Baker Tilly US, LLP, trading as Baker Tilly, is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. © 2022 Baker Tilly US, LLP.
Citywide Risk
Assessment and
Annual Internal
Audit Work Plan
February 3, 2023
2 2
I. Baker Tilly - Who We Are
II. Internal Audit’s Risk Assessment for
Audit Planning
III. Risk Assessment Methodology
IV. Risk Assessment Results
V. Proposed Audit Work Plan
Table of Contents
Baker Tilly -
Who We Are
4 At a glance
BAKER TILLY – WHO WE ARE
5 Engagement Management
BAKER TILLY – WHO WE ARE
Adriane D. McCoy, CIA, CGAP, CISA, CFSA, CFE,
CAMS, CSOE
Director, Public Sector Advisory
Adriane is a public sector services professional with more than 25 years of internal audit experience in state, local and federal government agencies. She serves as a trusted business partner to staff and management, consulting on ways to strengthen and improve operations to reduce risk and improve process
efficiencies. Adriane focuses on risk management, business processes and procedures, compliance, and operations.
6 Engagement Management
BAKER TILLY – WHO WE ARE
Chiemi Perry, CPA, CIA, CISA, CFE
Manager, Public Sector Advisory
Chiemi leverages 20+ years of experience to help state and local government agencies improve their processes and
controls efficiently and effectively to mitigate risks and comply with applicable contract terms, laws, and regulations.
Internal Audit’s
Risk Assessment
for Audit Planning
8 The Institute of Internal Auditors
https://www.theiia.org/en/standards/what-are-the-standards/definition-of-internal-audit/ Internal auditing is an independent, objective
assurance and consulting activity designed to add
value and improve an organization's operations. It
helps an organization accomplish its objectives by
bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management,
control, and governance processes.
9 Risk Assessment
INTERNAL AUDIT’S RISK ASSESSMENT FOR AUDIT PLANNING Risk – The possibility of an event or condition occurring
that will have an impact on
the ability of an organization
to achieve its objectives*
Purpose – To develop an
audit plan that assigns
internal audit resources to
the activities that add the
most value to an organization
Process - Identifying and
measuring risks associated
with the audit universe
Identify, measure, and
prioritize risk
Identify, measure, and
prioritize risk
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Identify, measure, and
prioritize risk
Allocate internal audit
resources
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Assess the progress against the
audit plan
Follow up on management’s
corrective actions
Communicate audit results
1.Risk Assessment
Plan and execute approved
audits
Monitor emerging risks
and changes in
organization and
environment
3.Engagement
Identify, measure, and
prioritize risk
Allocate internal audit
resources
2.Risk‐based
Audit Plan
4.Reporting
5.Follow‐Up
6.Monitoring
7.Assessment
Internal Auditing
Annual Cycle
Risk
Assessment
Methodology
11 Phase
RISK ASSESSMENT METHODOLOGY
12 Phase
RISK ASSESSMENT METHODOLOGY
13 Phase
RISK ASSESSMENT METHODOLOGY
14 Risk Factor - Impact
RISK ASSESSMENT METHODOLOGY
15 Risk Factor - Likelihood
RISK ASSESSMENT METHODOLOGY
16 Risk Factor – Likelihood
RISK ASSESSMENT METHODOLOGY
17 Risk Factor – Other
RISK ASSESSMENT METHODOLOGY
18 Audit Universe
RISK ASSESSMENT METHODOLOGY
19 Risk Matrix
RISK ASSESSMENT METHODOLOGY
Risk
Assessment
Results
21 Overall Risk Scoring Distribution
RISK ASSESSMENT RESULTS
22 Citywide Key Risk Areas
RISK ASSESSMENT RESULTS
• Strategic Workforce Planning
o Employee Recruitment & Retention
o Employee Turnover
• Budget and Financial Performance
o Revenue Generation
o Funding
• Compliance and Legal Risks
o Compliance with Laws, Regulations, and Contracts
o Litigation
• Organizational Governance
o Leadership
• Information Technology & Cybersecurity
23 City Department Risk Heat Map
RISK ASSESSMENT RESULTS
24 Department Key Risk Areas
RISK ASSESSMENT RESULTS
City Attorney’s Office
• Case management
• Conflict of interest monitoring
City Clerk’s Office
• Public Records Act compliance
• Records retention program
City Manager’s Office
• Property management
• Convention center operation
• Stadium operation
• Business continuity plan for the City
departments
Community Development Department
• Case management
• Conflict of interest monitoring
City Clerk’s Office
• Building permitting & inspection
• Housing inspection
• Development projects review
• Code enforcement
• Affordable housing program
Library Department
• Memorandum of Understanding with the
Santa Clara Library Foundation & Friends
• Fee collection
• Purchasing
25 Department Key Risk Areas
RISK ASSESSMENT RESULTS
Electronic Utility Department
• Power Purchase Agreements
• Renewable energy programs
• Procurement and contract management
• Work Order and Asset Management
• Cybersecurity
• Construction project controls
Finance Department
• Procurement Card Administration
• Vendor master file
• Timesheet processing
• Utility billing and collection process
• Investment management
• Warehouse/inventory management
Fire Department
• Overtime
• Field inspection services
•T r a i n i n g
• Emergency medical services
Human Resources Department
• Staff development and succession
planning for the City departments
• Workers' Compensation and Safety
• Employee records management
Parks and Recreation Department
• Park infrastructure
• Park revenue
26 Department Key Risk Areas
RISK ASSESSMENT RESULTS
Information Technology Department
• Cybersecurity Assessment
• Managed Service Provider (MSP)
contract management
• Application portfolio management
• Data management
Police Department
• Overtime
• Body-worn camera
• Use of force policies
• Evidence processing and storage
• Case management
Department of Public Works
• Construction project controls
• The Americans with Disabilities Act (ADA)
compliance
• Maintenance service requests
• Grant management
Water and Sewer Utilities Department
• Construction project controls
• Water conservation and sustainability programs
• Rate setting practices
• Work order and asset management
Proposed
Audit Work
Plan
28 Audit Project Selection
PROPOSED AUDIT WORK PLAN
• Selection based on some factors such as:
o Risk rating
o Pervasiveness of the process or control
o Audit coverage
o Timing of projects
o Value-added activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness • A variety of projects for a 24-month period
o Flexibility to adjust the timing of audits
o Amendments during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls 29 CAO Resources
PROPOSED AUDIT WORK PLAN
• Two full-time employees:
o Internal Audit Manager
o Staff member
• Limited capacity due to:
1. Santa Clara City Code Sec. 909 City Auditor
• The responsibility to “audit and approve all bills, invoices, payrolls, demands or charges against the City government before payment.”
2. Control activities performed in the operati onal/transactional process (Approval before payment) • Impairment to organizational independence and individual objectivity if the staff member performs an audit of the processes related to their approvals (Standard 1130 of the IIA Standards).
3. Supervisory responsibility of the Internal Audit Manager • Influence over the staff member who performs control activities • A need to perform control activity whenever the staff member cannot perform the approval and other related duties
• It is recommended that the City evaluate the current roles and responsibilities of the CAO and take the appropriate action(s) to ensure that the CAO will achieve its mission 30 Proposed 2023 Plan
PROPOSED AUDIT WORK PLAN
31 Proposed 2024 Plan
PROPOSED AUDIT WORK PLAN
Questions?