Item No. 9
Town of Atherton
CITY COUNCIL STAFF REPORT – REGULAR AGENDA
TO: HONORABLE MAYOR AND CITY COUNCIL
GEORGE RODERICKS, CITY MANAGER
FROM: ROBERT BARRON III, FINANCE DIRECTOR
DATE: SEPTEMBER 18, 2024
SUBJECT: REVIEW AND APPROVE THE RESPONSE TO GRAND JURY REPORT:
“ASSESSING AND REPORTING INTERNAL CONTROLS IN SAN
MATEO COUNTY AGENCIES AND SCHOOL DISTRICTS”
RECOMMENDATION
Review and approve the attached response to the San Mateo County Grand Jury Report on their report entitled “Assessing and Reporting Internal Controls in San Mateo County Agencies and School Districts.”
BACKGROUND
The Superior Court of California, of the County of San Mateo Civil Grand Jury issued a report on June 27, 2024, entitled, “Assessing and Reporting Internal Controls in San Mateo County Agencies and School districts.” The Grand Jury report notes that in 2015, the California State Controller’s Office issued “Internal Control Guidelines-California Local Agencies” covering the need for internal controls in government agencies to comply with California Government Code section 12422.5. The State refers to the “Green Book” which sets the standards for internal control in the Federal Government issued by the General Accounting Office of the U.S. Government. The State guidelines refer to the Green Book and guidelines include a section on Accountability for Performance which includes:
• establishing mechanisms for holding individuals accountable for internal control responsibilities, which naturally include the oversight body and management • establishing performance measures for all levels of the organization • performing timely evaluations and aligning incentives with the fulfillment of internal control responsibilities.
The report further states that “All governing bodies and its management have basic responsibilities regarding internal controls, even if State Guidelines do not specifically refer to those basic responsibilities. Those responsibilities naturally include:
Grand Jury Report on Internal Controls
September 18, 2024
• Oversight boards must demonstrate its oversight of management’s internal controls, such as clear and timely reporting on its review of internal controls • Management’s reports on internal controls should be clearly and readily available to the public
• Management must be evaluated for its assessments of internal controls and its external reporting.”
The Grand Jury surveyed 75 entities, that included municipalities, school districts, independent special districts and joint powers authorities. They received responses from 54 entities. They looked into how government entities assess their internal controls and how the results are reported to the governing board. The Civil Grand Jury focused on the responses to the following questions from the survey:
1. Do you have an established process in place to identify organizational risks (also known as Enterprise Risk Management, or ERM)?
2. Other than outside audits of your organization's financial statements, have you or your organization performed an assessment of your organization's "internal controls" within the last 18 months?”
3. Was a written report of the assessment produced?
From the survey eighteen entities responded that they had performed an assessment of internal controls in the prior 18 months. Four entities responded that they prepared a report on assessments of internal controls. The Grand Jury Report is included as Attachment 1. Agencies must submit comments within 90 days after the Grand Jury submits a report regarding the operations of any public agency, as California Penal Code §933(c) provides the “Governing body of the public agency shall comment to the presiding judge of the Superior Court on the findings and recommendations pertaining to matters under the control of the governing body…” It requires any agency that is the subject of such a report to reply in writing at a public meeting. Our response is due no later than September 25, 2024.
The Finance Director has prepared the attached reply (Attachment 2) to the Grand Jury Report for Council consideration and approval.
FINDINGS | ANALYSIS
Overall, the report provides a general overview of internal controls, including regulatory history, and includes recommendations on how to strengthen internal controls. The report cites the government faces risks, including fraud and waste. It lists some examples of fraud and waste found in some government agencies. Internal controls are vital and in place for reasonable assurance that an agency will safeguard its assets and achieve its objectives with reliability of financial reporting, efficiency and effectiveness of operations, and compliance with laws. It was discussed that all agencies aim to control risks appropriate for its staffing and operations while implementing internal controls based on its agency profile. From the survey it was discovered that all agencies have established internal controls and published audit reports. At the forefront of the Grand Jury report is that agencies do not assess their internal controls and do not communicate with governing Grand Jury Report on Internal Controls
September 18, 2024
boards regarding management of internal controls. It recommends for timely documented assessments of internal controls, reports from management to governing boards on assessments in an effort to reduce risks of failed internal controls, promote confidence in government agency operations and improve efficiencies of external audits. Those agencies that responded to the survey were then interviewed to confirm their survey responses.
The Grand Jury focus during the interviews was on whether the agencies have a process to identify organizational risks, periodically assess internal controls, and reporting of the results of these assessments. Following the interviews the Grand Jury compiled a report that presents three findings and makes three recommendations. The report identifies each jurisdiction and corresponding response requirements. The following are the Findings from the report:
F1. When an entity does not have a process to identify organizational risks, and the entity does not demonstrate how its internal controls address identified risks, the likelihood of a failure in internal controls that results in fraud or waste increases.
F2. When an entity does not periodically assess its internal controls and the entity cannot demonstrate that it is monitoring its internal controls, the likelihood of a failure in internal controls that results in fraud or waste increases.
F3. When management does not report the results of its assessments of internal controls to its governing board and the entity has not communicated externally, the likelihood that others see this as an opportunity to commit fraud or waste increases.
The Report concludes with three Recommendations to which each jurisdiction must respond.
R1. Beginning by no later than December 31, 2024 and at least annually thereafter, each entity will document its organizational risks and address those risks in its annual Assessment of Internal Controls.
R2. Beginning by no later than March 31, 2025 and at least annually thereafter, each governing board will require its management to complete its annual assessments of internal controls.
R3. Beginning by no later than June 30, 2025 and annually thereafter, each governing board will require management to report the results of its annual assessment of the entity’s internal controls.
The report instructs many agencies to respond to all of these. The Town of Atherton is instructed to only respond to Findings 2 and 3 and Recommendations 2 and 3. Staff has reviewed these Findings and Recommendations and has prepared a letter for the City Council’s consideration that responds to the report.
POLICY FOCUS
The Grand Jury requires that the Town respond to the findings and recommendations in the report.
Staff has provided responses for the City Council’s consideration. Staff has agreed with findings, partially agreed with others, and provided feedback on the recommendations.
Grand Jury Report on Internal Controls
September 18, 2024
FISCAL IMPACT
The development and preparation of an annual report on internal controls will require staff time and resources not fully identified. This additional requirement is anticipated to fall to executive leadership and department staff. There is potential expense if the Town chooses to hire an external provider or consultant to conduct assessment of our internal controls.
GOAL ALIGNMENT
This report and its contents are in alignment with the following Council Policy Goals:
• Goal A – Maintain Fiscal Responsibility
• Goal F – Be Forward-Thinking, Well-Managed, and Well-Planned
COMMISSION/COMMITTEE FEEDBACK/REFERRAL
This item ____ has or __X___ has not been before a Town Committee or Commission. ____ Audit/Finance Committee (meets every other month)
____ Bicycle/Pedestrian Committee (meets as needed)
____ Civic Center Advisory Committee (meets as needed)
____ Environmental Programs Committee (meets every other month) ____ Park and Recreation Committee (meets each month)
____ Planning Commission (meets each month)
____ Rail Committee (meets every other month)
____ Transportation Committee (meets every other month) ____ Tree Committee (meets each month)
ATTACHMENT
1. Grand Jury Report-Assessing and Reporting Internal Controls in San Mateo County Agencies and School Districts
2. Response to Grand Jury Report “Assessing and Reporting Internal Controls in San Mateo County Agencies and School Districts.”