- 1 -
4/24/2024 4:00:00 PM
www.modestogov.com
AGENDA
City of Modesto
SPECIAL AUDIT COMMITTEE
COUNCIL WORKSHOP
2001-40 Del Puerto Room
Tenth Street Place, 1010 10th Street
Modesto, California
Wednesday, April 24, 2024 at 4:00 PM
Roll Call: Sue Zwahlen, Chair
Nick Bavaro, Vice-Chair
David Wright, Member
Camille Garcia, Public Member
Jennifer Barillas, Public Member
Alternates: Eric Alvarez, Rosa Escutia-Braaton, Chris Ricci, Jeremiah Williams Council has not delegated directive or final approval authority to the Committees.
Committee actions are recommendations to the full City Council, not final decisions on an issue. * Public Comment will only be in-person. Members of the public who wish to address the Committee, by providing public comment, during the meeting must do so in-person in the 2001-40 Del Puerto Room. As an alternative, members of the public may also provide written public comment submitted via email as indicated in the Submitting Comments by Email instructions on this agenda. Zoom will still be available for viewing and Wordly translation. *Members of the public will be allowed to provide public comment through Zoom if a Committee Member is participating remotely pursuant to the provisions of Assembly Bill 2449.
Effective March 1, 2023, if a technical issue arises with Zoom or the phone dial-in option, the Committee meeting will continue unless the meeting is being held pursuant to the provisions of Assembly Bill 2449. Alternative viewing options are listed below, and the meeting is physically open to the public.
“Wordly” can translate into 25+ different languages! To access written translation during the meeting, please scan the QR Code or click this link https://attend.wordly.ai/join/RJDY-6364.
- 1 -
4/24/2024
- 2 -
4/24/2024 4:00:00 PM
"Wordly" puede traducir a más de 25 idiomas diferentes! Para acceder a la traducción durante la reunión, por favor escanee el código QR o haga clic en el enlace https://attend.wordly.ai/join/RJDY-6364.
You may observe a livestream of the meeting at http://media.modestogov.com. You may also view or listen to the meeting as indicated below.
THE MEETING CAN BE VIEWED BY ZOOM VIDEO
CONFERENCING OR TELEPHONE
Joining the Committee meeting via Zoom
The City of Modesto is now offering the ability to view Committee meetings via telephonic conferencing via “Zoom” video conferencing computer technology. The meeting may be accessed through the use of Zoom using the following options:
Enter the following link into an Internet Browser
https://us02web.zoom.us/j/86945970570,
Enter the following link into an Internet Browser https://zoom.us/ and using the Webinar ID 869 4597 0570
Passcode 84326
To use Zoom, please visit: https://zoom.us/ and either sign-up for a free Zoom account or continue as a guest. Once you have downloaded the app onto your mobile device, joined from your web browser, or downloaded the Zoom software on your computer you will be ready for the upcoming Committee meeting.
Joining the Committee meeting via Telephone
If you don’t have a smart phone or computer to access the meeting via Zoom, you can listen by phone, by calling 1-877-853-5257 (Toll Free) or 1-888-475-4499 (Toll Free) and enter the Webinar ID 869 4597 0570 Passcode 84326
PUBLIC COMMENTS IN PERSON
Three-minute time limit per speaker.
Only interested persons in the audience may present these matters. Under State law, Committee Members may respond to matters being presented under this item only as follows:
a. Briefly respond to statements made or questions raised. b. Ask a question for clarification.
c. Provide a reference to staff or other resources for factual information. d. Request staff to report back at a subsequent meeting. e. Finally, a Committee Member or the Committee itself may take action to direct staff to place a matter of business on a future agenda.
SUBMITTING COMMENTS BY E-MAIL
Written comments may be submitted via email to: [email protected] (include Agenda Item Number in the subject line). All comments will be shared with the Committee - 2 -
4/24/2024
- 3 -
4/24/2024 4:00:00 PM
Members and placed in the record but will not be read aloud during the meeting. Written comments must be received two hours before the meeting.
This Agenda is on file in the City Clerk’s Office, Sixth Floor, 10th Street Place, Posting Board at entry of 10th Street Place, and is available on the City’s Web site at www.modestogov.com.
Materials related to an item on this Agenda submitted to the Council after distribution of the agenda packet are available for public inspection in the Clerk’s office during normal business hours. Such documents are also available online, subject to staff’s ability to post the documents before the meeting, at the following website www.modestogov.com/councilmeetings In accordance with the requirements of Title II of the Americans with Disabilities Act (“ADA”) of 1990, the Fair Employment & Housing Act (“FEHA”), the Rehabilitation Act of 1973 (as amended), Government Code section 11135 and other applicable codes, the City of Modesto (“City”) will not discriminate against individuals on the basis of disability in the City’s services, programs, or activities. For more information, please visit the City of Modesto website at https://www.modestogov.com/865/Americans-with-Disabilities-Act-ADA In compliance with the Americans with Disabilities Act, if you need special assistance to participate in this meeting, please contact the City Clerk (209) 577-5396. Notification 48 hours prior to the meeting will enable the City to make reasonable arrangements to ensure accessibility to this meeting
Any and all of the following agenda items are subject to action by the Modesto City Council.
NEW BUSINESS
1. Internal Audit Status Report dated April 24, 2024. (Funding Source: Not Applicable) Presentation of Internal Audit Status Report, dated April 24, 2024.
CITY AUDITOR; Colleen Rozillis, 206-302-6795, [email protected]
2. Consider Internal Controls Review Report and Presentation. (Funding Source: Not Applicable)
Motion recommending the acceptance of the Internal Control Review Report and Presentation and forwarding to Council for approval.
CITY AUDITOR; Colleen Rozillis, 206-302-6795, [email protected]
3. Enterprise Risk Training Presentation. (Funding Source: Not Applicable) Presentation of Enterprise Risk Training.
CITY AUDITOR; Colleen Rozillis, 206-302-6795, [email protected]
ADJOURNMENT
Posted pursuant to Government Code Section 54954.2 on the bulletin board at Tenth Street Place on - 3 -
4/24/2024
- 4 -
4/24/2024 4:00:00 PM
at by
date time signature
- 4 -
4/24/2024
CITY OF MODESTO INTERNAL AUDIT STATUS REPORT 04-16-24
April 24, 2024
To: City of Modesto Audit Committee
From: Moss Adams LLP
Subject: Internal Audit Status Report January 18 through April 16, 2024 _____
INTERNAL AUDIT
PROJECTS INTERNAL CONTROLS REVIEW FRAUD, WASTE, AND ABUSE POLICY UPDATE AND TRAINING
FLEET OPERATIONS INTERNAL
CONTROL REVIEW
PROCUREMENT PERFORMANCE
AUDIT
SOLID WASTE AND FORESTRY
EFFICIENCY STUDY UPDATE
PROPERTY MANAGEMENT
REVIEW
Schedule December 2023 through March 2024 October 2023 through May 2024 February through May 2024 March through June 2024 March through June 2024 April through August 2024 Budget Status: Total
Budget and %
Expended
$40,000
72%
$20,000
51%
$40,000
2%
$50,000
0%
$25,000
0%
$35,000
0%
Activities for This
Period
Completed fieldwork and analysis,
developed draft and final reports.
Completed program description and
training materials; reviewed with City
leadership and finalized.
Held kickoff meeting, received
preliminary documents, began
conducting interviews
Conducted fieldwork: interviews and
document review.
Held orientation meeting, submitted
document request, began scheduling
interviews.
Held kickoff meeting, submitted
document request and work plan for
approval.
Activities for Next
Period None Deliver training. Develop testing plan and conduct testing.
Conduct analysis and develop
preliminary findings.
Completing field, analysis, and
reporting.
Conduct interviews and document
analysis to develop preliminary
observations.
Issues None None None None None Schedule delays due to staffing changes. New contact started 4/15.
BASIC INTERNAL
AUDITOR SERVICES
ONGOING INTERNAL AUDIT
SERVICES
ETHICS HOTLINE STATISTICS
Schedule October 2023 through June
2024 Complaint Type
Complaints Received This
Quarter Under Review
Referred to Appropriate City
Official(s) Closed
Budget Status: Total
Budget and %
Expended
$30,000
65%
Compliance & Ethics 6 0 6 6
Fraud 0 0 0 0
Employment Matters 0 0 0 0
#1..
- 5 -
FINAL REPORT
City of Modesto
INTERNAL CONTROLS REVIEW
April 15, 2024
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
#2..
- 6 -
Internal Controls Review Report
FOR INTERNAL USE OF CITY OF MODESTO ONLY
Table of Contents
Executive Summary 1
Scope and Methodology 3
Internal Controls Review 5
#2..
- 7 -
Internal Controls Review Report | 1
FOR INTERNAL USE OF CITY OF MODESTO ONLY
EXECUTIVE SUMMARY
As part of the fiscal year 2023-2024 internal audit program, the City of Modesto (the City) requested that Moss Adams LLP (Moss Adams) conduct a review of the City’s internal controls framework. The internal controls review took place between December 2023 and March 2024 and focused on assessing select key controls in areas deemed important to protecting the City’s assets and resources as well as processing and reporting timely financial information.
We conducted this internal controls review in accordance with Generally Accepted Government Auditing Standards (GAGAS). Those standards require that we plan and perform the internal controls review to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our objectives. The internal controls review objectives, scope, methodology, and conclusions are included in the report body.
This internal controls review did not constitute an audit of financial statements in accordance with GAGAS. Moss Adams LLP was not engaged to and did not render an opinion on the City’s internal controls or over financial management systems.
Specific areas where controls were reviewed included:
Accounts Receivable
Cash Management
Financial Reporting, Close, and Reconciliations
Fixed Assets and Asset Management
Inventory
Information Technology (IT) General Controls
Overall Control Environment
Payroll and Timekeeping
Purchasing and Accounts Payable
Revenue and Billing
The City appeared to have internal controls developed for many functions, and the City was in the process of implementing internal controls for other functions. Some examples of commendable activities that, based on the review performed, appeared to have well-designed internal controls, include:
Monitoring and reconciliation controls related to:
○ Accounts Receivable
○ Cash Management
○ Financial Reporting, Close, and Reconciliation
○ Overall Control Environment
Performing occasional surprise cash audits across City departments Performing timecard audits at the close of each pay period #2..
- 8 -
Internal Controls Review Report | 2
FOR INTERNAL USE OF CITY OF MODESTO ONLY
Performing weekly blind inventory counts of Central Store inventory Setting standards for a strong IT security environment Establishing a strong foundation of accountability and segregation of duties by incorporating a number of review processes across financial-related functional areas Similar to most cities, there is an opportunity to strengthen controls, policies, procedures, and systems. Although minor gaps in internal controls of varying degrees were discovered across six of the ten functions reviewed, the City appears to have a strong internal control environment.
Suggested priorities to address over the next six to 12 months include, but are not limited to:
Fixed Assets and Asset Management
○ Updating policies and procedures
○ Reconciling newly added fixed assets
Inventory
○ Updating policies and procedures
○ Developing a process to ensure that an independent review and close-out occurs for Fleet work orders and parts requests
IT General Controls
○ Confirming which IT assets are disposed of by third-party companies Payroll and Timekeeping
○ Updating policies and procedures
○ Updating the paid-time-off (PTO) accrual rate change process ○ Reviewing and updating user access to payroll-related forms ○ Defining roles and responsibilities for ensuring that all documentation related to the annual negotiated salary increase is retained
Purchasing and Accounts Payable
○ Verifying that procurement card (P-Card) users have signed the P-Card Agreement and completed the required training prior to receiving their P-Card #2..
- 9 -
Internal Controls Review Report | 3
FOR INTERNAL USE OF CITY OF MODESTO ONLY
SCOPE AND METHODOLOGY
The scope of our internal controls review included an evaluation of the City’s key internal controls to determine the general adequacy of internal controls and identify areas warranting more in-depth review in the future.
The scope of the internal controls review included the following functional areas:
Accounts Receivable
Cash Management
Financial Reporting, Close, and Reconciliations
Fixed Assets and Asset Management
Inventory
IT General Controls
Overall Control Environment
Payroll and Timekeeping
Purchasing and Accounts Payable
Revenue and Billing
For each functional area assessed, we conducted a review of key controls which included:
Identifying control objectives in specific areas and controls that would satisfy each control objective
Reviewing policies and procedures
Examining relevant documentation in support of select key controls Performing control walkthroughs to observe the design of key controls and understand workflow processes
Obtaining an understanding of the characteristics of each relevant control activity (who performs it, how often it is designed to operate, whether it is designed to mitigate fraud, whether it is a manual or programmed (automated) control, and whether it is a preventive, detective, or corrective control)
Assessing whether the controls in place would prevent or detect errors Providing recommendations on key controls that need to be implemented or changed The work performed included interviews with employees involved in managing functions, processing key accounting transactions, and handling physical assets in the following departments:
Finance
Human Resources
Technology Services
Public Works
#2..
- 10 -
Internal Controls Review Report | 4
FOR INTERNAL USE OF CITY OF MODESTO ONLY
In support of the internal controls review, the matrix provided in Section III provides results by including the:
Control objective
Control issue
Corresponding recommendation
Likelihood of occurrence
Impact of occurrence
Likelihood of occurrence is defined as the probability of a negative event occurring. Impact of occurrence is defined as the level of significance if a negative event occurs. Risk levels of low, moderate, or high were used to rate the likelihood of occurrence and impact of occurrence for each finding.
Beyond those controls that have been noted within this report as an issue, additional controls were reviewed without exception. It should be noted that many controls were reviewed multiple times in relevant, separate department reviews, but not all controls or departments were reviewed.
Departments were selected to provide a broad understanding of the City’s control environment. Key controls with exception conditions are reported in this document. #2..
- 11 -
Internal Controls Review Report | 5
FOR INTERNAL USE OF CITY OF MODESTO ONLY
INTERNAL CONTROLS REVIEW
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
A. Fixed Assets and Asset Management
1 The City performs
reconciliations of fixed
assets entered into the
Oracle system to
physically issued tag
numbers to ensure
accuracy and consistency
of fixed asset inventory
records.
The City was not completing a
reconciliation of the asset tag
numbers to the Oracle system
to ensure that all assets were
issued a tag and that the tag
numbers were appropriately
recorded in Oracle. Without this
reconciliation, the risk for asset
loss or theft increases because
assets may not be as easily
located or identified.
The City should develop a process
that would require City staff that are
responsible for overseeing fixed
asset inventory to complete a
monthly reconciliation that would
verify whether fixed assets entered
into Oracle that month were properly
tagged. The process should clearly
define:
● Who is responsible for
performing this reconciliation
● How they should perform and
document the reconciliation
● Where the reconciliation
documentation is maintained
● How they should investigate any
variances
● Who should review and approve
the reconciliation
High Moderate
#2..
- 12 -
Internal Controls Review Report | 6
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
2 The City’s Asset
Safeguarding Directive
includes specific controls
related to preventing asset
loss.
The City’s current Asset
Safeguarding Directive does not
include specific controls
describing the detailed
steps/actions that the City
deploys to prevent asset loss.
The City should update the current
Asset Safeguarding Directive to
include preventative steps relating to
asset loss, which might include:
● Conducting regular inventory
checks to ensure that assets are
accounted for and to identify any
missing or stolen assets
● Implementing access controls to
limit access to assets to
appropriate employees
● Installing surveillance systems to
monitor assets and deter theft or
vandalism
● Providing training to educate
employees about the importance
of safeguarding assets and the
policies in place to protect the
City’s assets
High Moderate
3 Monthly Mass Addition
reports are reviewed, and
evidence of the review is
documented via signature
and date.
Although there was evidence
that the Monthly Mass Addition
reports, which details all asset
additions across the City each
month, were being reviewed,
there was no evidence of who
completed the review and
when.
The City should develop a policy
and procedure around the review of
the Monthly Mass Addition reports
specifically addressing who
completes the review, what the
review is meant to achieve, and a
requirement for the City staff
members completing the review to
sign off and date the report as
evidence that the review was
completed. This formal signoff and
date should signify that the reviewer
believes the Monthly Mass Addition
is complete and accurate. This
review helps to support the financial
High Moderate
#2..
- 13 -
Internal Controls Review Report | 7
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
reporting and asset safeguarding
functions at the City.
4 The City's record retention
policy includes a retention
requirement for
documents/records
relating to asset auctions.
During our assessment of the
supporting documentation for a
recent City auction, the City
was able to provide the
supporting Equipment Auction
List; however, the email
correspondence from Accounts
Receivable, which provides
notification that the assets were
ready for auction, could not be
provided. The supporting email
is meant to ensure that the
correct assets are identified for,
and included in, the auction.
The City should review its record
retention policy to ensure that the
requirements for disposed asset
records are maintained for at least
six years after the disposal date
based on best practices set by
Generally Accepted Recordkeeping
Principles. The policy should
address what supporting
documentation must be maintained
to support auctioned assets. Making
these updates will help to promote
better accountability and reliability
that the correct assets are identified
for auction and are the same assets
that end up being auctioned.
High Moderate
B. Inventory
1 Fleet inventory counts are
performed in alignment
with regular inventory
blind counts.
During our preliminary
procedures, we found that the
last fleet inventory count was
performed approximately two
years ago. There are currently
no standards or guidance that
require the fleet inventory to be
a part of the City’s current
annual inventory blind count
procedures.
The City should update its current
inventory reconciliation and count
processes to include the fleet
inventory as part of the annual
inventory blind counts. An annual
count will give the City a more
reliable and accurate count of
inventory while also promoting the
proper safeguarding of assets. The
City should ensure to document the
results of the count each year along
with any variances that are observed
to best address any potential
inventory issues and mitigate
potential risks of loss or theft in the
future.
Moderate Moderate
#2..
- 14 -
Internal Controls Review Report | 8
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
2 Only Fleet Supervisors or
Crew Leads review and
close out work orders and
parts requests within the
AssetWorks system.
For three work orders
assessed, there was no
evidence that the Fleet
Supervisor or Crew Lead closed
out the related parts request.
We verified that the listed
employee on the parts request
was not a Fleet Supervisor or
Crew Lead via the Fleet Crew
Organizational Chart. Without
an independent supervisor
review, there is a risk that parts
could be misappropriated and
not be identified.
The City should develop a process
to ensure that only Fleet Supervisors
or Crew Leads are reviewing and
closing out work orders and parts
requests. The review and close-out
process should help to ensure that
the close-out records are complete.
Having an independent final review
and close-out of work orders and
parts requests will help to instill
segregation of duties, which will help
to protect against potential asset
loss or theft.
The City should consider whether it
can restrict access within the
AssetWorks system for only Fleet
Supervisors or Crew Leads to have
the ability to close work orders and
parts requests.
High Moderate
C. IT General Controls
1 IT assets are properly
disposed of.
The City provided a listing of
the IT assets that were
inventoried for destruction, and
the listing contained evidence
that the City documented the
date the items were picked up
by California Electronic Asset
Recovery (CEAR) for
destruction. However, there
was no corresponding
destruction receipt from CEAR,
which documents the specific IT
assets that were picked up and
subsequently destroyed.
For all IT asset destructions, the City
should request that CEAR provide a
listing of the specific assets that
were picked up and subsequently
destroyed. The destruction receipt
provides evidence that all identified
IT assets were picked up, and
subsequently destroyed, by CEAR
which helps increase accountability,
prevent misappropriation, and
ensure records of IT asset
destructions are complete. The City
should then designate an
independent employee to compare
the listing that was initially sent to
Moderate Moderate
#2..
- 15 -
Internal Controls Review Report | 9
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
CEAR prior to destruction and the
listing that CEAR provides to the
City after destruction to verify that
the listings reconcile (i.e., all IT
assets were provided to CEAR and
destroyed).
2 Daily activity log reviews
are completed, and a
confirmation of completion
is emailed to the IT
Supervisor.
The daily activity log reviews
are intended to identify any
security anomalies, such as an
unauthorized individual trying to
gain access to the City’s
network. Based on interviews,
the daily activity log reviews are
being conducted by IT;
however, there is no
documentation or evidence to
verify that it is being completed.
The City should develop a process
that requires the IT staff member
conducting the daily activity log
review to document its completion
by emailing a confirmation to the IT
Supervisor. The IT Supervisor
should expect this daily email and
contact the IT staff member with any
questions or concerns about that
day’s activity log.
High Low
D. Payroll and Timekeeping
1 Access to adjust paid time
off (PTO) accrual rates is
appropriately restricted
and adjustments to
accrual rates are properly
monitored. In addition,
there is not a defined
process for monitoring
PTO balance adjustments.
The City provides access to all
Payroll employees to change
PTO accrual rates, and there is
not a defined process for a
designated employee to monitor
PTO accrual rates, and
adjustments to those rates, to
ensure that they are
appropriate.
The City should designate a singular
Payroll employee and a secondary
Payroll employee as a backup, if the
employee is unavailable, to have
access to and be responsible for
changing PTO accrual rates.
Restricting access to change these
rates will help to prevent any
unauthorized changes. The City
should review these access levels
regularly, as needed but at least
annually, to ensure they are updated
based on personnel changes or
employee role changes that occur.
As an additional control, the City
should designate a separate
Moderate Low
#2..
- 16 -
Internal Controls Review Report | 10
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
employee to monitor PTO balance
adjustments to ensure that all PTO
changes are appropriate and
properly supported. This review
should be completed once a month
based on the number of PTO
balance adjustments made. The
employee should communicate any
unusual or unsupported PTO
balance adjustments to the HR
Director.
2 PTO accrual rate changes
are monitored and
reviewed by both the
Finance Director and HR
Department.
During our review of the email
correspondence for the Accrual
Rounding for 2024 - 27 Pay
Period, we noted that the HR
Department was not involved in
the correspondence, nor did
they provide a review and
approval of the changes. HR’s
review and approval helps to
ensure that the City is following
current labor regulations.
The City should review its current
PTO accrual change policies and
procedures to ensure that, along
with the Finance Director, the HR
Department is involved with the PTO
accrual change process based on
their extensive knowledge of labor
regulations. Including the HR
Department in these reviews will
help align the City with any changes
to labor regulations that may occur
throughout the year. The HR
Department should designate at
least one individual to monitor and
review PTO accrual rate changes
and document any decisions made
via email.
High Moderate
3 The annual negotiated
salary increase is properly
documented, reviewed,
and approved and the
overall process is
supported by standard
operating procedures
Based on interviews performed,
the HR Department does not
have documentation to
evidence that the annual
negotiated salary increase
review was completed, as this
was done via email and the
related emails were not
The City should update the Across
the Board Increase SOP to ensure
that evidence of this process is
documented and retained for no less
than four years based on the statute
of limitations for legal actions related
to wage and hour claims set by
California through California Labor
High Moderate
#2..
- 17 -
Internal Controls Review Report | 11
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
(SOP) that address
required documentation.
retained. Based on a review of
the City's Across the Board
Increase SOP, the annual
negotiated salary increase
review process must be
documented and that
documentation must be
retained.
Code section 1194. The HR
Department should also develop an
internal process, which includes
defined roles and responsibilities, for
ensuring that all email
correspondence related to the
annual negotiated salary increase
review process is retained. The City
could also consider documenting
this annual review in a form or
memo format, as opposed to email,
to better reduce the risk of
unauthorized changes or any
version control issues that might be
more difficult to address via email.
This form or memo should then be
signed by all parties involved in the
review process to document their
participation in the review and
approval of the resulting salary
increase.
4 Formal policies and
procedures for a City-wide
vacation request process
are well-documented and
current.
Time Off Request Forms are
required for employees
submitting vacation requests,
but there are no formal Citywide policies or procedures that departments are required to
follow to standardize the
process.
The City Manager should use the
Personnel Rules Number 13.4 to
establish a formal City-wide vacation
request policy and procedure for all
City departments that will outline a
formal vacation request process to
require employees to submit a Time
Off Request Form. This policy and
procedure should include:
● The timing of when employees
should submit these requests
(i.e., at least two weeks prior to
the requested time off)
● The preferred method that
employees should submit these
Moderate Low
#2..
- 18 -
Internal Controls Review Report | 12
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
forms to their supervisor (i.e., via
email)
● How the supervisor will review
and approve the forms
● Who will maintain these
approved forms and how they
should be maintained (in case
the Payroll Team or HR
Department requests to see the
approved forms)
5 Access to electronic
Payroll Team forms is
monitored, reviewed, and
updated as needed.
Based on a comparison of the
Payroll organization chart to the
employees listed within the
Electronic Payroll Form Access
List, there were some
employees who had access that
were not part of the Payroll
Team and should not have
access to these sensitive
payroll forms. Unauthorized
access to payroll forms, such as
salary information or other
personnel information, could
subject the City to data privacy
concerns.
The City should develop a process
to ensure that access permissions
for the electronic payroll forms is
reviewed regularly, at least annually
and when personnel changes occur.
The City should also remove any
unauthorized employees from
accessing these forms to ensure
that the electronic payroll forms are
only accessible by employees
whose job requires this access.
Moderate High
E. Purchasing and Accounts Payable
1 P-Card requestors
complete the mandatory
training and sign the PCard Agreement before
receiving access to a PCard.
In our assessment of the
supporting documentation for a
sample of P-Card holders, we
identified one employee that did
not have a signed P-Card
Agreement on file and did not
complete the required training,
but received their P-Card. The
required training ensures that
The City should develop SOPs
detailing how Administrative
Directive 7.27 Procurement Card
Policies and Procedures will be
enforced including a defined
process, and related roles and
responsibilities, for ensuring that all
employees complete the required
training and sign the P-Card
Moderate High
#2..
- 19 -
Internal Controls Review Report | 13
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
employees understand their
role, and related
responsibilities, in utilizing a
City-issued P-Card and the PCard Agreement documents the employee's understanding and
agreement to the terms of use.
Agreement Form prior to receiving a
City-issued P-Card.
The P-Card program administrators
should develop processes to
designate:
● Who will send out the P-Card
Agreement to the employee
● Who will track the incoming
signed agreements
● Who will retain signed
agreements and where they will
be retained
● Who will track which employees
have completed the required
training and how they will track
this
● Who will verify that the employee
has a signed agreement on file
and has completed the required
training prior to handing over the
P-Card
2 The annual review of an
Open Encumbrance
Report is signed and
dated by the Finance
Director, Budget Manager,
and City Manager.
The Finance Director, Budget
Manager, and City Manager will
review an Open Encumbrance
Report prior to year-end close
so that any issues with
purchase orders can be
resolved before the close of the
year. There was a meeting
invite showing that these three
employees met to discuss this
topic; however, there was no
documentation that the review
occurred and what procedures
were performed, such as
The City should develop a process
to document the annual Open
Encumbrance Report review that is
performed by the Finance Director,
Budget Manager, and City Manager.
Documentation should include when
the review was performed, who
participated in the review, any
research performed for identified
issues and the resolution of those
issues. Adding this formal
documentation of the review process
helps to verify that:
High Low
#2..
- 20 -
Internal Controls Review Report | 14
FOR INTERNAL USE OF CITY OF MODESTO ONLY
NO. CONTROL OBJECTIVE CONTROL ISSUE RECOMMENDATION
LIKELIHOOD OF
OCCURRENCE
IMPACT OF
OCCURRENCE
reviewing for purchase orders
that should be closed and
researching and resolving any
identified issues.
● This Open Encumbrance Report
review took place
● The Open Encumbrance Report
review was satisfactory
● Any action items from this review
can be carried out efficiently and
effectively
F. Revenue and Billing
1 Monthly accounts
receivable reconciliations
contain documentation of
who performed the
reconciliation and when it
was performed.
Based on a review of the
supporting documentation for
three monthly accounts
receivable reconciliations, it was
evident that the reconciliations
occurred; however, there was
no documentation of who
completed the reconciliation
and when it was performed.
The City should develop a process
that will require the employee
conducting the monthly accounts
receivable reconciliation to
document its completion, which
could be via system signoff, email to
their supervisor, or physical
signature. The employee should
also ensure to note the date that
they completed the reconciliation to
demonstrate that they completed the
reconciliation timely, which should
be within about 30 days of monthend.
The City should also ensure that the
appropriate supervisor reviews and
approves this monthly reconciliation.
Documentation of approval should
be made via system signoff, email,
or physical signature. This approval
signifies that the supervisor agrees
that the reconciliation is appropriate
and that any item warranting followup discussion have been addressed and documented within the
reconciliation.
High Low
#2..
- 21 -
#2..
- 22 -
City of Modesto
Internal Controls Review Presentation
Audit Committee Meeting
April 24, 2024
#2..
- 23 -
This internal controls review was designed to identify key controls across various City functions and to compare to best practices and increase the efficiency and effectiveness of the City’s operations in the following areas:
Scope and Purpose
Accounts Receivable IT General Controls
Cash Management Overall Control Environment
Financial Reporting, Close, &
Reconciliations
Payroll & Timekeeping
Fixed Assets & Asset Management Purchasing & Accounts Payable Inventory Revenue & Billing
#2..
- 24 -
• Identified control objectives in specific areas and controls that would satisfy each control objective
• Reviewed policies and procedures (P&Ps)
• Examined relevant documentation in support of select key controls • Performed control walkthroughs to observe the design of key controls and understand workflow processes
• Obtained an understanding of the characteristics of each relevant control activity (who performs it, how often it is designed to operate, whether it is designed to mitigate fraud, whether it is a manual or automated control, and whether it is a preventive, detective, or corrective control) • Provided recommendations on key controls that need to be implemented or changed Methodology
3 #2..
- 25 -
• Controls across most sections were generally designed well and properly implemented
• There were opportunities to better document the processes and controls in place via policy and procedure documents.
• Employees across departments were willing to make changes to better protect City assets and better document current processes.
Themes
4 #2..
- 26 -
Questions/Discussion
5 #2..
- 27 -
The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind, including, without limitation, legal, accounting, or investment advice. This information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant-client relationship. Although this information may have been prepared by professionals, it should not be used as a substitute for professional services. If legal, accounting, investment, or other professional advice is required, the services of a professional should be sought.
Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory offered through Moss Adams Wealth Advisors LLC. Investment banking offered through Moss Adams Capital LLC.
6 #2..
- 28 -
CITY OF MODESTO
Risk Management Overview
April 2024
#3..
- 29 -
Agenda
2 01 Defining Risks
02 Enterprise Risk Management
03 Questions
#3..
- 30 -
Defining Risks
3 #3..
- 31 -
What is a risk?
4 Risk can be defined as the probability of an event occurring and the potential impact or consequence it may have on the City’s objectives.
In simpler terms, it's the possibility of something going wrong and the potential harm it could cause.
#3..
- 32 -
What makes a
risk more or
less critical?
5 IMPACT
Level of potential impact of a
negative event on strategy, people,
operations, systems, and
resources
LIKELIHOOD
Probability of a negative event
occurring, given the current risk
conditions
PREPAREDNESS
Level of preparedness through
activities and resources to manage
risks and minimize and limit
potential losses
TRAJECTORY Trajectory of the risk level, given
the current risk conditions
#3..
- 33 -
What types of
risk does the
City face?
6 • Financial Risk: Events that could cause an organization to lose money or financial value.
• Operational Risk: Events that could block the
organization’s ability to achieve its mission due to
insufficient or failed human resources, IT systems,
policies, or procedures.
• Management/Governance Risk: Events that could
impact effective management or compliance with legal,
tax, or good governance practices.
• Reputational Risk: Events that could cause an
organization to experience negative community
perception, loss of trust, or controversy.
• External Risk: Events including natural disasters,
legislative changes, economic impacts, or other external conditions that can block the organization’s ability to achieve its mission.
#3..
- 34 -
General City
Risk Categories
7 • Financial Risks • Accounting and Finance • Funding and Economics • Internal Controls • Procurement and Contracting • Management/Governance Risks • Compliance and Financial Reporting • Ethics, Fraud, Waste, and Abuse • Governance • Management • Planning and Strategy • Risk Management • Operational Risks • Human Resources • Information Technology • Infrastructure and Asset Management • Operations and Service Delivery • Organization Structure and Staffing • Policies and Procedures • Public Safety • Reputational • Reputation and Public Perception • External Risks #3..
- 35 -
Enterprise Risk Management
8 #3..
- 36 -
Enterprise
Risk
Management
9 At its core, Enterprise Risk Management (ERM) is
about developing a better understanding of the
risks your organization faces and having a
sustainable and repeatable process to
successfully monitor or mitigate them.
The term ERM can be thought of as the steps an
organization takes to maximize the likelihood of
achieving its desired impact.
#3..
- 37 -
Enterprise
Risk
Management
10 Most ERM activities are:
• Designed to identify potential events that can
impact the organization and manage related risks
• An ongoing process that flows throughout an
organization
• Impacted by people at every level within an
organization
• Geared to support the organization’s objectives–it’s
a means to an end, not an end in itself
#3..
- 38 -
ERM Goals
11 Legal Compliance
Ensuring
Financial
Health
Safety and
Security
Ensuring
Services
#3..
- 39 -
ERM Lifecycle
12 • Identify: Identify and prioritize risks.
• Assess: Assess the key causes and
consequences of the identified risks.
• Respond: Choose risk response,
mitigation, and management strategies.
• Monitor & Report: Monitor the risks and
report on status.
Identify
Assess
Respond
Monitor
&
Report
#3..
- 40 -
Audit
Committee
Role
13 Audit Committees play an important role in the ERM
lifecycle.
• Identify: ACs work with the internal audit team to
identify risks (typically through enterprise risk
assessments and other audits).
• Assess: ACs help to shape the internal audit
program and review audit reports that assess
various risks.
• Respond: ACs can make recommendations to City
leadership on needed action steps to mitigate risks.
• Monitor and Report: ACs oversee the ongoing
monitoring of risks and progress on mitigation
strategies.
#3..
- 41 -
The purpose of the Audit Committee is to advise the City Council on items related to the work of the City Auditor and the City's financial statement audits. Among other duties, the Audit Committee shall:
1. Review the Auditor's audit plan annually and submit annually to the City Council;
2. Provide suggestions and comments for the annual audit plan;
3. Review and consult with the Auditor on quarterly reports or updates of the City Auditor's activities and findings;
4. Report irregularities raised by the Auditor to the City Council;
5. Ensure that audit reports are transmitted to the legislative body and to the public;
6. Monitor follow-up on reported findings to assure corrective action is taken by management;
7. Report to the legislative body on problems or problem areas at such times as deemed appropriate
8. Provide input on, and participate in, the selection of the firm conducting the annual financial statement audits; and
9. Review and forward to the City Council materials related to the City's annual financial statement audit Modesto Audit Committee Purpose and Duties
14 City of Modesto: Internal Audit Overview
#3..
- 42 -
Implementing Risk Mitigation Strategies
15 City
Council
Management
Management and Staff
Opportunities to reduce
risks and improve
performance exist at each
level of the organization
Operational decision-making and direction,
workplace culture
Strategic decision-making and
direction, financial oversight, ethics
Tactical implementation, service
delivery, processes
#3..
- 43 -
16 #3..
- 44 -
The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind, including, without limitation, legal, accounting, or investment advice. This information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant-client relationship. Although this information may have been prepared by professionals, it should not be used as a substitute for professional services. If legal, accounting, investment, or other professional advice is required, the services of a professional should be sought.
Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory offered through Moss Adams Wealth Advisors LLC. ©2021 Moss Adams LLP
17 #3..
- 45 -