 0% October. Recommendations – 0% *Medical staff interviews will tentatively begin in October. Public Utilities Department – Pre-Audit Planning – 100 % *Draft report submitted to October 2019 Water Business Office Discovery Stage – 100% department. Analysis – 100% Conclusions – 100% Recommendations – 100% Central Services Department – Pre-Audit Planning – 100% *Request for documents received October 2019 Fleet Management Program Discovery Stage – 85% from HR, Fleet Management, and Analysis – 80% Finance. Conclusions – 50% *Interviews 90% complete. Recommendations – 50% *Conducted observation. Animal Services Department – Pre-Audit Planning – 10% Preplanning tentatively scheduled January 2020 Animal Control Discovery Stage – 0% to start the week of October 22. Analysis – 0% Conclusions – 0% Recommendations – 0% AUDIT STAGES Pre-Audit Planning: OOA staff conducts literature reviews, identifies benchmark communities, research best practices, develops pre-audit survey(s), and requests documents related to the audit client. OOA staff conducts pre-conference meeting with the audit client/department (Dept. Director); discuss the audit process, the timing of fieldwork, and answer any questions. Discovery: Interviews, information validation, observations and surveys. As this stage is critical to the preparation of a complete and meaningful audit, it consumes the majority of time involved. Analysis: Assigning meaning/value to the information; determining what it reveals related to the scope of the audit. Defines systems, processes and practices in terms of effectiveness and efficiency. Conclusions: Identifies and describes constraints and opportunities regarding developments and implementation of needed improvements. Recommendations: Suggests action that can be taken in consideration of the constraints and opportunities.  Audit Universe Year Year Audit Audit Issued Issued Airport Corrections Airport Administration Administration Airport Services Food Services Airport Maintenance Security Operations Operations & Organization 2008 Diversion Center Inmate Labor Cost Analysis Audit 1994 Attorney's Office Contract & Deeds Review District Attorney Open Records Requests Discrimination Complaints Economic Development Board of Elections Finance Voter Registration Administration Absentee & Advance Voting Accounting Online Voter Registration Accounts Payable Voting - Election Day Invoicing Payments Contract Labor Payments Building Inspection Department IRS 1099 Forms Building Inspection Administration Alcohol Licensing Building Construction Inspection Business Tax Division Building Inspection Community Protection 2008 Budget Management Building Inspection Community Protection Follow-up 2009 Purchasing Building Permits Purchasing Card Program Code Enforcement Travel Card Municipal Ordinance Violation Vendor Management Private Property Zoning Marshal Services (currently CPD) 2003 Fire & Emergency Services Operations & Organization 1994 Administration 2009 Fire Prevention Central Services Fire Suppression Administration Emergency Management Permits Special Events Housing & Community Development Sidewalk Vending Human & Economic Development 2009 Sidewalk Café Public Information Displays Human Resources Animal Control Administration Animal Shelter Employment 2001 Injured Animals Recruitment and Retention Rescue Adoption Employee Relations Electronic Confinement Systems Compensation & Payroll Internal Support Benefits & Wellness Indirect Charges Health Insurance Courthouse Parking Deck Operatoins Retirement Benefits Mail Services Health & Wellness Program County Records Management Safety & Risk Surplus Property Safety Training and Audits Internet Auction Operation General Liability Program Wireless Telephone Support Workers Compensation Program Print Shop Operations Personnel (currently HR) 1995 Landscape Management Facilities Mowing & Landscape Informational Technology Parks Mowing & Landscape Computer Information Services 1994 Right-of-Way Mowing & Landscape Digital Telephone System Community Tree Program Facilities Management Juvenile Court New Construction Contract Management Family Dependency Treatment Court Life Cycle Replacement Facilities Maintenance Contracts Leisure Services Facilities Maintenance Repair & Renovation Administration 800MHZ Radio System Arts & Nature Fleet Management Park Services Administrative Issues 1994 Recreation Corrective Services Summer Camp Program 2016 Fuel Service Organization & Operations 2002 Motor Pool Rental & Loaner Service Department Performance Audit 2017 Preventive Maintenance Vehicle Replacement Program Magistrate Court 1997 24/7 On-call Vehicle Response Civil Eviction Clerk of Superior and State Court Personal Property Foreclosure Records Retention and Storage 2000 Garnishment Operations & Organization 2009 Criminal & Bad Checks Child Abondonment Cooperative Extension F:\AUDITOFC\Work Plan\Work Plan Related Documents\Audits & Projects Conducted\Audit Universe.xlsx  Audit Universe Year Year Audit Audit Issued Issued Manager's Office Solid Waste Administration Landfill Emergency Management Composting Geographic Information Systems & Graphics Gas Capture System Office of Sustainability Leaf & Limb Pickup Office of Inclusion & Diversity Recycling Operations & Organization Commercial Recycling Organizational Development Green School Program Public Information Office Teacher Reuse Store ACTV Charm ACC Website Citizen Concerns Superior Court SPLOST Administration DUI/Drug Court Mayor & Commission Felony Drug Court Mayor's Office Parental Accountability Court Clerk of Commission Veterans Court Board, Authorities & Commissions 2016 Probation Services: 2003 Cost & Revenue Estimates for In-house Misdemeanor Jurisdiction 1997 Provision of Misdemeanor Probation 2007 State & Municipal Courts 2001 Municipal Court State & Municipal Courts 2007 Staffing Workload 2007 Tax Assessor Planning Department 1994 Appeals Zoning Ordinance Subdivision Regulations Tax Commissioner Street Numberling Ordinance Administration Environmental Arts Ordinances Delinquent Tax Historic Preservation Ordinance Personal Sign Ordinance Real Estate Operations & Organization 1994 Property Tax Operations & Organization 2004 Motor Vehicle Division 1994 Tag Renewals Police Services Motor Vehicle Registrations Command Central Communications Transit Support Services Operations Information Management Maintenance Central Criminal Investigations Administration Patrol Operations Demand Response Follow-up: SPO promotion program 2000 Title VI Plan Police Satisfaction Survey 2000 Retention & Recruitment of Police Officers 2002 Transportation & Public Works Operations & Organization 1997 Administration Special Operations Storm Water Management Central Communications Engineering Construction Management Probate Court 2000 Land Development Program Pavement Maintenance Program Public Utilities Residential Parking Program Administration Storm Water Management Construction & Project Management Right-of-Way Acquisition Plant Operations Streets & Drainage 2003 Engineering Management Traffic & Operations Water Business Office Soil Erosion 2005 Billing & Customer Payments Soil Erosion (staffing requests for additional 2007 Meter Management inspector positions for Building Inspections & Water &Sewage Operations Soil Erosion Follow-up Establishment of Service & Terminating Service Traffic Engineering Sheriff Administration Field Division Jail Division Field Operations and Jail Issues 1998 Operational 2018 Overtime Usage 2005 Solicitor General F:\AUDITOFC\Work Plan\Work Plan Related Documents\Audits & Projects Conducted\Audit Universe.xlsx Risk Based Audit Plan  TODAY’S OBJECTIVES ▪ Explain why we should establish a risk-based audit plan. ▪ Steps of a risk-based audit plan. ▪ Risk ranking. ▪ What happens next (selecting audits where the combination of likelihood and impact are the highest. 2  RISK: The effect of uncertainty. 3  Assessing Risk is a three step process. 1. Risk identification. 2. Risk analysis. 3. Risk evaluation. 4  Step 1: Identifying risks using the audit universe. There are three main types of risk. Risks that Risks that affect the Emerging affect a single entire risks. department. organization. 5  Step 2: Analyzing Risks During this step, risks are analyzed in terms of the likelihood (possibility) of the risk occuring and the severity or impact on objectives should the risk occur. 6  Step 3: Evaluating the Risks Inherent Risk Internal controls LIKELIHOOD provide assurance Control that processes are operating effectively and policies are being followed. Residual Risk Risk Appetite CONSEQUENCES 7  Five-by-Five Risk Analysis Matrix High 2 3 3 4 4 Likelihood or Possibility Medium- 2 2 3 3 4 High Medium 1 2 2 3 4 Medium-Low 1 1 2 2 2 Low 1 1 1 2 2 Medium- Low Medium-Low Medium High High Impact or Severity 8  QUESTIONS? 9  Risk Assessment Guide Grant Risk Animal SPLOST Board of Purchasing Mgmt. Level Control 2011 Elections Program 1. Number of authorized staff Risk Indicators 1-3 full-time employees 1 4-10 full-time employees 2 11-20 full-time employees 3 21 or more full-time employees 4 Subtotal 0 0 0 0 0 2. Formal policies and procedures Risk Indicators Formal/Written policies and procedures distributed to staff 1 Formal/Written policies and procedures; not distributed to staff 2 No formal/Written policies and procedures available 3 Subtotal 0 0 0 0 0 3. Date of Last Internal Audit Risk Indicators 0, (Never audited) 1 1-5 years ago 2 6-10 years ago 3 11 years or longer 5 Subtotal 0 0 0 0 0 4. Total Budget Risk Indicators $1-$300k 1 $301k -$1m 3 $1.1m - $5m 5 More than $5m Subtotal 0 0 0 0 0 5. Knowledge of M&C FY20 Strategic Goals Risk Indicators Yes 0 No 3 Somewhat 5 Raw Subtotal 0 0 0 0 0 Subtotal 0 0 0 0 0 6. Accept cash, check or other form of pymt. Risk Indicators Yes 5 No 1 Subtotal 0 0 0 0 0 7. Centralized/Decentralization Risk Indicators Operations are centralized 0 Operations are decentralized to 1 or 2 locations 3 Operations are decentralized to 3 or more locations 5 Subtotal 0 0 0 0 0 8. Major changes anticapated in department Risk Indicators Yes 1 No 3 Subtotal 0 0 0 0 0 9. Customer Demographic Risk Indicators Internal customers only 1 Internal and external customers 3 Primarily external customers 5 Subtotal 0 0 0 0 0 10. Department has formal succession plan Risk Indicators Yes 1 No 3 Subtotal 0 0 0 0 0 Score 0 0 0 0 0 F:\AUDITOFC\Audit Committee\FY20\October 11\Meeting Handouts\Risk Assessment Guide.xlsx 10/17/2019 12:35 PM  Sample Risk Assessment Questionnaire Animal Control 1. Total of authorized staff a. 1-3 full-time employees _____ b. 4-10 full-time employees _____ c. 11 -20 full-time employees _____ d. 21 or more full-time employees _____ 2. Check the answer choice that best describes your department. a. Formal/Written policies and procedures distributed to staff _____ b. Formal/Written policies and procedures; not distributed to staff _____ c. No formal/Written policies and procedures available _____ 3. Check the answer choice that best describes the last time your department had an internal audit. a. 0 (Never audited) _____ b. 1-5 years ago _____ c. 6-10 years ago _____ d. 11 years or longer _____ 4. Check the answer that represents your department’s FY20 budget across all funds? a. $1-300k _____ b. $301k- $1m _____ c. $1.1m - $5m _____ d. More than $5m _____ 5. Are you familiar with the performance measures that support the Mayor and Commission’s FY20 Strategic Goals? Yes_____ No____ Somewhat _____ 6. Does your department accept cash/checks or other forms of payment? (For example, payments for services such as water, the arts, etc.) Yes_____ No_____ 7. Check the answer choice that best describes your department. a. Department operations are centralized in one location _____ b. Department operations are decentralized in two locations _____ c. Department operations are decentralized to three or more locations _____  Sample Risk Assessment Questionnaire Animal Control 8. Do you anticipate major changes that will affect operations in your department over the next 24 months? (For example, new technology, retirement, FMLA, sick leave) Yes_____ No_____ 9. Select the answer that best describes your department’s customer demographic. a. Internal customers only _____ b. Internal and external customers _____ c. Primarily external customers _____ 10. Does your department have a formal succession plan in place? (Plan to prepare employees for advancement as positions become available.) Yes_____ No_____  Sample Risk Assessment Questionnaire BOE 1. Total of authorized staff a. 1-3 full-time employees _____ b. 4-10 full-time employees _____ c. 11 -20 full-time employees _____ d. 21 or more full-time employees _____ 2. Check the answer choice that best describes your department. a. Formal/Written policies and procedures distributed to staff _____ b. Formal/Written policies and procedures; not distributed to staff _____ c. No formal/Written policies and procedures available _____ 3. Check the answer choice that best describes the last time your department had an internal audit. a. 0 (Never audited) _____ b. 1-5 years ago _____ c. 6-10 years ago _____ d. 11 years or longer _____ 4. Check the answer that represents your department’s FY20 budget across all funds? a. $1-300k _____ b. $301k- $1m _____ c. $1.1m - $5m _____ d. More than $5m _____ 5. Are you familiar with the performance measures that support the Mayor and Commission’s FY20 Strategic Goals? Yes_____ No____ Somewhat _____ 6. Does your department accept cash/checks or other forms of payment? (For example, payments for services such as water, the arts, etc.) Yes_____ No_____ 7. Check the answer choice that best describes your department. a. Department operations are centralized in one location _____ b. Department operations are decentralized in two locations _____ c. Department operations are decentralized to three or more locations _____  Sample Risk Assessment Questionnaire BOE 8. Do you anticipate major changes that will affect operations in your department over the next 24 months? (For example, new technology, retirement, FMLA, sick leave) Yes_____ No_____ 9. Select the answer that best describes your department’s customer demographic. a. Internal customers only _____ b. Internal and external customers _____ c. Primarily external customers _____ 10. Does your department have a formal succession plan in place? (Plan to prepare employees for advancement as positions become available.) Yes_____ No_____  Sample Risk Assessment Questionnaire Grant Mgmt. Program 1. Total of authorized staff a. 1-3 full-time employees _____ b. 4-10 full-time employees _____ c. 11 -20 full-time employees _____ d. 21 or more full-time employees _____ 2. Check the answer choice that best describes your department. a. Formal/Written policies and procedures distributed to staff _____ b. Formal/Written policies and procedures; not distributed to staff _____ c. No formal/Written policies and procedures available _____ 3. Check the answer choice that best describes the last time your department had an internal audit. a. 0 (Never audited) _____ b. 1-5 years ago _____ c. 6-10 years ago _____ d. 11 years or longer _____ 4. Check the answer that represents your department’s FY20 budget across all funds? a. $1-300k _____ b. $301k- $1m _____ c. $1.1m - $5m _____ d. More than $5m _____ 5. Are you familiar with the performance measures that support the Mayor and Commission’s FY20 Strategic Goals? Yes_____ No____ Somewhat _____ 6. Does your department accept cash/checks or other forms of payment? (For example, payments for services such as water, the arts, etc.) Yes_____ No_____ 7. Check the answer choice that best describes your department. a. Department operations are centralized in one location _____ b. Department operations are decentralized in two locations _____ c. Department operations are decentralized to three or more locations _____  Sample Risk Assessment Questionnaire Grant Mgmt. Program 8. Do you anticipate major changes that will affect operations in your department over the next 24 months? (For example, new technology, retirement, FMLA, sick leave) Yes_____ No_____ 9. Select the answer that best describes your department’s customer demographic. a. Internal customers only _____ b. Internal and external customers _____ c. Primarily external customers _____ 10. Does your department have a formal succession plan in place? (Plan to prepare employees for advancement as positions become available.) Yes_____ No_____  Sample Risk Assessment Questionnaire Purchasing 1. Total of authorized staff a. 1-3 full-time employees _____ b. 4-10 full-time employees _____ c. 11 -20 full-time employees _____ d. 21 or more full-time employees _____ 2. Check the answer choice that best describes your department. a. Formal/Written policies and procedures distributed to staff _____ b. Formal/Written policies and procedures; not distributed to staff _____ c. No formal/Written policies and procedures available _____ 3. Check the answer choice that best describes the last time your department had an internal audit. a. 0 (Never audited) _____ b. 1-5 years ago _____ c. 6-10 years ago _____ d. 11 years or longer _____ 4. Check the answer that represents your department’s FY20 budget across all funds? a. $1-300k _____ b. $301k- $1m _____ c. $1.1m - $5m _____ d. More than $5m _____ 5. Are you familiar with the performance measures that support the Mayor and Commission’s FY20 Strategic Goals? Yes_____ No____ Somewhat _____ 6. Does your department accept cash/checks or other forms of payment? (For example, payments for services such as water, the arts, etc.) Yes_____ No_____ 7. Check the answer choice that best describes your department. a. Department operations are centralized in one location _____ b. Department operations are decentralized in two locations _____ c. Department operations are decentralized to three or more locations _____  Sample Risk Assessment Questionnaire Purchasing 8. Do you anticipate major changes that will affect operations in your department over the next 24 months? (For example, new technology, retirement, FMLA, sick leave) Yes_____ No_____ 9. Select the answer that best describes your department’s customer demographic. a. Internal customers only _____ b. Internal and external customers _____ c. Primarily external customers _____ 10. Does your department have a formal succession plan in place? (Plan to prepare employees for advancement as positions become available.) Yes_____ No_____  Sample Risk Assessment Questionnaire SPLOST 2011 1. Total of authorized staff a. 1-3 full-time employees _____ b. 4-10 full-time employees _____ c. 11 -20 full-time employees _____ d. 21 or more full-time employees _____ 2. Check the answer choice that best describes your department. a. Formal/Written policies and procedures distributed to staff _____ b. Formal/Written policies and procedures; not distributed to staff _____ c. No formal/Written policies and procedures available _____ 3. Check the answer choice that best describes the last time your department had an internal audit. a. 0 (Never audited) _____ b. 1-5 years ago _____ c. 6-10 years ago _____ d. 11 years or longer _____ 4. Check the answer that represents your department’s FY20 budget across all funds? a. $1-300k _____ b. $301k- $1m _____ c. $1.1m - $5m _____ d. More than $5m _____ 5. Are you familiar with the performance measures that support the Mayor and Commission’s FY20 Strategic Goals? Yes_____ No____ Somewhat _____ 6. Does your department accept cash/checks or other forms of payment? (For example, payments for services such as water, the arts, etc.) Yes_____ No_____ 7. Check the answer choice that best describes your department. a. Department operations are centralized in one location _____ b. Department operations are decentralized in two locations _____ c. Department operations are decentralized to three or more locations _____  Sample Risk Assessment Questionnaire SPLOST 2011 8. Do you anticipate major changes that will affect operations in your department over the next 24 months? (For example, new technology, retirement, FMLA, sick leave) Yes_____ No_____ 9. Select the answer that best describes your department’s customer demographic. a. Internal customers only _____ b. Internal and external customers _____ c. Primarily external customers _____ 10. Does your department have a formal succession plan in place? (Plan to prepare employees for advancement as positions become available.) Yes_____ No_____