Mayor & Commission Meetings

Audit Committee Meeting Agenda Wednesday, August 12, 2020 5:00 – 6:30 pm Teleconference A. Review and approval of meeting minutes – June 17, 2020 Review and approval of meeting minutes – July 13, 2020 B. Status of Audit Work Plan Activity  Fleet Management Program Complete  Animal Services Department Complete  2020 Risk Assessment Complete C. Risk Assessment Presentation D. Audit Topics Under Consideration for 2020 E. Administrative Updates  Audit Management Software  2020 Overview Commission F. Next Meeting Date – TBD  AUDIT COMMITTEE MEETING MINUTES Wednesday, June 17, 2020 Committee Members Present: Visiting: Commissioner Melissa Link, Committee Chair Deborah Lonon, Assistant Manager Commissioner Patrick Davenport Josh Edwards, Assistant Manager Commissioner Ovita Thornton Blaine Williams, Manager Commissioner Allison Wright Committee Members Absent: Commissioner Russell Edwards Staff: Stephanie Maddox, Internal Auditor Aaron Court, Student Intern Committee Chair Link called the meeting to order at 5:15 pm. A. Approval of Minutes: The Committee unanimously approved the Minutes of the May 13, 2020 meeting. B. Work Plan Update: Internal Auditor Maddox provided a status update on the annual work plan.  Central Services Department – Fleet Management Division  Animal Services C. Inmate Medical Services: Staff presented preliminary findings and recommendations on the Inmate Medical Services Draft Report. The Audit Committee requested that Auditor Maddox follow up with the Sheriff’s Office concerning missing data to add onto the report for additional context. D. Risk Assessment: Staff presented preliminary data on the 2020 Risk Assessment. The Audit Committee requested that staff continue to follow up with those Departments and Divisions that have yet to complete the risk assessment survey. The Audit Committee agreed to set the next meeting for Monday, July 13, 2020, at 5:30 pm. Commissioner Thornton motioned to adjourn the meeting. Commissioner Davenport seconded. The meeting adjourned at 6:15 pm. Page 1 of 1  AUDIT COMMITTEE MEETING MINUTES Monday, July 13, 2020 – Via WebEx Committee Members Present: Visiting: Commissioner Melissa Link, Committee Chair Blaine Williams, Manager Commissioner Allison Wright Deborah Lonon, Assistant County Manager Commissioner Russell Edwards Josh Edwards, Assistant County Manager Commissioner Ovita Thornton Keith Sanders, Program Admin., SPLOST Commissioner Patrick Davenport Staff: Stephanie Maddox, Internal Auditor Aaron Court, Student Intern Sarah Dryden, Student Intern Committee Chair Link called the meeting to order at 5:37 pm. A. June Minutes Commissioner Link suggested that the committee postpone the approval of the June 17 minutes to allow for amendments due to technological issues and disruptions that occurred during the meeting. The entire committee agreed to submit their notes from last month’s meeting to make the minutes more thorough. B. Work Plan Update Internal Auditor Maddox provided a status update on the audit work plan:  Central Services Department – Fleet Management Division  Animal Services Department Both of these audits are expected to be completed by the end of the month. C. Risk Assessment Internal Auditor Maddox gave an update about the Risk Assessment. Since the last meeting, the Office of Operational Analysis has gotten several more responses to the Risk Assessment Questionnaire, increasing their response rate to 92%. D. Inmate Medical Services Internal Auditor Maddox presented the findings and recommendations made by the Office of Operational Analysis upon reviewing Armor Correctional Healthcare’s contract terms, expenditures, and compliance. E. Audit Topics Under Consideration for 2020 The committee reviewed the list of audits under consideration. Commissioner Link suggested that an audit of the Police Department be added to the list of potential audits based on current Page 1 of 2  community concerns, and Commissioner Thornton agreed. Commissioner Wright reminded everyone that the Risk Assessment is intended for determining future audits, and Commissioner Link responded by saying the Risk Assessment is the quantitative tool to supplement qualitative decision-making. Commissioner Edwards motions to table the discussion of the audit plan until the Risk Assessment comes back. Commissioner Thornton seconded. All in favor. F. Administrative Update Internal Auditor Maddox provided an update on two administrative areas:  Audit Management Software – Internal Auditor Maddox advised the committee that a vendor has been selected and the next step is to prepare an agenda item for the software.  2020 Overview Commission The next Audit Committee meeting is scheduled for August 12, 2020, from 5:30 pm – 6:30 pm via WebEx. Commissioner Edwards motioned to adjourn the meeting. Commissioner Thornton seconded. The meeting adjourned at 6:48 pm. Page 2 of 2  AUDIT STATUS REPORT DATE: August 12, 2020 TO: Audit Committee FROM: Stephanie Maddox, Internal Auditor Office of Operational Analysis SUBJECT: Status of Work Plan Activity The following table summarizes the current status of each audit according to audit stages. A description of the audit stages is below the table. WORK IN PROGRESS Status Completion Project The percentage indicates the completion level Forecast Fleet Management Program Pre-Audit Planning – 100%  Schedule Exit Conference July 2020 Discovery Stage – 100% with the Director of Analysis – 100% Central Services Department and Fleet Conclusions – 100% Division Superintendent to Recommendations – 100% discuss Findings and Recommendations. Animal Services Department Pre-Audit Planning – 100%  Next step: Submit the draft July 2020 Discovery Stage – 100% report to the Audit Analysis – 100% Committee. Submit draft report to the Deparment Conclusions – 100% and to the Manager’s Recommendations – 100% Office for review. The response to the audit report is anticipated after 30 days. Risk Assessment tool for audit 1. Identify the audit universe  Present results at next July 2020 planning 2. Understand M&C Strategic Audit Committee meeting Objectives for discussion of the next 3. Conduct risk assessment audit (August 2020). 4. Analyze results 5. Identify communities to benchmark results 6. Determined highest areas of risk AUDIT STAGES Pre-Audit Planning: OOA staff conducts literature reviews, identifies benchmark communities, research best practices, develops pre-audit survey(s), and requests documents related to the audit client. OOA staff conducts a pre-conference meeting with the audit client/department (Dept. Director), discusses the audit process, the timing of fieldwork, and answers any questions. Discovery: Interviews, information validation, observations, and surveys. As this stage is critical to the preparation of a complete and meaningful audit, it consumes the majority of the time involved. Analysis: Assigning meaning/value to the information, determining what it reveals related to the scope of the audit. Defines systems, processes, and practices in terms of effectiveness and efficiency. Conclusions: Identifies and describes constraints and opportunities regarding developments and implementation of needed improvements. Recommendations: Suggests action that can be taken into consideration of the constraints and opportunities. Risk Assessment Prepared by the Office of Operational Analysis  Overview Our risk assessment tool was sent out to 117 auditable areas across 38 departments of the ACCUG. We received responses from 114 auditable areas and 36 departments, yielding a response rate of 95%. • Two departments that were given an extension to complete the Risk Assessment: • Magistrate Court • Attorney’s Office • One division (1/117) did not respond to the Risk Assessment Questionnaire: • Safety and Risk Division, Human Resources Department  Benchmark Comparisons • In order to add value to our data, we reached out to other governments to request a copy of their risk assessment to compare our results. • We received Risk Assessments from 3 community governments: • City of Asheville • Chatham County • Dekalb County  Categories of Risk These 4 overarching risk categories will be used to evaluate and connect the Risk Assessment to ACC’s Strategic Objectives. Financial Risk Staffing Risk Operational Risk Community and Reputation Risk  Financial Risk Financial Risk relates to the ACC Strategic Top Categories of Financial Risk Goal of 1. Shared Prosperity. Travel/P-cards In benchmarking with comparable communities, the top three areas of Financial Risk are: Purchasing/Procurement Consulting Fees • Travel/P-card program • Purchasing/Procurement • Consulting Fees  Staffing Risk Staffing Risk relates to the ACC Top Categories of Staffing Risk Strategic Goal of 2. Accountable and Responsive Government. In benchmarking with comparable communities, the top three areas Vacancy Rate (FT) Promotion/Raises of Staffing Risk are: Benefits • Vacancy Rate (FT)* • Promotion/Raises • Employee Benefits  Operational Risk Operational Risk relates to 2 of the 6 Strategic Goals: Top Areas of Operational Risk 3. Healthy, Livable, Sustainable Athens-Clarke County 4. Transportation Mobility and Connectivity. Grant Compliance/ Contract Management In benchmarking with comparable communities, the top Audit History three areas of Operational Risk are: • Lack of written policies (standard operating procedures) Lack of written • SOPs (Standard Operating Procedures) policies • P&Ps (Policies and Procedures) • Inconsistency of managing grants on a departmental level • Audit History  Community & Reputation Risk Community and Reputation Risk relates to 2 Strategic Goals: 5. Safe and Prepared Community Top Categories of Community and Reputation Risk 6. Informed and Engaged Citizens Complaint ACC Website Management In benchmarking with comparable communities, the top three areas Transparency of Community and Reputation Risk are: • Residents find it difficult to locate specific information on the ACC Website • Perceived lack of transparency • Last minute submissions of items added to the agenda • Funding decisions are not clear to the community • Departments lack a formal complaint management process  What is a formal complaint management process?  Summary Financial Risk • Credit Card Program (Travel/P-card ) • Purchasing/Procurement • Consulting Fees Staffing Risk • Vacancy Rate (FT) • Promotion/Raises • Employee Benefits Operational Risk • Lack of written policies and procedures • Grant management and compliance • Audit History Community and Reputation Risk • Residents find it difficult to locate specific information on the ACC Website • Perceived lack of transparency • Departments lack a formal complaint management process  Proposed Audits for 2020-2021 Department Audit Topic(s) Additional Information Proposed Audit Scope 1. Finance Department - Credit Card Program (Purchasing and Travel Cards) Objective and Scope: Purchasing Division 1. High value transactions and high amounts per month across • Assess Internal Controls and processes/procedures of the P-card program. multiple transactions • Are cardholders in compliance with the P-card policy 2. Duplicate and split transactions • Evaluate reconciliation process 4. Late or missing cardholder or manager approvals • Conduct financial transaction analysis to determine if unauthorized 5. Keyword search could reveal personal transactions or other purchases are approved violations • Is consistent documentation submitted by card users 6. Maximum spending limit/day (per transaction) • Determine if internal control weaknesses exist 7. Are itemized receipts reviewed 2. SPLOST Program Areas of interest: Objective and Scope: One SPLOST program. For example, SPLOST 2011. 1. Determine if there is clear communication to decision makers, residents, etc. for how project savings are spent 2. Determine what is in place to hire local contractors 3. Citizen input and user group viability (are citizens included in final project design process?) 4. Do the details of the final project design match the original intent of the project as presented for the referendum voted on by citizen? 3. Grant Management Program Common findings Objective and Scope: • Untimely report submissions • Evaluate performance oversight and program outcomes Administration, Compliance and • Lack of documentation • Evaluate grant process (programmatic, budgeting, accounting, etc.) Oversight • Inadequate monitoring of subrecipients • Are grant resources utilized in accordance with the contract • Inadequate time/effort reports • Determine if training is needed • Excess cash on hand • Unallowable costs • Unauthorized changes 4. Board of Elections Risks unique to the elections process Objective and Scope: 1. Segregation of Duties • Determine whether BOE has the controls in place to ensure an accurate, 2. Document Management fair, and efficient election 3. Policies and Procedures • To assess the effectiveness of BOE's efforts to comply with reporting and 4. Reduced Confidence disclosure requirements 5. Voter Registration Systems and equipment • Determine if the BOE has administrative rules, policies and procedures in 6. Perceived lack of transparancy place • Assess the effectiveness of BOE's efforts to comply with reporting and disclosure requirements 5. Police Department Quantitative Audit Examining: Objective and Scope: • The PD's different funding streams • Provide overview of the department's organizational structure (include • Staffing Structure both admin and sworn officer positions) • Determine what percent of the PD's budget is grant funding. • Determine the outcomes of reducing funding • Perform salary evaluation- benchmark with other communities 08/11/2020