Audit Committee

CITY OF HENDERSON AUDIT COMMITTEE REGULAR MEETING MINUTES Wednesday, July 13, 2022 I. CALL TO ORDER Vice Chair/Councilman Dan K. Shaw called the City of Henderson Audit Committee meeting to order at 9:00 a.m. in the Mayor and Council Boardroom, 4th Floor, City Hall, 240 South Water Street, Henderson, Nevada 89015. II. CONFIRMATION OF POSTING AND ROLL CALL Melissa Wright, City Auditor, confirmed the City of Henderson Audit Committee meeting had been noticed in compliance with the Nevada Open Meeting Law. PRESENT: Bryan Allison Vice Chair/Councilman Dan K. Shaw ABSENT: Chair/Councilman John F. Marz STAFF: Jenifer Bessette, Senior Internal Auditor Bristol Ellington, Chief Operating Officer/Deputy City Manager David Furber, Senior Internal Auditor Maria Gamboa, Assistant Director of Finance Stephanie Garcia-Vause, Chief Strategy Officer/Assistant City Manager Robert Herr, Chief Infrastructure Officer/Assistant City Manager Paul McPhee, Senior Internal Auditor Brian Reeve, Assistant City Attorney III Nicole Rourke, Director of Government/Public Affairs Janet Sandifer, Deputy City Clerk Brooke Stream, Human Resources Director Nicholas Vaskov, City Attorney Melissa Wright, City Auditor III. PUBLIC COMMENT There were no public comments presented. IV. ACCEPTANCE OF AGENDA (Motion) Mr. Allison introduced a motion to accept the agenda, as presented. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. Audit Committee Meeting Page 2 of 7 Wednesday, July 13, 2022 – Minutes V. NEW BUSINESS 1 MINUTES AUDIT COMMITTEE MEETING APRIL 20, 2022 INTERNAL AUDIT Audit Committee meeting minutes of April 20, 2022. (Motion) Mr. Allison introduced a motion to adopt the minutes of April 20, 2022, as presented. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. 2 DRAFT AUDIT REPORT CITYWIDE DELINQUENT ACCOUNT COLLECTIONS INTERNAL AUDIT Receive and approve draft audit report of Citywide Delinquent Account Collections. Melissa Wright, City Auditor, gave a presentation and provided a summary of the draft audit report of Citywide Delinquent Account Collections. She noted the objectives on this audit were to determine if delinquent account collection processes throughout the City of Henderson are consistent, effective, and comply with applicable City policy, Nevada Revised Statutes, and contractual obligations. Ms. Wright said this audit encompassed the period from July 1, 2019, through May 31, 2022. Based on the findings, Ms. Wright stated the audit team made the following recommendations:  For the Finance Department to continue in their efforts to develop a written policy and procedures to provide citywide guidance and oversight for delinquent accounts.  City departments consult with Finance for direction on reviewing collection agency records.  City management determine if centralized contract management function is needed. Wright said both the Finance Department and the City Manager’s Office both agreed with the recommendations. Audit Committee Meeting Page 3 of 7 Wednesday, July 13, 2022 – Minutes A brief discussion ensued regarding the current absence of a City-wide policy pertaining to how and when an account is sent to a collection agency by the submitting department(s). Vice Chair/Councilman Shaw recommended the implementation of a collection services firm competitive bidding process. He also recommended auditing the City’s currently contracted collection agency firms, more frequently than yearly, to ascertain their business practices and collection efforts and to verify whether payments are and have been processed accurately on the City’s behalf. (Motion) Mr. Allison introduced a motion to approve the draft audit report of Citywide Delinquent Account Collections. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. 3 DRAFT AUDIT REPORT CITYWIDE CULTURE AND ETHICS INTERNAL AUDIT Receive and approve draft audit report of Citywide Culture and Ethics. Melissa Wright, City Auditor, gave a presentation and provided a summary of the draft audit report of Citywide Culture and Ethics. She noted the objectives on this audit were to determine if cultural and ethical programs exist within the City of Henderson, if cultural and ethics education is provided to City staff, if mechanisms are in place to report cultural and ethical misconduct, and to ensure whether City-wide cultural and ethical initiatives that are already implemented, to date, are effective. Ms. Wright said this audit encompassed the period from January 1, 2019, through the present. A brief discussion ensued regarding workforce demographics Responding to an inquiry from Vice Chair/Councilman Shaw regarding whether goals need to be set for the City’s workforce demographics and the employee by gender percentages, Brooke Stream, Human Resources Director, stated the workforce demographics are analyzed on an annual basis and stated positions are being added that will focus primarily on City-wide demographics. She also said although there are quite a few positions that are traditionally male dominated, the Human Resources Department realizes the world is changing and more diversity is needed. Audit Committee Meeting Page 4 of 7 Wednesday, July 13, 2022 – Minutes Based on the findings, Ms. Wright stated the audit team made no recommendations as a part of this audit engagement and commended the City Manager’s Office for continuously working with the Human Resources Department to monitor, review, and assess culture and ethics to ensure the City stays relevant and maintains a positive organizational culture. Ms. Wright said although there were no recommendations, Bristol Ellington, Chief Operating Officer/Deputy City Manager, has requested the audit team to perform a follow-up audit in a year to report back specific topics, such as diversity within managerial positions versus within Teamsters and other field operation positions. Ms. Wright said the follow-up audit will also contain information requested by Robert Herr, Chief Infrastructure Officer/Assistant City Manager, which will include information related to teleworking and how it has impacted the City’s culture. (Motion) Mr. Allison introduced a motion to approve the draft audit report of Citywide Culture and Ethics. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. 4 DRAFT AUDIT REPORT DEPARTMENT OF INFORMATION TECHNOLOGY CYBER SECURITY INTERNAL AUDIT Receive and approve draft audit report of the Department of Information Technology Cyber Security. Melissa Wright, City Auditor, gave a presentation and provided a summary of the draft audit report of the Department of Information Technology (DoIT) Cyber Security. She noted the objective on this audit was to evaluate the efficiency and effectiveness of existing information technology controls that would help deter, prevent, and/or respond to cyber-attacks. Ms. Wright said this audit encompassed the period from January 1, 2019, through the present. Based on the findings, Ms. Wright stated the audit team made the following recommendations:  Departments should be notified of staff successes and failures for simulated phishing attacks.  The City should continue to invest adequate resources and work towards full Health Insurance Portability and Accountability Act (HIPAA) compliance.  The password policy should be strengthened to enhance security. Audit Committee Meeting Page 5 of 7 Wednesday, July 13, 2022 – Minutes  The DoIT Security Division should verify compliance of Provider-1 with Criminal Justice Information System (CJIS) and with Nevada Criminal Justice Information System (NCJIS) security policies.  All rogue device alerts should be investigated within 24 hours and revoked device alerts should be investigated within one business day and resolved by DoIT personnel within a two-week period.  Discrepancies between entries in the CSSTools program and active devices reports be regularly reviewed by DoIT, and steps be taken to reconcile the differences. Ms. Wright stated the audit team commended the DoIT for achieving a 100 percent compliance rate for Payment Card Industry Data Security Standards. She said DoIT and the City Attorney’s Office were commended for recognizing the need for additional language to further protect and ensure controls are in place over City data. Vice Chair/Councilman Shaw stated he has noticed cashier staff utilizing their cell phones during the course of their shifts while having access to accounts and asked staff how compliance is monitored in those situations. Terry Daus, Information Security Manager, stated because the City no longer stores credit card numbers in any systems and because only the customer handles their own credit cards for card present transactions, there is very little risk of the cashier staff being able to capture the credit card numbers. He also said all credit card processing is outsourced to a third-party vendor. A brief discussion ensued regarding how third-party vendor compliance is monitored by DoIT staff, the efficiency of the City’s current firewall software, and the recommendation regarding the strengthening of the password policy to enhance security. (Motion) Mr. Allison introduced a motion to approve the draft audit report of the Department of Information Technology Cyber Security. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. Audit Committee Meeting Page 6 of 7 Wednesday, July 13, 2022 – Minutes 5 RISK ASSESSMENT REPORT AS OF JUNE 2022 INTERNAL AUDIT Receive and approve Risk Assessment Report as of June 2022, including the Fiscal Year 2023 Proposed Audit Plan. Melissa Wright, City Auditor, gave a presentation and provided a summary of the Risk Assessment Report as of June 2022, including the Fiscal Year 2023 Proposed Audit Plan. She said the internal audit process includes analyzing risks and preparing an audit plan, obtaining audit plan approval by the Audit Committee, conducting audit engagements, presenting audit reports to the Audit Committee, and presenting follow-up reports to the Audit Committee. A brief discussion ensued regarding the Risk Assessment Process. Following an inquiry from Vice Chair/Councilman Shaw regarding the possibility of having risk assessments conducted for City Council agenda items prior to deciding on them to avoid issues that may come up afterwards, Ms. Wright said the audit team would be happy to work with the City Manager’s Office to develop a process to be provided to City departments that may help to mitigate risks on the front-end. (Motion) Mr. Allison introduced a motion to approve the Risk Assessment Report as of June 2022, including the Fiscal Year 2023 Proposed Audit Plan. The vote favoring approval was unanimous. Vice Chair/Councilman Shaw declared the motion carried. VI. CHAIRMAN\MEMBER COMMENTS There were no Chair\Member comments presented. VII. SET NEXT MEETING The next meeting was set for December 7, 2022, at 3:00 p.m. Audit Committee Meeting Page 7 of 7 Wednesday, July 13, 2022 – Minutes VIII. PUBLIC COMMENT There were no public comments presented. IX. ADJOURNMENT There being no further business to be discussed, Vice Chair/Councilman Shaw adjourned the meeting at 9:33 p.m. Respectfully submitted, /s/ Janet Sandifer Janet Sandifer, Deputy City Clerk