CITY COUNCIL STAFF REPORT
Meeting: July 2, 2024
Subject
Accept the Enterprise Risk Assessment Final Report and FY 2024-25 Internal Audit Work Plan Recommended Action
Accept the Enterprise Risk Assessment Final Report
Accept the FY 2024-25 Internal Audit Work Plan
Reasons for Recommendation
Background
As of FY 2021-22, Moss Adams LLP (“Moss Adams”) serves as the designated Internal Auditor for the City of Cupertino (the City) and conducts projects focusing on:
Risks
Internal controls
Efficiency and effectiveness
Best practices
Compliance
As described in the internal audit charter, the Internal Auditor is appointed by and reports to the Audit Committee and City Council. The Audit Committee and City Council approve the annual audit work plan, review audit report findings and recommendations, and monitor the implementation of recommendations. 2024 Enterprise Risk Assessment
As part of their internal audit work plan, Moss Adams conducted a triennial enterprise risk assessment for the City. An enterprise risk assessment provides a snapshot of the risk landscape at a specific point in time, reflecting current threats and vulnerabilities faced by the City. It is a recommended practice to regularly update an enterprise risk assessment to ensure that the City maintains an accurate and up-to-date understanding of its risk environment.
This enterprise risk assessment provides a way for the leadership of the City to measure uncertainty related to the City’s ability to achieve defined strategic objectives and operate effectively. Risks are identified, analyzed, and measured by the level of inherent vulnerability, the level of preparedness to mitigate them, and the impact such negative events could have on the City should they occur. This assessment evaluates risk across 19 categories. This engagement took place between December 2023 and May 2024 and is a point-in-time assessment. Additionally, as stated in the report, the results of this ERA were largely impacted by views of the City’s financial future; however, currently, management believes there is now a more optimistic outlook on the City’s finances.
The previous Enterprise Risk Assessment was conducted in 2020 and presented to the Audit Committee on February 22, 2021 and May 24, 2021 (continued from previous meeting), and to the City Council on July 20, 2021.
Compared to 2020, the 2024 risk assessment results show that 42% of the City’s risk categories have remained flat in their risk rating. There has been an increase in risk rating for 32% of categories, and 26% of categories have decreased in their risk rating. Increased risk ratings are largely driven by the change in the City’s financial situation, while decreased risk is due to the City’s efforts in the intervening years to deploy risk mitigation strategies. This has involved additional studies over the past three years to address areas of risk, including an Enterprise Leadership Assessment, Budget Review, Capital Program Effectiveness Study, and Procurement Operational Review.
Internal Audit Work Plan
The Internal Audit Work Plan, developed by Moss Adams, outlines the projects to be undertaken in FY 2024-25. The Audit Committee and City Council prioritize the projects included in the work plan.
The Audit Committee and City Council approved the following internal audit work plans in prior years:
FY 2021-22:
Procurement Operational Review
Policy Inventory (Fiscal) and Plan
Capital Program Effectiveness Study Fraud, Waste, and Abuse Program FY 2022-23:
Budget Process Review
Enterprise Leadership Effectiveness Study
Library Construction Audit
FY 2023-24:
Enterprise Risk Assessment
City Policy Inventory
For FY 2024-25, Moss Adams recommended the following internal audit work plan:
Grants Management Internal Controls Review: Assess the internal controls in place over the City’s grants management activities (including applications, review, administration, and reporting). (16 weeks, $25,000) Special Revenue Funds Process Review: Document the process used for special revenue fund accounting, identify gaps compared to best practices, and conduct testing of prior years’ accounting. (16 weeks, $18,000) Recommendation Validation Process Establishment: Inventory prior internal and external audit recommendations, collaborate with City staff to develop a tracking mechanism and process to report and validate recommendation implementation (20 weeks, $10,000) Ongoing Internal Audit Services Attend Audit Committee and Council meetings, prepare status reports, manage internal audit program, and monitor FWA hotline. ($7,000) The Enterprise Risk Assessment and FY 2024-25 Internal Audit Work Plan were presented to the Audit Committee on June 24, 2024. The Audit Committee voted unanimously to receive the reports and forward them to the City Council for approval.
Next Steps
From the risk assessment results, Moss Adams prioritized and recommended an internal audit work plan for FY 2024-25. If the City Council approves the recommended internal audit work plan, Moss Adams will complete the recommended projects and present the audit reports to the Audit Committee for review and the City Council for acceptance. The audit reports will be available on the City’s website at cupertino.org/finance under Internal Audit.
Sustainability Impact
No sustainability impact.
Fiscal Impact
In the FY 2024-25 Adopted Budget, the City has budgeted $60,000 for the internal audit contract in the contracts category of the accounting program (GL 100-41-405 700-702). No additional appropriations are requested.
California Environmental Quality Act
Not applicable.
_____________________________________
Prepared by: Thomas Leung, Budget Manager
Reviewed by: Kristina Alfaro, Director of Administrative Services Approved for Submission by: Pamela Wu, City Manager
Attachments:
A – City of Cupertino Enterprise Risk Assessment Final Report B – FY 2024-25 Internal Audit Work Plan