1 Indepe
ndent Auditor’s Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards
To the
City Council
City of Fairfield, California
We h
ave audited, in accordance with auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States (Government Auditing Standards), the financial statements of the governmental activities, the business-type activities, each major fund, and the aggregate remaining fund information of the City of Fairfield, California (the City), as of and for the year ended June 30, 2024, and the related notes to the financial statements, which collectively comprise the City’s basic financial statements and have issued our report thereon dated December 12, 2024.
Repo
rt on Internal Control over Financial Reporting
In p
lanning and performing our audit of the financial statements, we considered the City's internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the City's internal control.
Accordingly, we do not express an opinion on the effectiveness of the City's internal control.
A def
iciency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the City’s financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
Our c
onsideration of internal control was for the limited purpose described in the first paragraph of this section and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. Given these limitations, during our audit we did not identify any deficiencies in internal control that we consider to be material weaknesses. We identified certain deficiencies in internal control, described in the accompanying Schedule of Findings and as item 2024- 001 that we consider to be a significant deficiency.
What inspires you, inspires us. | eidebailly.com
2151 River Plaza Dr., Ste. 308 | Sacramento, CA 95833-4133 | T 916.570.1880 | F 916.570.1875 | EOE 2 Report on Compliance and Other Matters
A
s part of obtaining reasonable assurance about whether the City’s financial statements are free from material misstatement, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the financial statements. However, providing an opinion on compliance with those provisions was not an objective of our audit and, accordingly, we do not express such an opinion. The results of our tests disclosed no instances of noncompliance or other matters that are required to be reported under Government Auditing Standards.
C
ity’s Response to Findings
G
overnment Auditing Standards requires the auditor to perform limited procedures on the City’s response to the findings identified in our audit and described in the accompanying Schedule of Findings and Responses. The City’s response was not subjected to the other auditing procedures applied in the audit of the financial statements and, accordingly, we express no opinion on the response.
P
urpose of this Report
T
he purpose of this report is solely to describe the scope of our testing of internal control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the City’s internal control or on compliance. This report is an integral part of an audit performed in accordance with Government Auditing Standards in considering the City’s internal control and compliance. Accordingly, this communication is not suitable for any other purpose.
S
acramento, California
December 12, 2024
City of Fairfield, California
Schedule of Findings and Responses
For the Year Ended June 30, 2024
3 2024-001 Systems Access Reviews
Type of Finding: Significant Deficiency in Internal Control over Financial Reporting C
riteria:
M
anagement is responsible for establishing a system of internal controls to prevent individuals having inappropriate access to systems or records within their accounting system. This includes having controls in place to review the systems access granted to individuals to ensure that those individuals are only granted the access they require for their position and assigned responsibilities, removing access when those individuals no longer require it, and reviewing the assigned access for conflicts with segregation of duties.
C
ondition:
Th
ere was no documentation of the review of user access in Tyler to verify the appropriateness of permissions based on their role and job duties. We corroborated with City employees that a review was performed, but there was no documentation of the review and the results of the review.
C
ause:
T
he City’s procedures do not include documenting the results of its periodic review of user access in Tyler.
E
ffect:
B
y not reviewing the user access in Tyler, there is an increased risk of individuals having inappropriate access and conflicting segregation of duties which increases the risk of fraud or error occurring within the accounting system and not being identified by management.
R
ecommendation:
W
e recommend that management formally document their periodic review of users and their access granted in Tyler to ensure that their current assigned access in appropriate for their position and responsibilities.
V
iews of Responsible Officials:
T
he City hired an expert to review all permissions and build a robust workflow model, this review and implementation was completed in November 2024, and while the city has consistently been reviewing permissions in the past there were too many changes made over the course of the first year of implementation to formally document. When the City conducts future periodic reviews, the process will be documented to reflect the outcome of the review.
City of Fairfield, California
Summary Schedule of Prior Audit Findings
For the Year Ended June 30, 2023
4 2023-001 Systems Access, Security and Segregation of Duties Type of Finding: Material weakness in Internal Control over Financial Reporting S
tatus:
P
artially implemented. See current year finding 2024-001. 20 23-002 Prior Period Adjustment, Manual Adjustments and Chart of Accounts for Financial Reporting Type of Finding: Material weakness in Internal Control over Financial Reporting S
tatus:
C
orrected.
20 23-003 Reconciliations
Type of Finding: Material weakness in Internal Control over Financial Reporting S
tatus:
C
orrected.