CA Review CKM
Meeting Date: Aug. 16, 2022
To: Mayor and City Council
From: Scott Chadwick, City Manager
Staff Contact: Robert Threatt, Internal Audit Manager
[email protected], 442-339-2418
Laura Rocha, Deputy City Manager, Administrative Services [email protected], 442-339-2415
Subject: Fiscal Year 2022-23 Internal Audit Plan and Update on Audit Activities Recommended Action
1. Receive a report on the results of internal audit activities and the annual audit plan for fiscal year 2021-22.
2. Adopt a resolution approving the Internal Audit Plan for fiscal year 2022-23.
Exec
utive Summary
The city’s internal audit program examines city operations to ensure city resources are being used effectively and appropriately and city procedures are being followed. The internal audit plan for each fiscal year is developed for the City Council’s review and approval each fiscal year, in accordance with City Council Policy No. 89. The plan is attached as Attachment A to Exhibit 1.
This policy also requires the city’s internal auditor to communicate progress on the annual audit plan along with the status of any open recommendations from past audit engagements to the City Manager and the City Council twice a year.
Reports on each audit are distributed to city management and the City Council as they are completed during the year and are available to the public on the city’s internal audit webpage (carlsbadca.gov/departments/internal-audits).
Discussion
Annual Internal Audit Plan
The city’s internal audit manager performs independent and objective assurance services to safeguard city resources and improve city operations. Such services may include internal audits of any city department, division, function or program. The audit plan outlines the internal audits and other value-added engagements the internal audit manager proposes to conduct during the fiscal year.
Aug. 16, 2022
Item #12 Page 1 of 9
The attached Internal Audit Plan for fiscal year 2022-23 includes information about the basis for the audit engagements selected, their preliminary objectives, and the resources that will be required. It includes two engagements carried over from the previous year’s audit plan and four new engagement audits for the City Council’s consideration. Once approved, the internal audit plan serves as the operating roadmap for the city’s internal audit manager.
Each internal audit engagement is detailed in a report that summarizes the auditor’s findings and recommends corrective actions to city departments, when necessary. An engagement could be a detailed audit of a major city program or a less comprehensive “agreed-upon- procedures review,” which examines certain specified aspects of city operations.
Proposed in ternal audit engagements in FY 2022-23
Carried over from FY 2021-22
• Procurement program audit
• Vice Narcotics Intelligence Unit “Buy Fund” compliance review New for F Y 202 2-23
• Transient occupancy tax agreed-upon-procedures review engagement • Payroll recordkeeping, data entry and segregation of duties audit • City’s intake process associated with transient occupancy tax revenue receipts and recordkeeping audit
• Information technology system user access audit
Annual internal audit update
Two audit engagements were discussed during the last update to the City Council, on March 22, 2022. The first was the city’s credit card program audit, performed in FY 2020-21. At the time of the update, there were two audit recommendations that remained open.
The second was the code enforcement program audit. That engagement had just been completed and consisted of four open audit recommendations. The status of the referenced audit recommendations is detailed in Exhibit 2.
A summary of the fiscal year 2021-22 internal audit activities is provided as Exhibit 3.
Fiscal An alysis
There is no immediate fiscal impact to approving the fiscal year 2022-23 Internal Audit Plan as there is sufficient funding in the fiscal year 2022-23 budget to execute the proposed Internal Audit Plan.
Next Steps
If accepted as presented, the city’s internal audit manager will conduct the engagements as cited in the fiscal year 2022-23 Internal Audit Plan.
Environmental E valuation
This action does not constitute a project within the meaning of the California Environmental Quality Act under California Public Resources Code Section 21065 in that it has no potential to cause either a direct physical change in the environment or a reasonably foreseeable indirect physical change in the environment and therefore does not require environmental review.
Aug. 16, 2022
Item #12 Page 2 of 9
Public Notification
This item was noticed in accordance with the Ralph M. Brown Act and was available for viewing at least 72 hours prior to the scheduled meeting date.
Exhibits
1. City Council resolution
2. Open audit recommendations status update
3. Fiscal year 2021-2022 audit activities
Aug. 16, 2022
Item #12 Page 3 of 9
RESOLUTION NO. 2022-207
A RESOLUTION OF THE CITY COUNPL OF THE CITY OF CARLSBAD, CALIFORNIA, APPROVING THE FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN WHEREAS, the city's internal audit manager performs independent and objective assurance services to safeguard city resources and improve city operations; and WHEREAS, the services provided may include internal audits of any city department, division, function or program; and
WHEREAS, as required by City Council Policy No. 89, the internal audit manager has presented a Fiscal Year (FY) 2022-23 Internal Audit Plan (Attachment A) for the City Council's review and approval; and
WHEREAS, the purpose of the FY 2022-23 Internal Audit Plan is to outline internal audits and other value-added engagements the internal audit manager proposes to conduct during the fiscal year; and
WHEREAS, the FY 2022-23 Internal Audit Plan includes information about the basis for the audit engagements selected, preliminary objectives and the consideration of resources; and WHEREAS, once approved, the FY 2022-23 Internal Audit Plan will serve as the operating roadmap for the city's internal audit manager.
NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Carlsbad, California, as follows:
1. That the above recitations are true and correct.
2. That the City Council approves the FY 2022-23 Internal Audit Plan as shown in Attachment A.
PASSED, APPROVED AND ADOPTED at a Regular Meeting of the City Council of the City of Carlsbad on the 16th day of August, 2022, by the following vote, to wit:
AYES:
NAYS:
ABSENT:
Hall, Blackburn, Bhat-Patel, Acosta, Norby.
None.
None.
� FAVIOLA MEDINA, City Clerk Services Manager
(SEAL)
Exhibit 1
Aug. 16, 2022 Item #12 Page 4 of 9
MATT H::;1-ff M ~ ------
t1vL
Attachment A
Fiscal Year 2019-20 Internal Audit Plan
Fiscal Year
2022-23
Internal Audit
Plan
Aug. 16, 2022
Item #12 Page 5 of 9
( city of
Carlsbad
Attachment A
Fiscal Year 2022-23 Internal Audit Plan
OVERVIEW
The City of Carlsbad’s internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Internal audits help to mitigate risks by recommending improvements to the city’s internal controls and g overnance, risk, and compliance processes. Potential audits may include any city department, division, function, or program administered by the city.
The purpose of the annual internal audit plan is to outline audits and other value -added engagements the internal auditor proposes to conduct during the current fiscal year. This document serves as the primary work plan to carry out the responsibilities of the internal auditor. The basis for the audit plan comes from auditor observations, inquiries of management, audit requests from the City Council and senior management, and programs or processes with inherently higher risk levels. The internal auditor’s strategy in developing this plan seeks to identify, prioritize, and manage audits important to city operations, programs, and systems.
Currently, the Internal Audit Division is comprised of one full-time internal auditor. The internal audit plan considers available staff hours, level of expertise and experience, the estimated size and complexity of audits, time allocated to satisfy continuing professional education requirements, time allocated to performing audit follow-up procedures, and use of external consultants/auditors.
The internal audit plan is a working document. During the year, causes for changes to the audit pl an may include an increase or decrease in audit scope, additional or pressing audit requests, or a threat to auditor independence. As such, projects initiated in the current year may carry over into the following fiscal year.
The following page identifies the list of prioritized internal audit engagements for FY 2022 -23, along with their preliminary objectives. At the beginning of each engagement, the internal auditor will establish familiarity with the department, function or process identified for audit. During that initial period, audit objectives may be refined, and the methodology will be established.
Aug. 16, 2022
Item #12 Page 6 of 9
{city of
Carlsbad
Attachment A
Fiscal Year 2022-23 Internal Audit Plan
Fiscal Year 2022-23 Internal Audit Engagements
Entity, Function,
Program or
Process to Audit
Type of
Engagement
Primary
Stakeholder/Audit
Lead
Preliminary Objectives
Carryover from FY 2021-22
Procurement Internal Audit Various
departments/
Internal Audit
Manager
• To assess the city’s compliance with
applicable procurement guidelines.
• To evaluate whether the city’s
procurement process is effective and
adhered to.
Vice Narcotics
Intelligence Unit
(VNIU) “Buy
Fund”
Internal Audit Police
Department/Internal
Audit Manager
• To determine whether the fund was
managed and accounted for in
accordance with authorized policies
and procedures.
New for FY 2022-23
Transient
Occupancy Tax
Agreed Upon
Procedure
Various hotels as
determined by
city/External Audit
Firm
• To determine if hotels are properly
reporting and remitting occupancy
taxes in compliance with city
ordinance.
Revenue Audit Internal Audit Finance
Department/Internal
Audit Manager
• Evaluate the city’s receipt and
recordkeeping associated with its
transient occupancy tax revenues.
Payroll Audit Internal Audit Human
Resources/Finance
Department/Internal
Audit Manager
• Evaluate the city’s payroll
recordkeeping and data entry.
• Evaluate the city’s segregation of
duties.
Business
Application User
Access
Internal Audit Information
Technology
Department/Internal
Audit Manager
• Evaluate the city’s management of
user access across its enterprise
resource planning systems and
software applications.
Aug. 16, 2022
Item #12 Page 7 of 9
{city of
Carlsbad
City of Carlsbad
Status of Open Internal Audit Recommendations
Audit Engagements: 2021-01 City Credit Card Program Audit and 2022-01 Code Enforcement Program Audit City Council Date: August 16, 2022
No. Recommendation Department Status
1 The Finance Department should communicate guidance citywide about the taxability of employee appreciation related items and gifts to ensure that city departments give and report them in compliance with the Internal Revenue Code.
Finance Department Complete - The Finance Department sent out a city-wide email on June 16, 2022 titled, "Employee Taxable Benefits Guidance" which addresses this item.
2 To ensure that lodging purchases made during city business-related travel are appropriate, the Finance Department should update its travel guidelines and procedures to adopt either the state or the federal government’s annual lodging rates by geographic location, and require employees to submit written justification when rates must exceed these established maximums.
Finance Department In progress - The Finance Department is incorporating this recommendation into an update of the city's travel policy.
The specific audit recommendation will be addressed by
adopting the federal GSA rates while allowing the approval of exceptions with justification.
No. Recommendation Department Status
1 The Code Enforcement Division should immediately begin the implementation of a code enforcement procedure manual to serve as both a training and operations resource for staff.
Community Development In progress - The code enforcement procedure manual is in final review with City Attorney's Office.
2 Management should identify a code enforcement officer to serve as a training coordinator for the division. Identifying such a role will help ensure the code enforcement officers continue to maintain their uniform approach to addressing complaints and serving the city’s residents. The uniformity will result in part from having a single point of contact for training and from the implementation of a code enforcement procedure manual as noted in recommendation #1.
Community Development Complete - The code enforcement division has hired a senior code enforcement officer who is serving in this
capacity.
3 To evaluate the performance of its code enforcement officers and to maximize the use of code enforcement data residing in EnerGov, the Code Enforcement Division must identify and monitor key metrics. Once specific metrics are identified, code enforcement staff should coordinate with the Information Technology Department to determine how to best extract this information from EnerGov. If EnerGov is unable to support this activity, the city should prioritize the identification or procurement of a software application that can.
Community Development In progress - The Code Enforcement Division is finalizing a technical specification that identifies the data (metrics) they are seeking to track. They will present that request to the IT Department staff to determine if EnerGov can
provide the necessary data and reports. If EnerGov is
unable to, they will ask IT to recommend a system that can. 4 The auditor recommends that the IT and Community Development Departments coordinate a recurring meeting (bi-monthly, monthly, etc.) that brings together all divisions within Community Development to discuss and prioritize ServiceNow requests that originated during the period related to the EnerGov system.
Community Development Complete - The divisions within Community Development meet with the Information Technology Department staff on a bi-monthly basis to discuss open tickets and to facilitate resolutions.
2021-01 City Credit Card Program Audit
2022-02 Code Enforcement Audit Report
Exhibit 2
Aug. 16, 2022
Item #12 Page 8 of 9
Fiscal Year 2021‐22, Internal Audit Activities Update
City of Carlsbad, CA
Exhibit 3
No. Entity, Unit or Program Type of Engagement Primary Stakeholder/Audit Lead Status 1 Code Enforcement Audit Internal Audit Community Development/Internal Audit Manager Complete 2 Fraud & Ethics Hotline Program Evaluation Internal Audit Manager Complete 3 Transient Occupancy Tax Agreed Upon Procedures Various hotels/External audit firm In Process 4 City
of Carlsbad Risk Assessment Various departments/Internal Audit Manager In Process 6 Procurement Internal Audit Various departments/Internal Audit Manager Rolled to fiscal year 2022‐23 5 Vice Narcotics Investigative Unit (VNIU) Internal Audit Police Department/Internal Audit Manager Rolled to fiscal year 2022‐23 1 2
3 4
5 6
Fiscal Year 2021‐22 Internal Audit Activities
This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan.
The code enforcement audit was completed in fiscal year 2021‐22 and the results were presented to the City Council on March 22, 2022.
Status Notes:
The fraud and ethics hotline evaluation was completed in fiscal year 2021‐22. City staff presented recommendations to the City Council on April 5, 2022. At that meeting, City Council approved the implementation of a 3rd party hosted fraud and ethics hotline. The city has since selected Navex Global Inc. to implement the hotline. The hotline has been fully developed and the fraud and ethics hotline administrative order is undergoing final review. Following the completion of the administrative order, the City will go live with the hotline.
The city's annual transient occupancy tax review engagement is performed by an external CPA firm. This engagement is 90% complete and the audit firm is wrapping up their review procedures.
The citywide risk assessment engagement is 50% complete. The survey questions have been prepared and the survey is ready to be assigned to the leadership team for completion. Following the completion of the survey, the city's internal auditor will meet one on one with management to discuss their responses and then finally all inputs will be scored and a risk ranking applied to the city's different programs. The risk assessment will aide the city in developing future internal audit plans and prioritizing future internal audit engagements.
This internal audit engagement has been transferred to the fiscal year 2022‐23 Internal Audit Plan. Audit planning has begun for this engagement.
Exhibit 3
Aug. 16, 2022
Item #12 Page 9 of 9
Internal Audit Update and
Fiscal Year 2022-23 Internal
Audit Plan
Robert Threatt, Internal Audit Manager
Administrative Services Branch
August 16, 2022
TODAY’S PRESENTATION
• Overview
• Status of open internal audit recommendations
• Update on fiscal year 2021-22 internal audit activities • Present fiscal year 2022-23 internal audit plan
ITEM 12: Internal Audit Update and Plan
PROPOSED ACTION
Adopt resolution approving the fiscal
year 2022-23 Internal Audit Plan.
ITEM 12: Internal Audit Update and Plan
STATUS: INTERNAL AUDIT RECOMMENDATIONS
• For business related travel, city should follow state or federal guidelines to ensure appropriateness
• In-process: As part of a travel policy update, the
Finance Department is adopting federal General
Services Administration guidelines for travel
reimbursements
Credit Card Program Audit
STATUS: INTERNAL AUDIT RECOMMENDATIONS
• Using data maintained in the EnerGov system, identify and monitor key metrics for trend analysis and staff
development purposes
• In-process: Technical specification being developed,
and staff will coordinate with Information
Technology Department to develop reports or
queries that provided the required metrics
Code Enforcement Program Audit
FISCAL YEAR 2021-22 AUDIT ACTIVITIES
• Status of internal audit engagements
• Completed (2): Code enforcement audit & fraud
and ethics hotline evaluation and recommendation
• Ongoing (2): Transient Occupancy Tax review and
citywide risk assessment
• Included in fiscal year 2022-23 Internal Audit Plan
(2): Procurement program audit and Vice Narcotics
Intelligence Unit “Buy Fund” review
Annual Update
FISCAL YEAR 2022-23 INTERNAL AUDIT PLAN
• Procurement program audit*
• Vice Narcotics Intelligence Unit “Buy Fund” policy
review*
• Transient Occupancy Tax review
• Payroll process audit
• Revenue audit
• Business application user access review
(*Engagements from fiscal year 2021-22)
Proposed Audit Engagements
PROPOSED ACTION
Adopt resolution approving the fiscal
year 2022-23 Internal Audit Plan.
ITEM 12: Internal Audit Plan and Update