Audit Status Report - as of
September 30, 2023
City Auditor’s Office
2023 Audit Status Report
As of September 30, 2023
OVERVIEW
The mission of the City Auditor’s Office is to promote honest, efficient, effective, and fully accountable city government through accurate, independent, and objective audits. We conduct performance audits and reviews of City departments, programs, and services. We provide oversight of external auditors regarding the City’s annual financial audit, single audit, annual compliance review with the City’s Investment Policy, performance audits and related financial audits.
The Audit Committee and City Council approve a flexible annual Audit Work Plan with a risk- based methodology. The most recent Audit Workplan Report was delivered to the Audit Committee in March of 2023 and was accepted by City Council in June of 2023. The Auditor’s Office began working with consultant Baker Tilly, Inc. on the projects approved by the Committee and continued to finalize outstanding projects from the previous workplan.
Listed below are activity highlights from the audit work plan during the reporting period. The 2023 update to the risk assessment is currently underway and when completed, those results will be presented to the committee with the goal of identifying future audit projects as well as make any necessary revisions to previously suggested projects. The audit work plan is a flexible process that may recommend projects based on the results of the annual risk assessment or other projects that the committee would like to recommend. The Audit Committee has the discretion to propose changes to the plan as it deems necessary.
This Audit Status Report summarizes the standing of items from the previously approved Annual Audit Workplan and includes other items that have been proposed for review.
ACTIVITY HIGHLIGHTS – PERIOD ENDING SEPTEMBER 30, 2023:
Completed the City’s first annual risk assessment and provided recommendations to the committee to prioritize the audit work plan. The annual work plan is designed to improve the effectiveness of risk management, internal controls, and governance processes. Completed a review of past Stadium Authority Construction Fund and Public Safety transactions during the time of stadium construction.
Completed an analysis of the revenue and expense classification and review of the completeness of the supporting documents for the 2019 College Football Playoff game. Completed a review of the year-end net income for Non-NFL events for fiscal years 2018, 2019, and 2020 to identify any differences in overall net income versus the sum of net income for individual events, while also determining if revenues and expenditures for each event were recorded accurately.
Continued detailed monitoring of all City expenses related to Accounts Payable, Payroll, Purchase Card Charges, and employee travel and MOU reimbursements to ensure proper supporting documentation and approvals by management.
2023 Audit Status Report - As of September 30, 2023 (continued)
ASSIGNMENTS COMPLETED SINCE PREVIOUS STATUS REPORT
The following table lists completed assignments from the previous Audit Work Plan:
Project Name Project Description Start
Date
(1) Status
Issuance /
Completion
Date
1. Annual External
Financial Audit and
Single Audit for the City
(contracted audit service)
The City Charter requires an annual external audit of the City’s financial transactions to be performed by an
independent certified public accountant. The City Auditor’s Office administers the audit contract and works with the Finance Department and the external audit firm to
coordinate this effort.
July 2022 Completed December 2022
2. Annual External
Financial Audit for the
Stadium Authority
(contracted audit service)
The Santa Clara Stadium Authority (Stadium Authority),
the Stadium Funding Trust, and Goldman Sachs Bank
USA entered into a Credit Agreement on June 19, 2013 to finance the stadium. Section 5.1(a) of the Credit
Agreement requires that the Stadium Authority Annual
Financial Statements be audited by independent certified public accountants within 180 days after the end of each fiscal year. The City Auditor’s Office administers the audit contract and works with the Finance Department and the
external audit firm to coordinate this effort.
March 2023 Completed September 2023
3. Review of Financial
Procedures and Controls
for the Santa Clara
Stadium Authority
(contracted service)
Review past Construction Fund and Public Safety
transactions and provide feedback on the allocation of
staff charges. Contracted to JS Held. This report was presented to the City Council on September 26, 2023.
June 2023 Completed December 2022
2023 Audit Status Report – As of September 30, 2023 (continued)
ASSIGNMENTS COMPLETED SINCE PREVIOUS STATUS REPORT (Cont.)
Project Name Project Description Start
Date(1) Status
Issuance /
Completion
Date
4. Audit of the 2019
College Football Playoff
National Championship
Game (Contracted audit
service)
An analysis of the revenue and expense classification and review of the completeness of the supporting documents
for the 2019 College Football Playoff game. Contracted to The PUN Group. This had been delayed due to a need for
a non-disclosure agreement between MANCO and The
PUN Group as well as contractual and PUN Group staffing issues that had to be addressed with the time extension of the PUN Group contract.
June 2021 Completed June 2023
5. Review of SCSA net
income related to Non-
NFL events. (Contracted
audit service)
The City Auditor’s Office originally contracted with JS Held to perform a review of the year-end net income for Non- NFL events for an initial three-year period (2015, 2016, 2017). Amendment #3 of this contract was been
approved to allow for additional reviews of fiscal years 2018, 2019, and 2020. The review is to identify reasons for the differences in overall net income versus the sum of net income for individual events, while also determining if revenues and expenditures for each event were recorded
accurately. This report was presented to the Stadium
Authority Board on September 26, 2023.
June 2021 Completed May 2023
6. Annual Risk
Assessment and
Development of Internal
Audit Annual Workplan -
Year 1
The City Auditor’s Office is to perform an annual risk
assessment as required by internal audit standards to
identify and prioritize the potential audit subjects for the Audit Work Plan. The annual work plan is designed to
improve the effectiveness of risk management, internal
controls, and governance processes. The City contracted with Baker Tilly, Inc. to perform the risk assessment for a period of five years. They are a nationally respected firm with many municipal internal audit clients. The Year 1 risk assessment and audit work plan was accepted by the City Council on June 27, 2023.
June 2021 Completed February 2023
2023 Audit Status Report – As of September 30, 2023 (continued)
ASSIGNMENTS COMPLETED SINCE PREVIOUS STATUS REPORT (Cont.)
Project Name Project Description Start
Date(1) Status
Issuance /
Completion
Date
7. Semi-Annual Audit
Status Report
The City Auditor’s Office prepares and issues semi-annual status and progress update reports on the approved audit assignments in the audit work plan. The staff also reports on any changes (e.g. assignment addition or deletion) to the audit work plan.
June 2021 Completed March &
November 2023
ASSIGNMENTS IN PROCESS:
The following table lists all Assignments in Process from the previous Audit Work Plan Project Name Project Description Start
Date
(1) Status
Issuance /
Completion
Date
8. Annual Audit
Recommendation Status
Report
The City Auditor’s Office tracks audit recommendations
and issues reports on the implementation status of all
open audit recommendations. The staff also meets with
the auditee to discuss the progress of the audit
recommendations.
June 2021 In Process March 2024
9. City Auditor’s Cash
Disbursement Audit
The City Charter requires the City Auditor to audit and approve bills, invoices, payrolls, demands or charges
against the City before payment.
June 2021 In Process Ongoing
10. Annual Risk
Assessment and
Development of Internal
Audit Annual Workplan -
Year 2
The City Auditor is responsible for developing an annual internal audit work plan based on the results of an annual citywide risk assessment designed to improve the
effectiveness of risk management, internal control, and governance processes. We are currently in the process of the 2nd year assessment. The updated annual work plan
will be presented to the Audit Committee to recommend to the City Council for approval, which is required prior to the start of any audit work.
October 2023 In Process January 2024
2023 Audit Status Report – As of September 30, 2023 (continued)
ASSIGNMENTS IN PROCESS (Cont.):
Project Name Project Description Start
Date(1) Status
Issuance /
Completion
Date
11. Annual Continuing
Education Training
The City Auditor’s Office attends regular continuing
professional education training and maintaining a
minimum of 40 CPE hours a year for each staff. Audit
staff is attending online trainings for cost effectiveness.
June 2021 In Process Ongoing
12. Review of Silicon
Valley Power (SVP)
Power Purchase
Agreements (Co-sourced
audit process)
The City has contracted Baker Tilly, Inc. to conduct an assessment of the process for evaluating and entering into power purchase agreements as well as assess the
effectiveness of the internal controls in place that oversee the terms and conditions of the agreements.
June 2023 In Process January 2024
13. Review of the City’s
Building Permit Process
in Community
Development (Co-
sourced audit process).
Baker Tilly, Inc. is leading the audit as it related to internal controls to ensure compliance with industry best practices related to rules and regulations. The audit will assess the efficiency and effectiveness of the City’s building permit process from application to issuance and follow up with applicants throughout the process.
June 2023 In Process January 2024
ASSIGNMENTS NOT YET STARTED:
The following table lists all Assignments Not Yet Started as of September 30, 2023 for the current Audit Work Plan:
Project Name Project Description Start
Date
(1) Status
Issuance /
Completion
Date
14. Cybersecurity
Assessment of City and
SVP Information
Technology (Contracted
Service)
Identify risks related to weaknesses in City and SVP
cybersecurity programs. Map current state security
capabilities to industry specific cybersecurity frameworks and evaluate the maturity of current security processes.
June 2023 Postponed (2) TBD
2023 Audit Status Report – As of September 30, 2023 (continued)
ASSIGNMENTS NOT YET STARTED (Cont.):
Project Name Project Description Start
Date(1) Status
Issuance /
Completion
Date
15. City Property
Management Function
(Co-sourced audit
process)
Evaluate the efficiency and effectiveness of the City’s property management.
June 2023 Postponed (3) TBD
16. Review of FMS
Financial Procedures
and Controls for the
Santa Clara Stadium
Authority (contracted
service)
Staff has asked the City Auditor’s Office to provide advice on policies, procedural and internal control issues for the Stadium Authority. Proposed reviews include:
ꞏ Analyzing the Stadium Authority’s review procedures for Non-NFL Event revenues and provide feedback on
procedure and control issues, if any.
ꞏ Reviewing the Stadium Authority Financial Reporting Policy with staff and external auditors and providing
feedback on best practices.
June 2021 Pending - Will be
scoped with
proposed next
phase of Non-NFL
event review
June 2024
17. Performance Audit
of Vendor Master File
and 1099 Reporting
The purpose of this audit is to assess and evaluate
whether the City has adequate controls regarding its
master vendor file setup and if the City is effectively monitoring and maintaining its vendor information.
This audit has been deferred due to conflicts of interest with current audit staff having been in accounting
operations. We plan to co-source this audit with an
external CPA firm.
June 2021 Pending - Per IIA
Standards, project
has to wait until at
least a year has
passed since audit
staff was previously
involved with
vendor
maintenance
June 2024
18. Citywide Fraud Risk
Assessment (contracted
service)
This is a citywide fraud risk assessment for all the
departments including utility departments. This is
separate from the annual Citywide risk assessment.
June 2021 Pending December 2024
2023 Audit Status Report – As of September 30, 2023 (continued)
ASSIGNMENTS NOT YET STARTED (Cont.):
Project Name Project Description Start
Date(1) Status
Issuance /
Completion
Date
19. Review of SCSA net
income related to Non-
NFL events. (Co-sourced
audit service)
The City Auditor’s Office will contract with JS Held to perform a review of the year-end net income for Non-NFL events for the next three-year period (2021, 2022, 2023) leveraging their previous fiscal year reviews. The review is to identify reasons for the differences in overall net income versus the sum of net income for individual
events, while also determining if there has been
improvement with the support of revenues and
expenditures for each event. Direction from City Council was to scope this project and return before approval of this project. This is anticipated to be scoped with the above project related to the analysis of the FMS at the stadium. The scope is currently being worked on.
September
2023
Pending June 2024
**See Footnotes on next page**
2023 Audit Status Report – As of September 30, 2023 (continued)
Notes:
(1) The start date column indicates the period where the project was either re-started from the original work plan (June 2021) after the Auditor’s Office was staffed again, or the date where new projects were added to the audit work plan.
(2) After the recommendation to the Audit Committee that IT Cybersecurity programs be audited; the Auditor’s Office has been made aware of audits that already occur by other agencies that may cover these topics already. In 2019, the City had an external auditor conduct an exhaustive cybersecurity audit and risk assessment of the City against the National Institute of Standards and Technology (NIST) framework and the risk register that resulted from that audit is regularly maintained and actively used by the IT department to manage cybersecurity risks. Additionally, subsequent to the acceptance of the work plan, the City was awarded Super Bowl 60 and FIFA World Cup. As part preparing for those high-profile events, the City is working with the Cybersecurity and Infrastructure Security Agency (CISA) and Department of Homeland Security (DHS) to audit our cyber readiness in preparation for these events. There will be audits associated with these events that cover the areas of interest that were identified in the initial risk assessment and these audits will be free of charge to the City. This work has already begun and will continue to ramp up as the events get closer.
(3) The Auditor’s Office is recommending a postponement of this project since the staff position for property management has been vacant for some time. Recommendation is to perform this audit in 2024 once the staff position has been filled and there is a City contact that can lead the audit.