1 2023-2024 San Mateo County Civil Grand Jury
Assessing and Reporting Internal Controls
in San Mateo County Agencies and School Districts
“FAILURE OF ANY CONTRIBUTES TO PUBLIC DISTRUST OF ALL”
ISSUE
San Mateo County, Cities, Special Districts, Joint Power Authorities, or Schools are not assessing internal controls and are not reporting the results of assessments to governing boards and the public.
SUMMARY
Our government faces risks, including fraud and waste.
Internal controls are put in place by an entity's oversight body, management, and other personnel to provide reasonable assurance that the entity will achieve its objectives. Internal controls in our government are key to ensuring that goals are met without fraud and waste and are critical to the public trust. An example of an internal control is having separate people approve a transaction before paying the bill for that transaction.
Internal controls hit the public eye back in the 1990s, after the scandals at Enron, WorldCom and other organizations, all of which served as examples of fraud and waste. The United States Congress reacted in 2002 by enacting the laws known as Sarbanes–Oxley that impact publiclytraded companies. In 2015, the State of California issued “Internal Control Guidelines - California Local Agencies” covering the need for internal controls in government entities.
Given the enormity of the challenge of reviewing individual controls at any one agency, the Civil Grand Jury looked into the way government entities in San Mateo County assess their internal controls and how the results of those assessments are reported to governing boards and to the public. Assessments and reporting should follow the State of California guidelines and the underlying referenced guidelines from the Green Book and the Committee of Sponsoring Corporations. Management’s assessment of internal controls and communication, both internally within an entity and externally to the entity’s constituents, are key principles of internal controls. 2 2023-2024 San Mateo County Civil Grand Jury
Too many examples of lack of or failed internal controls exist, including recent news stories about taxpayer money used for constructing personal residences in train stations in Burlingame and San Mateo that are referenced in the attached Appendix.
The Civil Grand Jury learned from survey respondents that all of them do have established internal controls and publish external audit reports. Most of them, however, do not assess internal controls and do not communicate with governing boards or the public regarding management of internal controls. Of the few entities that do assess internal controls, they do not report those results.
The Civil Grand Jury recommends timely and documented assessments of internal controls with clear, appropriate reports from management to governing boards and to the public to reduce the risk of failed internal controls, to enhance public confidence in our government and to improve the efficiency of external audits.
By rule of the Civil Grand Jury, the recommendations included in this report can only be sent to entities that participated in interviews with the Civil Grand Jury. While the Civil Grand Jury could not efficiently interview all entities that participated in surveys, common sense suggests that these recommendations are applicable to all entities within San Mateo County. The current Civil Grand Jury encourages future civil grand juries to investigate the recommendations in this report as appropriate, to help optimize trust in the integrity of internal controls in San Mateo County government.
GLOSSARY
Assessment and Evaluation
Assessment for the purpose of this report is defined in the Green Book as follows: “To determine if an internal control system is effective, management assesses the design, implementation, and operating effectiveness of the five components and 17 principles.” Examples in an internal control assessment include to confirm and document that all requisitions are properly approved and that payments for goods or services are made by authorized individuals. This process helps management and stakeholders have confidence in the reliability of financial reporting, compliance with laws and regulations, and the overall integrity of the organization's operations.
In general, Assessment and evaluation can be used interchangeably.
Committee of Sponsoring Organizations of the Treadway Commission (COSO) The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is an organization that develops guidelines for businesses to evaluate internal controls, risk management, and fraud deterrence.
Enterprise Risk Management (ERM)
Enterprise risk management is an entity-wide strategy to identify and prepare for hazards with the entity’s finances, operations, and objectives.
3 2023-2024 San Mateo County Civil Grand Jury
Entity
An Entity for this report is San Mateo County, Cities, Special Districts, Joint Power Authorities, or Schools.
External Auditor
An external auditor is a public accountant who conducts audits, reviews, and other work for its clients. An external auditor is independent, and so is in a good position to make an impartial evaluation of the financial statements and systems of internal controls of those clients.
Green Book
Standards for internal control in the Federal Government issued by the General Accounting Office of the U.S. Government.
Internal Auditor
An internal auditor is responsible for reviewing a company’s processes, identifying anomalies, and reporting any issues found to management. An internal auditor is an employee of a company, so is not independent of the company.
Internal Controls
A process effected by those charged with governance, management, and other personnel that is designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations. Internal control over safeguarding of assets against unauthorized acquisition, use or disposition may include controls relating to financial reporting and operations objectives.
Management
Management consists of those individuals directly responsible for all activities of an entity, including design, implementation and operation of an internal control system.
Oversight Body
The oversight body is the group responsible for overseeing the strategic direction of the entity and obligations related to the accountability of the entity, including management’s design, implementation and operation of an internal control system. The oversight body may include elected or appointed officials and employees of the Entity.
BACKGROUND
Internal controls help an entity’s management achieve its objectives. Also, internal controls help an entity run its operations efficiently and effectively, report reliable information about its operations and comply with applicable laws and regulations.
The need for internal controls applies to all entities, regardless of size. Large complex entities have different risk profiles than small, less-complex entities. All entities seek to control risk appropriate for its operations, designing and implementing internal controls for its own particular risk profile. Even small, less-complex entities face risks that demand related internal controls. 4 2023-2024 San Mateo County Civil Grand Jury
Whether an internal control is followed or not is not a matter of materiality. A failure in what might seem to someone to be a trivial control is the same as a failure in what everyone might consider to be a very important control. There are no big or small controls, just controls. Failure in any contributes to public distrust of all.
The Green Book, which sets the standards for an effective internal control system for federal agencies, identifies five components of an internal control system:
● Control Environment
● Risk Assessment
● Control Activities
● Information and Communication
● Monitoring
Each of these components applies to different levels of an organizational structure, such as a Parks and Recreation Department within a City Government.
The Green Book summaries 17 Principles of Internal Control for these five components as:
Each entity’s oversight body is specifically responsible for oversight of internal control. Each entity’s management is responsible for the design, implementation and maintenance of internal controls.
Each entity’s internal controls are its own – no one would expect all entities to have the same internal controls, because all entities are different.
5 2023-2024 San Mateo County Civil Grand Jury
The Civil Grand Jury found examples of fraud and waste in government listed in the appendix.
Each of these examples likely reflects a failure of internal controls to prevent or detect fraud and waste. In other words, you ordinarily can’t have a problem with fraud and waste without a failure in internal controls.
Focus on the Control Environment, Information and Communication and Monitoring principles
The Civil Grand Jury focused on the control environment, information and communication and monitoring principles of internal control, seeking information about:
● Control Environment Principle - how governing boards oversee internal controls, such as a review of management’s report on its assessment of internal controls. ● Information and Communication Principle - how management reports to the governing board regarding its assessment of internal control and how management’s assessment of internal controls is communicated to the public, such as through an agenda item in a public meeting of the governing board. ● Monitoring Principle - information about how management monitors its internal control systems, such as management's assessment of internal controls.
It is of note that this investigation did not evaluate the quality of any entity’s internal control or the effectiveness of an entity’s internal controls.
The Civil Grand Jury sent a survey, received responses and confirmed survey responses via interviews with the 28 entities from whom it requests responses. However, common sense suggests each of the recommendations included in this report apply to all entities in the County.
The Civil Grand Jury recognizes that for a variety of reasons, management may not want to publicly report its controls and results of investigations. For example, an internal report might include details of needs for improving controls that might be considered a roadmap for fraud until the improvements are in place. Management reports available to the public through public release or materials for a public meeting could exclude such details, while the report available to the public could include an appropriate summary of information from an assessment.
METHODOLOGY
Preliminary Research
The Civil Grand Jury reviewed the websites of San Mateo County public entities and public media related to fraud and waste in government.
Preliminary Interview
To better understand, as a baseline, how the County Controller’s Office oversees its internal controls, the Civil Grand Jury interviewed the Controller’s Office of the County of San Mateo. 6 2023-2024 San Mateo County Civil Grand Jury
Survey and Survey Response Analysis
The Civil Grand Jury designed a survey focused on an entity’s assessment of its internal controls, reporting, training and risk evaluation. See Appendix A for the survey. The Civil Grand Jury sent the survey to 75 entities.
The Civil Grand Jury reviewed and analyzed the responses.
Interviews with Entities
By rule, the Civil Grand Jury must interview an entity to use that entity’s responses to a survey as a matter of fact. The Civil Grand Jury interviewed 28 entities, mostly focusing on entities that did not conduct an assessment of its internal controls in the last 18 months.
The Civil Grand Jury also interviewed a Certified Public Accountant with experience serving as external auditor of entities within San Mateo County.
DISCUSSION
Regulatory History
In 2013, our California Assembly approved Bill No. 1248, to require the state controller to establish internal controls for California local agencies. Bill No. 1248 applies to the County of San Mateo and the cities, special districts and other local government entities, except school districts. Bill No.1248 appears in the California Government Code section 12422.5.
In 2014, The General Accounting Office (GAO) of the U.S. Government issued the Green Book.
The U.S. Comptroller General prescribes internal control standards in the Green Book for the federal government. The Green Book says that state, local and quasi-governmental agencies and not-for-profit organizations may adopt the Green Book as a framework for an internal control system.
In 2015, the California State Controller’s Office issued “Internal Control Guidelines - California Local Agencies” to comply with California Government Code section 12422.5. The State Guidelines refer to the Green Book, among other resources.
The State Guidelines refer to the same structure of internal controls in the Green Book as well as the Committee of Sponsoring Organizations of the Treadway Commission (COSO) publications, both of which refer to the Governing Board’s responsibility to ensure completion of periodic risk assessments and to oversee internal controls.
Schools in San Mateo County are governed by the California Education Code (EDC). The county superintendent of schools may review or audit internal controls of any school district in its county per the California Education Code section 1241.5. The guidance in the Green Book and the State Guidelines naturally apply.
7 2023-2024 San Mateo County Civil Grand Jury
Tone at the Top
The oversight body and management set the tone at the top and throughout the organization by its example. Tone at the top is fundamental to effective internal controls. The tone at the top helps ensure:
● the entity’s risk identification is complete
● risk responses are appropriate
● control activities are appropriately designed or implemented ● information and communication are effective
● results of monitoring are understood and acted upon.
Accountability for Performance
The State Guidelines include a section on Accountability for Performance, including:
● establishing mechanisms for holding individuals accountable for internal control responsibilities, which naturally include the oversight body and management ● establishing performance measures for all levels of the organization ● performing timely evaluations and aligning incentives with the fulfillment of internal control responsibilities.
All governing bodies and its management have basic responsibilities regarding internal controls, even if the State Guidelines do not specifically refer to those basic responsibilities. Those responsibilities naturally include:
● Oversight boards must demonstrate its oversight of management’s internal controls, such as clear and timely reporting on its review of internal controls ● Management’s reports on internal controls should be clearly and readily available to the public
● Management must be evaluated for its assessments of internal controls and its external reporting.
Role of the External Auditor
External auditors are not considered a part of an entity’s internal controls. While management may look into and use recommendations by external auditors, management owns the entity's internal controls. Management may communicate with and get quality information from its external auditors as it monitors and maintains internal controls.
Management may hire an external service provider to conduct assessments of internal controls.
Data from these assessments can aid management ensuring that the entity’s internal controls are appropriate for that entity. In conducting an audit, external auditors may rely on these assessments, which could result in a more efficient and less expensive external audit.
The Civil Grand Jury found through its research that audits uncover only about 4% of fraud.
Several entities we interviewed stated that they rely on or interact with its external auditors as part of its internal controls. Comments from respondents included:
8 2023-2024 San Mateo County Civil Grand Jury
● We have been using the external auditors and have been reviewing the internal controls with them annually.
● This is done with the regular annual audit. We do not have reasons to justify an additional assessment.
● Annually, the internal controls are updated as part of our external audit, not separately from the external audit process.
The reports from external auditors include limitations on the results of its review of internal controls they conduct in connection with an audit. These limitations include statements like “we did not identify any deficiencies in internal control that we consider to be material weaknesses” and “material weaknesses may exist that have not been identified.” The external auditor reports are clear that they do not express an opinion on the effectiveness of internal controls.
The Civil Grand Jury interviewed a Certified Public Accountant who audits local governments and agencies and confirmed that management should assess its internal controls independently of the external auditor’s work, noting management can separately refer to the independent auditor’s work in its report to its governing board regarding internal controls.
Furthermore, the Certified Public Accountant and interviewees generally agreed that if management performed its own assessment of its internal controls, the results of that assessment can be shared with the external auditor and the auditor may use those results in designing audit work, increasing efficiency. Increases in efficiency in external audits likely at least partially offset any incremental staff work in conducting management’s assessment.
Survey Responses
Survey requests were sent to 75 entities, including municipalities, school districts, independent special districts and joint power authorities. Responses were received from 54 entities.
Given the enormity of the challenge of reviewing individual controls at any one agency, the Civil Grand Jury looked into the way government entities in San Mateo County assess its internal controls and how the results of those assessments are reported to governing boards and to the public. This assessment and reporting should follow the State of California guidelines and the underlying referenced guidelines from the Green Book and the Committee of Sponsoring Corporations. Management’s assessment of its internal controls and communication, both internally within an entity and externally to the entity’s constituents, are key principles of internal controls.
9 2023-2024 San Mateo County Civil Grand Jury
The Civil Grand Jury focused on responses to three questions from the survey:
1. Do you have an established process in place to identify organizational risks (also known as Enterprise Risk Management, or ERM)? The tables below refer to this question as ‘ERM?’.
2. Other than outside audits of your organization's financial statements, have you or your organization performed an assessment of your organization's "internal controls" within the last 18 months? The tables below refer to this as ‘Assessment?’.
3. Was a written report of the assessment produced? The tables below refer to this as ‘Report?’.
Identifying risks to an entity is a critical part of effective internal controls. See Principle 7 in the Green Book Principles of Internal Controls Table above.
Eighteen entities responded that they had performed an assessment of internal controls in the prior 18 months. Each entity must assess its internal controls. State guidelines require established mechanisms to hold management responsible for internal control responsibilities and to align incentives with the fulfillment of internal control responsibilities.
Four entities responded that they prepared a report regarding assessments of internal controls.
Each governing board must oversee its entity’s internal controls. State guidelines require established mechanisms to hold management responsible for internal control responsibilities and to align incentives with goals and objectives. Management should both internally and externally communicate the results of its assessments of internal controls. If management does not communicate the results of its assessments of internal controls, others may see this as an opportunity to commit fraud or waste government assets. Management should communicate the results of its assessments of internal controls in writing to its governing board. 10 2023-2024 San Mateo County Civil Grand Jury
These data led the Civil Grand Jury to conduct interviews with selected entities that responded to the survey.
Interviews with Selected Entities
By rule of the Civil Grand Jury, the findings and recommendations included in this report can only be sent to entities that responded to the survey and participated in interviews with the Civil Grand Jury. In other words, the survey responses do not suffice to be considered a matter of fact and be used to come to a conclusion or make a recommendation.
The 28 Entities we interviewed are listed below in the section titled “Request for Responses.” Of the Entities interviewed to confirm survey responses:
● Seven Entities reported that they did not have an established process in place to identify organizational risks.
● Twenty-six entities reported that, other than outside audits, its organization had not performed an assessment of its internal controls in the last 18 months. ● Two entities that did perform an assessment of its internal controls did not produce a written report of its assessment.
Identifying risks
Identifying risks in an organization is a critical part of effective internal controls - see Principle 7 in the Green Book Principles of Internal Controls (Table above).
When an entity does not have a process to identify organizational risks, the entity does not demonstrate how its internal controls address identified risks, and the likelihood of a failure in internal controls that results in fraud or waste increases. 11 2023-2024 San Mateo County Civil Grand Jury
Assessing Internal Controls
Entities must assess its internal controls. State guidelines require established mechanisms to hold management responsible for internal control responsibilities and to align incentives with the fulfillment of internal control responsibilities.
When an entity does not periodically assess its internal controls, the entity cannot demonstrate that they are monitoring its internal controls, and the likelihood of a failure in internal controls that results in fraud or waste increases.
Reporting Results of Assessments
Each governing board must oversee its entity’s internal controls. State guidelines require established mechanisms to hold management responsible for internal control responsibilities and to align incentives with goals and objectives.
Management should both internally and externally communicate the results of its assessments of internal controls. If management does not communicate the results of its assessments of internal controls, others may see this as an opportunity to commit fraud or waste government assets.
Management should communicate the results of its assessments of internal controls in writing to its governing board.
When management does not report the results of its assessments of internal controls to its governing board and the entity has not communicated externally, the likelihood that others may see this as an opportunity to commit fraud or avoid waste increases.
FINDINGS
F1. When an entity does not have a process to identify organizational risks, and the entity does not demonstrate how its internal controls address identified risks, the likelihood of a failure in internal controls that results in fraud or waste increases.
F2. When an entity does not periodically assess its internal controls and the entity cannot demonstrate that it is monitoring its internal controls, the likelihood of a failure in internal controls that results in fraud or waste increases.
F3. When management does not report the results of its assessments of internal controls to its governing board and the entity has not communicated externally, the likelihood that others see this as an opportunity to commit fraud or waste increases. 12 2023-2024 San Mateo County Civil Grand Jury
RECOMMENDATIONS
R1. Beginning by no later than December 31, 2024 and at least annually thereafter, each entity will document its organizational risks and address those risks in its annual Assessment of Internal Controls.
R2. Beginning by no later than March 31, 2025 and at least annually thereafter, each governing board will require its management to complete its annual assessments of internal controls.
R3. Beginning by no later than June 30, 2025 and annually thereafter, each governing board will require management to report the results of its annual assessment of the entity’s internal controls.
REQUEST FOR RESPONSES
The following responses from governing bodies are required pursuant to Penal Code sections 933 and 933.05:
Entity Findings Recommendations
Belmont-Redwood Shores SD F1, F2, F3 R1, R2, R3
Brisbane School District F1, F2, F3 R1, R2, R3
City of Burlingame F1, F2, F3 R1, R2, R3
City of East Palo Alto F1, F2 R1, R2
City of Half Moon Bay F1, F2, F3 R1, R2, R3
City of Menlo Park F1, F2, F3 R1, R2, R3
City of Redwood City F2, F3 R2, R3
Coastside Fire Protection District F1, F2, F3 R1, R2, R3 Colma Fire Protection District F1, F2, F3 R1, R2, R3
Jefferson Union High School District F1, F2, F3 R1, R2, R3 La Honda-Pescadero USD F1, F2, F3 R1, R2, R3
Menlo Park City School District F2, F3 R2, R3
Menlo Park Fire Protection District F1, F2, F3 R1, R2, R3 Mid-Peninsula Water District F2, F3 R2, R3
North Coast County Water District F1, F2, F3 R1, R2, R3 Pacifica School District F1, F2, F3 R1, R2, R3
Portola Valley School District F1, F2, F3 R1, R2, R3
Ravenswood City School District F1, F2, F3 R1, R2, R3
Redwood City School District F1, F2, F3 R1, R2, R3
13 2023-2024 San Mateo County Civil Grand Jury
San Mateo County Libraries F1, F2, F3 R1, R2, R3
San Mateo Foster City School District F1, F2, F3 R1, R2, R3 San Mateo Union High School District F1, F2, F3 R1, R2, R3 Sequoia Healthcare District F2 R2
Silicon Valley Clean Water F2, F3 R2, R3
South Bayside Waste Management
Authority F1, F2, F3 R1, R2, R3
Town of Atherton F2, F3 R2, R3
West Bay Sanitary District F1, F2, F3 R1, R2, R3
Woodside School District F1, F2, F3 R1, R2, R3
RESPONSE REQUIREMENTS
California Penal Code Section 933.05 provides: For purposes of subdivision of Section 933, as to each Civil Grand Jury finding, the responding person or entity shall report one of the following:
(1) The respondent agrees with the finding.
(2) The respondent disagrees wholly or partially with the finding; in which case the response shall specify the portion of the disputed finding and shall include an explanation of the reasons.
For purposes of subdivision of Section 933, as to each Civil Grand Jury recommendation, the responding person or entity shall report one of the following actions:
(1) The recommendation has been implemented, with a summary regarding the implemented action.
(2) The recommendation has yet to be implemented but will be implemented in the future, with a timeframe for implementation.
(3) The recommendation requires further analysis, with an explanation and the scope and parameters of an analysis or study and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable. This time frame shall be at most six months from the Civil Grand Jury report's publication date. (4) The recommendation will not be implemented because it is not warranted or is not reasonable, with an explanation therefore.
14 2023-2024 San Mateo County Civil Grand Jury
APPENDIXES
Appendix A - Form of Survey
Appendix B - Examples of Fraud and Waste
15 2023-2024 San Mateo County Civil Grand Jury
Appendix A
Form of Survey
1. Please list your name, title and organization
2. Other than outside audits of your organization's financial statements, have you or your organization performed an assessment of your organization's "internal controls" within the last 18 months? (Yes/No)
3. If your organization has not performed an assessment of its internal controls or has not completed one in the last 18 months, why?
4. What was the date of your internal controls assessment?
5. What type of tool was used to assess your internal controls? If "Other", please provide a brief description of the tool. (Checklist/Guided questions/Other)
6. Was a written report of the assessment produced? (Yes/No)
7. Was this assessment report shared with your governing board? (Shared/Not shared/Written assessment report was not produced)
8. Does your governing board require or suggest that your organization periodically review its internal controls?
9. Have the personnel in your organization received training specific to building effective internal controls?
10. If your organization has received training in building effective internal controls, who provided the training?
11. Do you have an established process in place to identify organizational risks (also known as Enterprise Risk Management or "ERM")?
12. When substantial risks are identified, does your process require changes or improvements to the applicable internal controls?
13. Have you shared the organizational risk assessment findings with your governing board?
14. Internal controls assessment tool:
15. Internal controls assessment report:
16. Risk assessment report:
17. Other links, please describe and include link(s):
16 2023-2024 San Mateo County Civil Grand Jury
Appendix B
Examples of Alleged Fraud and Waste
Broadmoor Police Protection District Fraud
https://www.chronline.com/stories/outrageous-pension-double-dipping-triggers-criminalinvestigation-into-california-cops,281359 San Mateo County Pay to Play Prosecution
https://www.almanacnews.com/news/2023/02/10/community-college-district-lawsuit-alleges-payto-play-in-construction-projects-under-former-chancellor/ Reporting of Personal Residences paid for with government funds. https://www.nbcbayarea.com/news/local/former-caltrain-manager-secret-apartments-bay-areatrain-stations/3496068/ Release Date: June 27, 2024
2023-2024 San Mateo County Civil Grand Jury