Audit Committee

Audit Committee Meeting Agenda Friday, November 8, 2019 1:00 – 2:00 pm City Hall, Room 301 A. Review and approval of meeting minutes - October 11, 2019 B. Status of Audit Work Plan Activity  Public Utilities Department — Water Business Office  Central Services Department — Fleet Management Program  Sheriff’s Office — Inmate Medical Services  Animal Services Department — Animal Control C. Alternative audit selection tool: Questionnaire and heat map D. Work Plan  Multi-year audit work plan  Proposed audits for the current year. E. Next Meeting Date – Friday, December 6, 1:00-2:00 p.m., City Hall – Room 301 Attachments: 1. November 8 meeting agenda 2. Minutes for review and approval from October 11 meeting 3. November 2019 –Status of Audit Work Plan Activity Report 4. Audit Risk Questionnaire 5. Mimi-Dade – 2018-2019 Audit Business Plan 6. OKC 3-Year Audit Plan 7. Charlotte - 2019-2020 Audit Plan Note: The Audit Committee Meeting is open to the public; however, public comments are not received unless the Committee Chair requests that an individual provide information. O FFI CE O F O P ER A TI O N AL A N AL YSI S T H E U N I F I E D G O V E R N M E N T O F A T H E NS -C L A R K E C O U N T Y , G E O R G I A 300 College Avenue, Suite 202 • Athens, Georgia 30601 • (706) 613-3012 www. at h en sc lar k e c o unt y. c o m / 2 3 6/ O p er at i on al - An al ys is - Of f i ce  AUDIT COMMITTEE MEETING MINUTES Friday, October 11, 2019 Committee Members Present: Visiting: Commissioner Melissa Link, Committee Chair Deborah Lonon, Assistant Manager Commissioner Ovita Thornton Charlotte Sosebee, Board of Elections Commissioner Allison Wright Michael Smith, Community Citizen Commissioner Russell Edwards Staff: Stephanie Maddox, Internal Auditor Jill Arquette, Management Analyst Deborah Allen, Recorder Chair Link called the meeting to order at 1:05 pm. A. Approval of Minutes: The Committee approved the Minutes of the September 11, 2019 meeting. B. Work Plan Update: Internal Auditor Maddox updated the committee on the annual work plan:  Sheriff’s Office – Inmate Medical Services  Public Utilities Department – Water Business Office  Central Services Department – Fleet Management Program  Manager’s Office – Animal Services C. 2019 Work Plan: The committee discussed the work plan for the Animal Services audit. D. General Discussion: Staff presented a mock beta test of the risk assessment tool. The committee requested risk assessment examples from the University of Georgia and two unified governments. The Committee discussed moving to a multi-year audit plan. E. Items for Discussion at November 8, 2019 meeting:  Alternative audit selection tool: questionnaire and correlating heat map  Multi-year audit plan  Proposed audits for the current year The next meeting is scheduled for Friday, November 8, from 1:00 – 2:00 p.m., City Hall. The meeting adjourned at 2:15 p.m. The above summation is an interpretation of the items discussed and decisions reached at the above-referenced meeting, not a transcript of the meeting. Transcribed verbatim minutes of the meeting are available on the department’s webpage at https://www.accgov.com/operationalanalysis. Page 2 of 44  DATE: November 8, 2019 TO: Mayor and Commission FROM: Stephanie Maddox, Internal Auditor Office of Operational Analysis (formerly, the Auditor’s Office) SUBJECT: Status of Work Plan Activity The following table summarizes the current status of each audit according to audit stages. A description of the audit stages is below the table. WORK IN PROGRESS Status Completion Audit The percentage indicates the completion level Forecast Clarke County Sheriff’s Office – Pre-Audit Planning – 100% *Review of medical services November 2019 Inmate Medical Services Discovery Stage – 90% contract with Armor Medical. Contract Analysis – 40% Conclusions – 0% Recommendations – 0% Public Utilities Department – Pre-Audit Planning – 100 % *Draft report submitted to the October 2019 Water Business Office Discovery Stage – 100% department. Analysis – 100% Conclusions – 100% Recommendations – 100% Central Services Department – Pre-Audit Planning – 100% Next Steps: *Interviews 95% November 2019 Fleet Management Program Discovery Stage – 95% complete; schedule final meeting Analysis – 90% with Fleet Division. Conclusions – 75% *Finalize analysis and report Recommendations – 75% writing. Animal Services Department – Pre-Audit Planning – 10% Tentatively scheduled to start the January 2020 Animal Control Discovery Stage – 10% week of November 11. Analysis – 0% Conclusions – 0% Recommendations – 0% AUDIT STAGES Pre-Audit Planning: OOA staff conducts literature reviews, identifies benchmark communities, research best practices, develops pre-audit survey(s), and requests documents related to the audit client. OOA staff conducts pre-conference meeting with the audit client/department (Dept. Director), discusses the audit process, the timing of fieldwork, and answers any questions. Discovery: Interviews, information validation, observations, and surveys. As this stage is critical to the preparation of a complete and meaningful audit, it consumes the majority of time involved. Analysis: Assigning meaning/value to the information, determining what it reveals related to the scope of the audit. Defines systems, processes, and practices in terms of effectiveness and efficiency. Conclusions: Identifies and describes constraints and opportunities regarding developments and implementation of needed improvements. Recommendations: Suggests action that can be taken into consideration of the constraints and opportunities. Page 3 of 44  Unified Government of Athens-Clarke County Office of Operational Analysis 2019 Risk Assessment Questionnaire The Office of Operational Analysis is conducting a comprehensive, interactive Risk Assessment that includes input from departments and divisions regarding the operations of their respective areas. The Risk Assessment of a department allows us to analyze the designated department's operations and assists us in evaluating and identifying the areas where improvement, if any, is needed. The Risk Assessment Questionnaire is a tool that is used to aid in this process. In using this tool, departments are encouraged to evaluate staffing, budgets, and internal controls. When completing this questionnaire, please answer the questions for each topic. Check the boxes that most accurately describe your department’s status. There are two (2) boxes per category that should be checked (1 box for impact and 1 box for likelihood). Please offer additional comments, as necessary in the space provided. The results of the assessment are intended to provide useful information for the Mayor and Commission in developing the annual Audit Work Plan. Thank you in advance for your assistance. Please contact the Office of Operational Analysis should you have any questions at (706) 613-3012 or email at www.accgov.com/operationalanalysis. Page 4 of 44  Department Name: Completed by (Name & Position): Date: Objectives, Risks, and Exposures Identify any known departmental objectives, exposures, and risks. Create a bulleted list of the areas in the chart below. • Key Objectives—The purpose of the Department. What determines whether the Department had a successful year? • Key Risks—Any thing that could prevent the Department from accomplishing its objectives. • Exposures—The biggest undesirable outcome the Department would face if this area does not perform well in carrying out its objectives. Key Objectives Key Risks Key Exposures Page 5 of 44 Consulting Contracts Include consultants or contract laborers hired between FY18-FY20 for any service. Put N/A if no consultants were contracted. Final Report Annual Formally Expense or Presented to Location of Consultant Brief Description of Services Provided Agreed Upon the Mayor & Final Report Contract Price Commission Yes or No Page 6 of 44 Describe the purpose of working with/hiring a consultant: Size of Department Please list the approximate number of part-time and full-time employees within the Department. Full-Time: Part-Time: Total: Inventory/Capital Assets If inventory/capital assets exist, please list the type of inventory/capital assets kept and the estimated value. This should not include such things as standard office furniture but include such items as vehicles, portable equipment/tools, IT equipment, and for-sale inventory. Impact of risk: ☐ 1. Department does not have any inventory and/or capital assets. ☐ 2. Department has inventory and/or capital assets valued between $50,000 and $250,000. ☐ 3. Department has inventory and/or capital assets valued over $250,000. Likelihood of risk occurring: ☐ 1. No inventory or assets exist, or value is greater than $50,000. Page 7 of 44  ☐ 2. Inventory and/or capital assets exist with value between $50,000 and $250,000. ☐ 3. Inventory and/or capital assets are likely to exist within the next 12 months, or the value of current inventory and/or capital assets exceeds $250,000. Comments regarding types of inventory or controls in place over inventory: Interest to Outside Parties Please consider the amount of exposure or reputational risk a negative occurrence would have on the Department if reported in the media. This would include: • Fraud, waste, or abuse in the Department • Visibility of the Department • Clear and timely communication related to public interests • Legal exposure • Financial exposure • General media attention Impact of risk: ☐ 1. No media exposure, low visibility, low public interest, and little or no financial exposure. ☐ 2. Some public interest, medium visibility, and some financial exposure. ☐ 3. High public interest, high visibility, and moderate financial exposure. Likelihood of occurring: ☐ 1. Unlikely to occur within the next 12 months. ☐ 2. Likely to occur within the next 12 months. ☐ 3. Occurred several times in the last 12 months. Page 8 of 44 Comments regarding any past incidents or possible future impact: Handling of Cash Please consider the following factors when assessing the handling of cash: • Is cash collected in your department • How many staff members are responsible for handling cash • Does your Department have a petty cash fund • What controls are in place over the petty cash fund • Does the Department have its own bank account • Are staff in the Department issued a travel card and or a P-card for their use Impact of risk: ☐ 1. Does not handle any cash, checks, or credit cards for receipts or purchases. ☐ 2. There are designated staff or limited access to cash, checks, credit card receipts, credit cards, and P-card payments. ☐ 3. The handling of cash, checks, credit card receipts, and credit and P-card payments are routine transactions in the Department. Likelihood of risk occurring: ☐ 1. No cash, checks, or credit cards for receipts or purchases is handled, nor is it likely it will be handled within the next 12 months. ☐ 2. Handling of cash, checks, or credit cards for receipts or purchases is limited to designated staff in the department. ☐ 3. Handling of cash, checks, or credit card for receipts or purchase occurs every day or will occur within the next 12 months. Page 9 of 44 How many staff are assigned travel cards and/or P-cards? Travel Card: P-Card: Comments regarding type cash/payments received or controls over process: Instances of Fraud, Waste, and Abuse Have any instances of fraud or deceptive activities by employees or vendors been committed in your Department between FY15-FY20? Deceptive activities include; unsupported financial transactions, no segregation of duties with cash handling, theft of department resources, and using County work time for personal time. Yes ☐ No ☐ Prefer not to answer ☐ If yes, please explain: Complexity of Transactions Please consider the following factors when assessing the Department’s complexity of transactions: • The level of automation that is involved with daily transactions or processes compared to more manual/judgement-based processes, and • How this affects operations or frequency errors. Page 10 of 44 Impact of risk: ☐ 1. Transactions or processes are mostly automated with limited risk of error and are not very time consuming. ☐ 2. Transactions or processes are moderately automated, require a minimal number of manual steps to complete, and are moderately time consuming. ☐ 3. Transactions or processes are mostly manual, require several persons or steps, and are very time consuming. Likelihood of risk occurring: ☐ 1. Complex transactions are unlikely to occur within the next 12 months. ☐ 2. Complex transactions have occurred several times in the past 12 months, but control procedures are in place to reduce the risk. ☐ 3. Complex transactions have occurred several times in the past 12 months, and control procedures are not in place to reduce the risk. Comments regarding any processes/transactions that require more management review: Departmental Changes Please consider the following factors when assessing departmental changes: • Size of the staff • Significant turnover in the last five years (especially in key management positions) • Changes in work function • Addition(s) or deletion(s) of significant departmental operations • An increase or decrease in work or service activity FY15-FY20 • New or discontinued funding sources Page 11 of 44 Impact of risk: ☐ 1. No significant changes have occurred in the past 12 months. ☐ 2. Funding, staffing, work responsibilities have experienced a moderate change over the past 12 months. ☐ 3. Large scale changes have been made to the department over the past 12 months. Likelihood of risk occurring: ☐ 1. Departmental changes are unlikely to occur within the next 12 months. ☐ 2. Small departmental changes have occurred in the last 12 months or are anticipated to occur within the next 12 months. ☐ 3. Significant departmental changes have occurred in the last 12 months or are anticipated to occur within the next 12 months. Please list any staff changes since FY15: Additions: Subtractions: Full-Time: Part-Time: Comments regarding reasons for staffing changes: Page 12 of 44 Information Technology Changes Please consider if the Department has undergone any information technology changes in the past year, if these changes have improved operations, and any known security or operational issues relating to the new technology changes. Impact of risk: ☐ 1. There have been no new IT changes during the past 12 months, and there are no known security or operational issues. ☐ 2. Minor changes have been made to the IT environment in the past 12 months, and potential security and operational issues may occur. ☐ 3. The IT environment has changed significantly or been replaced in the past 12 months, and security or operational issues are possible. Likelihood of risk occurring: ☐ 1. Information technology changes are unlikely to occur within the next 12 months. ☐ 2. Information technology changes have occurred in the past 12 months, but IT security controls have been implemented into the system. ☐ 3. Information technology changes are likely to occur in the next 12 months, or IT security controls have not been implemented into the current system. Please comment on any changes since 2018 in key IT systems and an explanation of the purpose of the system or noted issues: Page 13 of 44 Quality of the Internal Control System Please consider the following factors when assessing the quality of the Department’s internal control system: • Current comprehensive policy and procedure (P&Ps) manual exists and is available to staff • Current comprehensive Standard Operating Procedures (SOPs) manual exists and is available to staff • Availability of current job descriptions • What type of training program exists • Known internal control weaknesses exist which would allow for fraudulent financial reporting to occur Impact of risk: ☐ 1. Excellent internal controls exist and are practiced with minor weaknesses. Formal written P&Ps and SOPs exist. ☐ 2. Internal controls exist, but some known weaknesses exist. ☐ 3. Internal controls are non-existent, and formal written P&P and SOP manuals do not exist. Likelihood of risk occurring: ☐ 1. Unlikely to occur within the next 12 months due to mitigating controls that are in place. ☐ 2. Likely to occur within the next 12 months due to the lack of adequate controls in place. ☐ 3. Occurred several times in the last 12 months due to the lack of controls in place. Comments on any examples of internal controls in place: Page 14 of 44 Regulations and Compliance Please consider the following factors when assessing any Federal, State, or local regulations and compliance oversight: • Local, state, and/or federal regulations or compliance oversight • The total amount of grant funds received annually • Knowledge of grant management regarding requirements of contract agreements Impact of risk: ☐ 1. Department is not affected or is minimally affected by Federal and/or State regulations. No Federal or State funds are received. ☐ 2. Department is moderately affected by Federal and/or State regulations. Federal and/or State Funds are received. ☐ 3. Department is heavily reliant on Federal and/or State funding and, therefore, subject to extensive regulations. Federal and/or State Funds are received. Likelihood of risk occurring: ☐ 1. Unlikely to occur within the next 12 months due to the Department not being affected by Federal and/or State regulations nor receiving Federal and/or State funds. ☐ 2. Federal and/or State funds will be received in the next 12 months. The Department will be required to follow Federal and/or State regulations. ☐ 3. Federal and/or State funds have been received within the last 12 months. The Department has been required to follow Federal and/or State regulations. Comments on types of grants received, the dollar value of funds, or monitoring efforts over funds: Page 15 of 44 Prior Audit Results Please consider any audits completed by either the Office of Operational Analysis (formerly the Auditor’s Office) or any regulatory agency affiliated with the department. Provide the date of the audit and any findings noted, if applicable, in the comments section below. Impact of risk: ☐ 1. The department has undergone an audit within the last five years, and no findings were noted. ☐ 2. An audit was conducted more than five years ago; findings were noted. ☐ 3. The department has not undergone an audit. Likelihood of risk occurring: ☐ 1. Low – the department has undergone an audit between FY18-FY19. ☐ 2. Moderate – the department has undergone an audit between FY15-FY19. ☐ 3. High – the department has never undergone an audit. OR significant findings were found in any audit in the last five years. Comments on any audit or review results: Page 16 of 44 Audit History Please list all audits (internal and/or external) the Department underwent between FY15-FY19. Audit or Project Title Fiscal Year Miscellaneous Questions: Is there any other information you wish to furnish regarding any potential performance or operational issues (i.e., difficulties receiving information, lack of review or monitoring procedures in place, insufficient funding in the operating or capital budget, etc.) related to your department? Other Comments or requests to meet with the Office of Operational Analysis: Page 17 of 44 Page 18 of 44 Page 19 of 44 Page 20 of 44 Page 21 of 44 Page 22 of 44 Page 23 of 44 Page 24 of 44 Page 25 of 44 Page 26 of 44 Page 27 of 44 Page 28 of 44 Page 29 of 44 Page 30 of 44 Page 31 of 44 Page 32 of 44 Page 33 of 44 Page 34 of 44 Page 35 of 44 Page 36 of 44 Page 37 of 44 Page 38 of 44 Page 39 of 44 Page 40 of 44 Page 41 of 44 Page 42 of 44 Page 43 of 44 Page 44 of 44