Internal Audit Unit
2600 Fresno Street, Suite 2162 PH (559) 621-6880 FAX (59) 498-2544 Kriti Agrawal, CIA Fresno, California 93721-3611 Principal Internal Auditor www.fresno.gov
Honorable Mayor and Audit Committee Members
City of Fresno, California
Attached is the Annual Citywide Risk Assessment proposed by the Internal Audit Unit of the City of Fresno. Included within this document is the Audit Work Plan, which lists the proposed audit assignments for FY 2023. The Audit Work Plan was developed by considering the results of the FY 2023 Citywide Risk Assessment, and input from other sources. The list of proposed audit assignments for FY 2023 includes performance audits regarding the various City departmental activity groups and other audit projects and activities. We designed our work plan to address what we considered to be risk areas, while limiting the scope of work to what we can realistically accomplish with the staff resources available.
Respectfully submitted,
Kriti Chadha Agrawal
KRITI AGRAWAL, CIA
Principal Internal Auditor, Finance Department
CC: Georgeanne White, City Manager, Office of the Mayor & City Manager Ruthie Quinto, Assistant City Manager, Office of the Mayor & City Manager Santino Danisi, Controller, Finance Department
Liliana Vidrio Flores, Internal Auditor, Finance Department Isabel Merino, Internal Auditor, Finance Department
Table of Contents
Calculation of Estimated Audit Hours Available for FY 2023 1 Citywide Risk Assessment – Fiscal Year 2023 2
Interpreting Risk Assessment Results 2
Audit Work Plan – Fiscal Year 2023 3
Attachment A 4
Attachment B 7
Annual Citywide Risk Assessment
Fiscal Year 2022
• • •
Calculation of Estimated Audit Hours Available for FY
2023
Principal
Internal
Auditor
Internal
Auditor
Internal
Auditor
Total
Three Full-Time Equivalent (FTE) Auditor Hours Hours Hours Hours Total Annual Hours Available
00002,080
2,080
2,080
6,240
Less Non-Audit Hours:
Annual Leave* 160 120 120
400
Supplemental Sick 40 40 40
120
FMLA/Other Leave 300 300
Holidays 96 96 96
288
Administrative Leave 60 60 60
180
Continuing Professional Education 40 40 40
120
Administrative Duties** 120 80 80
280
Other Assigned Projects*** 120 120 120 360 Total Non-Audit Hours 636 556 856
2,048
Total Annual Audit Hours Available
1,444
1,524
1,224
4,192
*"Annual Leave" - Maximum hours available- 13.3 hours * 12 months = 159.6 hours (rounded to 160).
Note - In most cases, auditors will take approximately 120 hours annual leave/year. If additional leave is requested, it will need to be discussed and approved by Management. **Administrative Duties" include completing timecards/leave approval; Performance Self-Evaluations; organization of office projects/tasks, etc.; research for training opportunities; and any time not attributed to a specific project or task assigned by management
***"Other Assigned Projects" include tasks such as developing IA department (updating annual risk assessment and audit plan, etc.), responding to Council and other stakeholder requests, internal research projects, presentation preparation, stakeholder outreach meetings, and research & development for future audit issues, etc.
Annual Citywide Risk Assessment
Fiscal Year 2022
• • •
Citywide Risk Assessment – Fiscal Year 2023
A risk assessment includes scoring based on a variety of risk factors. A risk factor is an indicator of a condition that could negatively affect the organization. They can measure inherent risk or organizational vulnerability. The risk assessment was used as a measurement tool for audits within the departments of the City of Fresno.
The first step in creating the City’s risk assessment model was to define the audit universe. The audit universe is a listing of all the City’s significant Auditable Units (all the City’s potential audits that could be performed). We created a list of all the City’s departments and their divisions as the Auditable Units.
A questionnaire was developed and sent to all department directors, with the request of responses per each division of their department. Responses to the questionnaires were submitted and scored into the risk assessment. Additional risk factors scored by department were the number of full-time employees (FTEs), revenues, and expenditures. The last risk factor taken into account, is the amount of time that has elapsed since the last audit was conducted for a division.
The final step to completing the risk assessment was calculating the total risk score for each of the submitted divisions of each department. The risk assessment was listed in order based on highest risk score to lowest risk score. In addition, the divisions are rated in descending order by tenths, identifying the top 30 percent (or those ranking 10, 9, or 8) as High Risk. The next 40 percent (ranking 7, 6, 5, or 4) were identified as Medium Risk, and the bottom 30 percent (score of 3, 2 or 1) of risk scores were ranked as Low Risk (See Attachment B – Citywide Risk Assessment).
Interpreting Risk Assessment Results
If a division has a high risk score, this indicates that the services they provide, or functions they are responsible for, are high in risk due to factors such as having a large amount of expenditures or revenues. A high risk score does not mean that a division is being managed ineffectively or that it is not functioning properly. High risk areas may indicate opportunities to address activities which are mission critical, provide substantial support for other internal City operations, reflect high public need, or consume significant financial resources. The overall risk scores identify activities with the highest risk factors that may warrant additional audit services.
Annual Citywide Risk Assessment
Fiscal Year 2022
• • •
Audit Work Plan – Fiscal Year 2023
While the annual risk assessment plays a major role in shaping the audit plan, it is not the sole factor defining that plan. Factors like scope limitations, an improvement of internal controls, input from stakeholders, and notification of possible internal control violations can also guide the audit plan’s development. In the end, the Internal Audit Unit uses all pertinent factors in conjunction with their professional judgment to develop the audit plan.
In the Audit Work plan for FY 2023, we have included the carryover of an audit from FY 2023 for the Information Services and PARCS Departments. The audits following are those proposed for FY 2023 and are based on the FY 2023 Citywide Risk Assessment results.
Work Plan
Item No.
Risk
Score Activity Group Audit Audit Objectives Status
1 51* Information Services Department -
Administration
Wireless devices audit Fieldwork
2 60 Finance Department - Administration Evaluation of Internal Controls
RFP
Interviews
Being
Conducted
3 56* PARCS - Administration TBD Not started
4 73 Airports - Administration Follow-up review Not started 5 87 Public Utilities-Water TBD Not started
6 86 Public Works-Construction
Management
TBD Not started
*Note - The audit was carried over into the current fiscal year because it was not completed by the end of FY 2022. The audit risk score is based on the FY 2023 Risk Assessment.
Attachment A
Internal Audits Annual
Risk Assessment
Management Questionnaire
Name: Title:
Department: Division:
1. To what extent does your department/division interface with the external public? Description / Purpose: Assess how frequently your department/division works/interacts directly with the public or City residents. Little to no interaction is not a negative indicator, but rather an indicator that your department/division serves internal customers – internal customer interaction is addressed in question 3.
a. None.
b. Rarely or infrequently.
c. Monthly to quarterly level of interface.
d. Weekly level of interface.
e. Continual interface with the external public several times daily or more.
2. To what extent is your department considered to be “mission critical” for the City to achieve its goals and objectives?
Description / Purpose: Mayor Dyer’s FY 23 Budget includes the following priorities: We work for you (improve customer service), public trust and safety, inclusive economic development, youth leadership development, downtown pride, and homelessness and housing. Ascertain the significance that your department/division plays in these priorities.
Little to no contribution is not a negative indicator, but rather an indicator that your department may provide services that support other internal customers.
a. No contribution towards the City’s goals / objectives. b. Minimal contribution towards attaining the City’s goals and objectives. c. Moderate contribution towards attaining the City’s goals and objectives. d. Significant contribution towards attaining the City’s goals and e. The success of the city’s goals and objectives is fully dependent on this department.
3. To what extent does your department/division support internal operations or are considered critical to achieving the objectives of other operation’s missions/goals? Description / Purpose: Determine the level of support and role your department/division plays in helping other departments/divisions achieve their overall mission. This question identifies the interconnectedness that one department/division has with other internal operations.
a. No support provided to other operations.
b. Infrequent (i.e. annual) support provided to other operations. c. Periodic (i.e. monthly) support provided to other operations.
Internal Audits Annual
Risk Assessment
Management Questionnaire
d. Regular (i.e. weekly) support provided to other operations. e. Ongoing support provided to other operations every day.
4. To what extent would failure to achieve your department’s/division’s mission or goals lead to public displeasure or negative media coverage?
Description / Purpose: Assess how the department’s/division’s level of visibility to the public, public interest in the department/division, interest of the media, or other public relations factors would lead to an increased potential loss or embarrassment if the department/division did not perform its critical mission or goals. This could also be called the newspaper test – how much negative press or public disapproval would a failure cause?
a. No risk of loss or embarrassment.
b. Low risk of loss or embarrassment.
c. Moderate risk of loss or embarrassment.
d. Significant risk of loss or embarrassment.
e. Very high risk of loss or embarrassment.
5. To what extent is there potential loss due to the cash or cash-convertible nature of your department’s/division’s transactions?
Description / Purpose: Assess the risk associated with cash or cash-convertible assets. Be sure to factor in the amount of cash collected as compared to business transacted by other means (credit card, electronic funds transfer, invoice, journal entry, etc.), as well as risks associated with the volume, type, and nature of existing assets that are susceptible to theft such as equipment, supplies, and inventories.
a. None.
b. Minimal amount of cash transactions or assets are difficult to convert to cash. c. Moderate amount of cash transactions or assets can be converted to cash with some difficulty.
d. Nature of operations is primarily cash or assets are easily converted to cash. e. Fully cash or equivalent operations.
6. To what extent does your department/division track activity performance metrics?
Description / Purpose: Determine the extent to which your department/division captures, assesses, and responds to performance measurement data.
a. We continuously capture performance metrics on key operations, assess achievement of goals and trends in the information, and adjust operations to improve upon our performance in all key areas.
Internal Audits Annual
Risk Assessment
Management Questionnaire
b. We track performance information in all key operations, assess and use data to improve operations, but we do not engage this process in a continuous, fluid manner.
c. We track performance information in all our key operations and may assess data to some extent, but we do not use data to improve performance in all key areas. d. We collect some performance information, but the information does not account for all our key operations or we do not assess the data.
e. We do not track performance measures or metrics.
7. To what extent do regulations affect or have impact on operations?
Description / Purpose: Assess how government regulations (federal, state, or local) impact your department’s/division’s operations and the exposure to sanctions and potential penalties for noncompliance. Please be sure to factor in the complexity, volume, and change in regulations, including ordinances, municipal codes, administrative regulations, MOUs, federal and state laws and regulations, contract conditions, and grant provisions that pertain to your department/division.
a. None.
b. Few regulations and little risk of noncompliance.
c. Risk of either substantial regulations or significant penalties. d. Complex, voluminous, or frequently changing regulations with significant penalties. e. Heavily regulated with serious consequences for noncompliance.
Department Division RAQ 1 RAQ 2 RAQ 3 RAQ 4 RAQ 5 RAQ 6 RAQ 7 FTEs Rev Exp Risk Score A1 Adjusted Risk
Score
Rank
10ths
Public Utilities Water 9 9 9 9 3 3 9 9 9 9 78 9 87 10
Public Works Construction Management 9 9 9 9 7 0 9 7 9 9 77 9 86 10 Public Works Landscape Maintenance 9 9 9 9 3 3 9 7 9 9 76 9 85 10 Police Patrol 9 9 9 9 7 0 9 9 5 9 75 9 84 10
Public Utilities Solid Waste 9 9 9 9 0 3 9 9 9 9 75 9 84 10 Transportation Capital Projects/Operations 9 9 5 9 9 0 9 9 9 7 75 9 84 10 Public Utilities Wastewater Management 9 9 5 9 3 3 9 9 9 9 74 9 83 10 Transportation Support Services/Customer Experience 9 5 9 7 9 0 9 9 9 7 73 9 82 10 Planning & Development Long Range Planning 9 9 7 7 5 7 7 7 7 7 72 9 81 9 Planning & Development Building & Safety 9 7 9 7 3 9 7 7 7 7 72 9 81 9 Planning & Development Administration 9 9 7 9 7 3 7 7 7 7 72 9 81 9 Public Works Streets/Traffic Signals 9 9 9 9 3 3 9 7 9 9 76 5 81 9 Public Utilities Administration 9 9 5 9 3 0 9 9 9 9 71 9 80 9 Planning & Development Current Planning 9 9 9 9 7 0 5 7 7 7 69 9 78 9 Police Support 9 9 9 9 3 0 9 9 5 9 71 7 78 9
Airports Capital 9 7 5 9 3 7 9 5 7 7 68 9 77 8
Public Works Administration 9 9 9 7 3 3 7 7 9 9 72 5 77 8 Airports Finance 9 9 5 9 0 9 9 5 7 7 69 7 76 8
Airports Fresno Chandler Airport 9 9 9 9 3 0 9 5 7 7 67 9 76 8 Airports Operations 9 7 5 9 3 7 9 5 7 7 68 7 75 8
Fire Personnel & Investigations 9 9 9 9 5 0 9 7 3 5 65 9 74 8 Police Investigations 9 9 9 9 0 0 9 9 5 9 68 5 73 7
Airports Administration 9 5 5 9 5 5 9 5 7 7 66 7 73 7
Public Utilities Utilities Planning & Engineering 9 7 9 9 0 0 3 9 9 9 64 9 73 7 Airports Marketing 9 7 5 9 5 0 9 5 7 7 63 9 72 7
Transportation FAX Maintenance 3 7 9 7 5 0 9 9 9 7 65 7 72 7 Planning & Development Parking 9 7 7 9 5 3 9 7 7 7 70 0 70 6 Fire Suppression 9 9 9 9 3 0 7 7 3 5 61 9 70 6
Public Works Traffic Operations & Planning 9 7 7 5 3 0 5 7 9 9 61 9 70 6 Fire Fire Prevention and Technical Services 9 9 7 9 5 3 7 7 3 5 64 5 69 6 Airports Properties 7 5 7 5 5 3 9 5 7 7 60 9 69 6
Police Administration 9 9 7 9 0 3 9 9 5 9 69 0 69 6
Public Works Engineering/Design/Project Management 9 7 7 7 0 7 7 7 9 9 69 0 69 6 Personnel Organization Development & Training 9 9 9 7 3 3 9 0 5 5 59 9 68 5 Personnel Operations 9 9 9 7 3 3 9 0 5 5 59 9 68 5
Personnel Administration 9 9 9 7 3 3 9 0 5 5 59 9 68 5
Fire Training 9 9 9 9 3 0 5 7 3 5 59 9 68 5
Fire Operations 9 9 9 9 3 0 7 7 3 5 61 7 68 5
ISD Systems & Applications 9 9 9 5 5 7 5 3 3 3 58 9 67 4 Transportation Municipal Fleet Management 5 5 9 3 0 0 9 9 9 7 56 9 65 4 Transportation Administration 5 7 9 7 3 0 9 9 9 7 65 0 65 4 Personnel Risk Management 9 9 9 7 3 0 9 0 5 5 56 7 63 4 Finance Utilities Billing & Collections 9 3 7 7 7 5 7 3 7 3 58 3 61 4 Personnel Labor Relations 3 9 9 9 0 3 9 0 5 5 52 9 61 4 Finance Administration 9 3 9 9 5 5 7 3 7 3 60 0 60 3
City Attorney Code Enforcement 9 7 7 9 5 0 9 5 0 0 51 9 60 3 ISD Cyber Security 7 9 9 7 0 5 5 3 3 3 51 9 60 3
Mayor/Managers Support Office of the Mayor 9 9 9 9 3 3 9 0 0 0 51 9 60 3 Planning & Development Housing & Community Development 5 7 3 5 0 7 7 7 7 7 55 5 60 3 City Attorney Administration 9 5 7 9 5 0 9 5 0 0 49 9 58 3 ISD Computer Services 3 9 9 7 3 5 3 3 3 3 48 9 57 2
Fire Business & Fiscal Services 5 7 9 5 3 3 9 7 3 5 56 0 56 2 PARCS Administration 9 7 7 9 5 0 5 3 3 3 51 5 56 2
ISD Geographic Information Systems 5 7 9 7 0 5 3 3 3 3 45 9 54 2 ISD Regional Communications 3 7 9 7 0 5 5 3 3 3 45 9 54 2 Retirement Administration 9 7 0 5 0 3 7 0 9 5 45 9 54 2 ISD Administration 5 7 9 3 3 5 3 3 3 3 44 7 51 1
Office of the Mayor and City Manager Administration 9 9 9 7 3 5 3 0 0 0 45 0 45 1 City Clerk Administration 9 3 5 7 0 5 5 0 0 0 34 9 43 1 City Clerk Copy Center 9 3 5 7 0 5 5 0 0 0 34 9 43 1
City Council** District 1-7 9 8 7 8 1 4 4 4 0 0 32 9 41 1 Transportation* Public Safety N/A N/A N/A N/A N/A N/A N/A 9 9 7 25 9 34 1 Key
RA# - Risk Assessment Questionnaire question number Scoring System FTEs - Full time employees (according to FY 21 budget) Response Score Rev - Budgeted revenues (according to FY 21 budget) A 0 Exp - Budgeted expenses (according to FY 21 budget) B 3 A1 - Adjustment 1, years since division was audited C 5 Rank - 1-3, Low risk; 4-7, Medium risk; 8-10, High risk D 7 *Risk Assessment Survey responses were not received from these divisons E 9 **Received responses from Council Districts 2,3,4,5, and 6. We calculated the average score from the responses on the questionaires received to include in the matrix.