CA Review GH
Meeting Date: Feb. 7, 2023
To: Mayor and City Council
From: Scott Chadwick, City Manager
Staff Contact: Robert Threatt, Internal Audit Manager
[email protected], 442-339-2418
Laura Rocha, Deputy City Manager, Administrative Services [email protected], 442-339-2415
Subject: Internal Audit Program Update
District: All
Recommended Action
Receive a report on the status of recommendations from previously completed internal audits and an update regarding internal audit engagements identified in the city’s fiscal year 2022-23 Internal Audit Plan.
Executive Summary
The city’s Internal Audit Manager performs independent and objective assurance services to safeguard city resources and improve city operations. These services may include internal audits of any city department, division, function, or program, along with recommendations to tighten controls, increase efficiency or better comply with standards and regulations.
This report provides the City Council with updates on:
• The status of recommendations from previously completed internal audits • The internal audit engagements identified in the city’s fiscal year 2022-23 Internal Audit Plan (Exhibit 1)
City Council Policy No. 89, Internal Audit Framework, requires the city’s internal auditor to present this update to the City Council twice a year.
Explanation & Analysis
Open internal audit recommendations
At the conclusion of each internal audit engagement, an audit report is issued that includes the audit’s findings. The findings are accompanied by specific audit recommendations to be addressed by city management. The city’s internal auditor is responsible for monitoring city management’s progress with implementing the audit recommendations and with reporting progress to the City Manager and City Council.
Feb. 7, 2023 Item #13 Page 1 of 7
During the previous update to City Council on August 16, 2022, there were two engagements with open audit recommendations:
2021‐01 City Credit Card Program Audit – Finance Department Recommendation: To ensure that lodging purchases made during city business- related travel are appropriate, the Finance Department should update its travel guidelines and procedures to adopt either the state or the federal government’s annual lodging rates by geographic location, and require employees to submit written justification when rates must exceed these established maximums.
Status: Complete. The Finance Department has addressed this audit recommendation by incorporating the use of federal General Services Administration lodging rates in the city's travel policy. The policy has a provision that allows for the approval of exceptions, on a case by case basis. (The updated travel policy will be presented to City Council at tonight’s meeting). 2022‐02 Code Enforcement Audit Report ‐ Community Development Department Recommendation 1: The Code Enforcement Division should immediately begin the implementation of a code enforcement procedure manual to serve as both a training and operations resource for staff.
Status: Complete. A code enforcement training manual was finalized in October 2022. The new training manual addresses core code enforcement topics ranging from code enforcement standards, field inspection protocols, compliance timelines, division policies and procedures, to uniform wear.
Recommendation 2: To evaluate the performance of its code enforcement officers and to maximize the use of code enforcement data residing in EnerGov (the application used to track code enforcement actions), the Code Enforcement Division must identify and monitor key metrics. Once specific metrics are identified, code enforcement staff should coordinate with the Information Technology Department to determine how to best extract this information from EnerGov. If EnerGov is unable to support this activity, the city should prioritize the identification and procurement of a software application that can.
Status: Complete. The Code Enforcement Division has been meeting with the city's Information Technology Department on a bi-weekly basis to develop and evaluate reports that utilize information that originates in the city's EnerGov application. After identifying key metrics, the Code Enforcement Division has now developed a core set of reports that enable them to monitor staff performance and code enforcement trends on an ongoing basis.
Feb. 7, 2023 Item #13 Page 2 of 7
Internal audit activities update
As required by City Council Policy No. 89, the City’s internal auditor is providing this status update regarding ongoing internal audit activities and progress in completing engagements identified in the fiscal year 2022-23 Internal Audit Plan.
FISCAL YEAR 2022‐23 INTERNAL AUDIT ACTIVITIES
No. Description Type of engagement Primary stakeholder/audit lead Status 1 Fraud & Ethics Hotline Program evaluation Staff/Internal Audit Manager Complete This was initially a project evaluation engagement in fiscal year 2021-22. The results and recommendations from that evaluation were presented to the City Council on April 5, 2022. At that meeting, the City Council approved the implementation of a third-party hosted fraud and ethics hotline. The city has since selected Navex Global, Inc. to implement the hotline. In coordination with Navex Global, Inc. the city established the hotline, implemented Administrative Order #93-Fraud and Ethics Hotline, developed a hotline intranet page and program resources and the hotline (for employee use only) officially went live on November 15, 2022. 2 Transient Occupancy Tax
Review
Review (agreed upon
procedures)
Various city hotels/External audit
firm
In
process
The city engaged a regional CPA firm, CliftonLarsonAllen, LLP, to perform a transient occupancy tax review of the city's transient occupancy tax revenues that are remitted by hotels operating within the city boundaries.
The ongoing engagement includes a review of eleven hotels selected by the city's internal auditor. The engagement is nearing completion with 9 of 11 reviews complete. Once fully complete, the results will be reported to the City Council.
3 Procurement Program Audit Internal audit Various departments/Internal Audit Manager
In
process
This engagement is in process and involves an audit of the city's procurement functions, including advertising, bid and award activities. The audit is designed to evaluate the city's compliance with federal, state and local guidelines (policies) as well as an evaluation of its best practices. 4 Vice Narcotics Investigative
Unit "Buy Fund" Internal audit Police Department/Internal Audit Manager Pending
This engagement will evaluate the Police Department's adherence to Buy Fund policies and procedures, and the safeguarding of the program’s cash balances.
5 Revenue Audit Internal audit Finance Department/Internal Audit Manager Pending
This engagement will evaluate the city's processes for receiving, recording and collecting transient occupancy tax revenues received from hotels operating within the city. 6 Payroll Audit Internal audit Finance Department/Internal Audit Manager Pending This engagement will evaluate the city's payroll recordkeeping and data entry processes including the program's segregation of duties, which contribute to the city's internal control structure. 7 Business Application User
Access Review Review Various departments/Internal
Audit Manager Pending
This engagement will evaluate the city's management of user access associated with its core business applications. Examples include the evaluation of access granted to Finance Enterprise, the city's financial enterprise system and EnerGov, which is the city's enterprise system for business licenses, permitting, and code enforcement, among others.
Feb. 7, 2023 Item #13 Page 3 of 7
Fiscal Analysis
There is no immediate fiscal impact to receiving the internal audit update.
Next Steps
The city’s internal audit manager will continue with ongoing internal audit engagements identified in the FY 2022-23 Internal Audit Plan and will return to the City Council with an update after end of fiscal year 2022-23.
Environmental Evaluation
This action does not require environmental review because it does not constitute a project within the meaning of the California Environmental Quality Act pursuant to California Public Resources Code Section 21065 in that it has no potential to cause either a direct physical change or a reasonably foreseeable indirect physical change in the environment.
Exhibits
1. Fiscal Year 2022-23 Internal Audit Plan
Feb. 7, 2023 Item #13 Page 4 of 7
Fiscal Year 2022-23 Internal Audit Plan
Fiscal Year
2022-23
Internal Audit
Plan
Exhibit 1
Feb. 7, 2023 Item #13 Page 5 of 7
(city of
Carlsbad
Fiscal Year 2022-23 Internal Audit Plan
OVERVIEW
The City of Carlsbad’s internal auditor performs independent and objective assurance services to safeguard city resources and improve city operations. Internal audits help to mitigate risks by recommending improvements to the city’s internal controls and governance, risk, and compliance processes. Potential audits may include any city department, division, function, or program administered by the city.
The purpose of the annual internal audit plan is to outline audits and other value-added engagements the internal auditor proposes to conduct during the current fiscal year. This document serves as the primary work plan to carry out the responsibilities of the internal auditor. The basis for the audit plan comes from auditor observations, inquiries of management, audit requests from the City Council and senior management, and programs or processes with inherently higher risk levels. The internal auditor’s strategy in developing this plan seeks to identify, prioritize, and manage audits important to city operations, programs, and systems.
Currently, the Internal Audit Division is comprised of one full-time internal auditor. The internal audit plan considers available staff hours, level of expertise and experience, the estimated size and complexity of audits, time allocated to satisfy continuing professional education requirements, time allocated to performing audit follow-up procedures, and use of external consultants/auditors.
The internal audit plan is a working document. During the year, causes for changes to the audit plan may include an increase or decrease in audit scope, additional or pressing audit requests, or a threat to auditor independence. As such, projects initiated in the current year may carry over into the following fiscal year.
The following page identifies the list of prioritized internal audit engagements for FY 2022-23, along with their preliminary objectives. At the beginning of each engagement, the internal auditor will establish familiarity with the department, function or process identified for audit. During that initial period, audit objectives may be refined, and the methodology will be established.
Feb. 7, 2023 Item #13 Page 6 of 7
{city of
Carlsbad
Fiscal Year 2022-23 Internal Audit Plan
Fiscal Year 2022-23 Internal Audit Engagements
Entity, Function,
Program or
Process to Audit
Type of
Engagement
Primary
Stakeholder/Audit
Lead
Preliminary Objectives
Carryover from FY 2021-22
Procurement Internal Audit Various
departments/
Internal Audit
Manager
•To assess the city’s compliance with
applicable procurement guidelines.
•To evaluate whether the city’s
procurement process is effective and
adhered to.
Vice Narcotics
Intelligence Unit
(VNIU) “Buy
Fund”
Internal Audit Police
Department/Internal
Audit Manager
•To determine whether the fund was
managed and accounted for in
accordance with authorized policies
and procedures.
New for FY 2022-23
Transient
Occupancy Tax
Agreed Upon
Procedure
Various hotels as
determined by
city/External Audit
Firm
•To determine if hotels are properly
reporting and remitting occupancy
taxes in compliance with city
ordinance.
Revenue Audit Internal Audit Finance
Department/Internal
Audit Manager
•Evaluate the city’s receipt and
recordkeeping associated with its
transient occupancy tax revenues.
Payroll Audit Internal Audit Human
Resources/Finance
Department/Internal
Audit Manager
•Evaluate the city’s payroll
recordkeeping and data entry.
•Evaluate the city’s segregation of
duties.
Business
Application User
Access
Internal Audit Information
Technology
Department/Internal
Audit Manager
•Evaluate the city’s management of
user access across its enterprise
resource planning systems and
software applications.
Feb. 7, 2023 Item #13 Page 7 of 7
{city of
Carlsbad