Cities Index.
Attachment A - COS Audit Findings Tracking Report 01-29-24

Council Audit Committee
January 29, 2024

Document
Attachment A - COS Audit Findings Tracking Report 01-29-24
Meeting
January 29, 2024
Body
Council Audit Committee
Original file
149 KB
Text extracted from the city's file for reading and search. Open the original on legistar1.granicus.com. That file is the official record.

City of Stockton - Audit Findings Tracking Report
1/12/2024
( A) ( B) ( C) ( D)
Reports
Total Findings
Open Findings
(Not Yet Completed by
City)
Validated Findings
(By Moss Adams)
Reportable Findings
(Newly validated since last
summary)
2011 Memorandum of Internal Control for CAFR (MOIC11 ) 38 1 37 0 2011 Single Audit (SA11 ) 5 0 5 0
2010 Single Audit (SA10 ) 8 0 8 0
2010 Report to Management (RMIC10 ) 3 0 3 0
Internal Audit 36 8 28 0
2002 Performance Audit - Administrative Directives (IA-AD ) 1 0 1 0 2007 Internal Control Evaluation - Stockton Events Center (IA-SEC ) 1 0 1 0 2008 Performance Audit - Library Fines and Fees (IA-LIB ) 1 0 1 0 2010 Compliance Audit - Election Costs (IA-EC ) 1 0 1 0 2010 Performance Audit - Fire Department Overtime Processing System (IA-FP ) 2 0 2 0 2012 Compliance Audit-ARRA Update (IA-ARRA ) 4 4 0 0
2012 Compliance Audit: Disbursements – Payment Authority (IA-PA ) 10 1 9 0 2012 Compliance Audit: Disbursements – Purchase Cards (IA-PC ) 5 0 5 0 2005 Performance Audit: City Clerk (IA-CC ) 1 0 1 0
2012 Performance Audit: Police Property Room (IA-PP ) 3 0 3 0 2012 Performance Audit: Fleet Utilization and Management (IA-FUM ) 7 3 4 0 2011 City of Stockton's Gas Tax Audit (SCOGT11 ) 3 0 3 0 2011 City of Stockton's Administrative and Accounting Controls Review (SCOIC11 ) 8 2 6 0 2011 City of Stockton's Redevelopment Agency Asset Transfer Review (SCORA11 ) 2 0 2 0 2014 City of Stockton's Crime Statistics Report for the Department of Justice Program (SCOCS14 ) 1 0 1 0 2012-2013 San Joaquin County Grand Jury Report, Case No. 0112 (SCGJ-112 ) 22 1 21 0 2012-2013 San Joaquin County Grand Jury Report, Case No. 0312 (SCGJ-312 ) 2 1 1 0 2012-2013 San Joaquin County Grand Jury Report, Case No. 0912 (SCGJ-912 ) 4 0 4 0 2012-2013 San Joaquin County Grand Jury Report, Case No. 1112 (SCGJ-1112 ) 1 0 1 0 2012-2013 San Joaquin County Grand Jury Report, Law and Justice Report (SCGJ-LAW ) 1 0 1 0 2013-2014 San Joaquin County Grand Jury Report, Stockton City Council and The Brown Act (SCGJ-BRN ) 14 2 12 0 2013-2014 San Joaquin County Grand Jury Report, Case No. 1613 (SCGJ-1613 ) 2 0 2 0 2013 Internal Controls Review (Enterprise Risk Assessment) (MA-ICR ) 70 12 58 3 2014 Internal Audit of Revenue and Cash Operations (MA-REV ) 18 2 16 0 2014 Internal Audit of IT General Controls (MA-IT ) 20 7 13 0 2014 Internal Audit of Payroll Operations (MA-PAY ) 12 2 10 0 2014 Internal Audit of Accounts Payable and Procurement Internal Controls (MA-AP/PUR ) 10 0 10 0 2015 Internal Audit of Monthly Close Process (MA-MON ) 4 0 4 0 2015 Internal Audit of Grants Management (MA-GRANT ) 3 3 0 0 2017 Internal Controls Testing: Cash Handling (MA-CASH ) 18 2 16 5 2017 Internal Controls Testing: Month End Close and Reconciliation Process (MA-MONIC ) 13 3 10 0 2017 Internal Controls Testing: Grants Management and Administration (MA-17GRANT ) 15 9 6 0 2017 Internal Controls Testing: Payroll and Timekeeping (MA-17PAY ) 15 5 10 0 2017 Internal Controls Testing: Superion Access (MA-17IT ) 4 1 3 0 2017 Internal Controls Testing: Purchasing and AP (MA-17PUR ) 16 4 12 0 2018 Internal Controls Testing: Travel Expenses (MA-18TRVL ) 4 0 4 0 2020 Venue Management Performance Audit (MA-20VMGT ) 15 15 0 0 2020 Internal Controls Testing: Purchasing Card (MA-20PCRD ) 5 3 2 0 2012 SAS 115 - Internal Controls Identified in an Audit (12 SAS115 ) 11 0 11 0 2012 Single Audit Report (SA12 ) 6 2 4 0
2013 SAS 115 - Internal Controls Identified in an Audit (13 SAS115 ) 9 0 9 0 2013 Single Audit Report (SA13 ) 3 0 3 0
2014 Single Audit Report (SA14) 2 0 2 0
2014 SAS 115 - Internal Controls Identified in an Audit (14SAS115 ) 6 0 6 0 2015 SAS 115 - Internal Controls Identified in an Audit (15SAS115 ) 4 0 4 0 2015 Single Audit Report (SA15 ) 2 0 2 0
2016 SAS 114 - Report on Internal Control Related Matters Identified in the Audit (16SAS114 ) 4 1 3 0 2017 Single Audit (SA17 ) 6 0 6 0
2017 SAS 115 - Report on Internal Control Related Matters Idenfitied in the Audit (17SAS115 ) 4 0 4 0 2018 SAS 115 - Report on Internal Control Related Matters Identified in the Audit (18SAS115 ) 2 0 2 0 2016 Public Agency Review (16PAR) 1 1 0 0
2012 Independent Accountant's Report on RDA Dissolution - Agreed Upon Procedures Engagement (RDA-AUP ) 5 1 4 0 2022 Internal Controls Testing: Inventory (MA-22INV ) 6 6 0 0 2021 SAS 115 - Report on Internal Control Related Matters Identified in the Audit (21SAS115 ) 1 0 1 0 2022 SAS 115 - Report on Internal Control Related Matters Identified in the Audit 1 1 0 0 2023 Single Audit Report 6 6 0 0
Total 471 101 370 8
Legend:

Reports = report name
Reporting Entity = organization that prepared the report Total Findings = number of findings in the report
Open Findings = number of findings not yet completed by City Completed Findings = number of findings completed by City, both and not yet validated Validated Findings = number of findings validated by Moss Adams as completed and adequately addresses the finding Reportable Findings=number of findings validated since last summary report for Audit Committee report Relationships between Columns
Total Findings: Column (A) = Column ( B ) + Column ( C) Open Findings: Column (B)
Completed Findings: Column (C) = Column ( A ) - (B)
Validated Findings: Column (D) (subset of (C) Completed Findings) Reportable Findings: Column (E) (subset of (D) Validated Findings) Item
No.

Findin
g No.

Report
Code
Report
Date
Finding Recommendation
Responsible
Dept(s)
Moss Adams Determination
173 E-12 MA-ICR 8/19/2013
Safety/protection measures are not adequate to ensure persons physically making or handling cash deposits at locations are physically protected.

Safe conditions exist for transport of money between locations.

Consider reviewing and refreshing the security protocols for transporting money from departments to the central Treasury.

ASD
Revenue
Closed with the approved of
the Cash Handling Policy.
178 F-3 MA-ICR 8/19/2013
Billing adjustments should be approved by someone who is not responsible for recording accounts receivables or cash receipts.

Review access rights for recording adjustments and implement changes to system access levels so employees who handle cash receipts do not have access to adjust accounts. Alternatively, implement mitigating controls that would detect unauthorized adjustments (e.g., review monthly report of all adjustments).

ASD
Revenue
Closed with the approved of
the Cash Handling Policy.
180 G-2 MA-ICR 8/19/2013
Billing adjustments should be approved by someone who is not responsible for recording accounts receivables or cash receipts.

Review access rights for recording adjustments and implement changes to system access levels so employees who handle cash receipts do not have access to adjust accounts. Alternatively, implement mitigating controls that would detect unauthorized adjustments (e.g., review monthly report of all adjustments).

ASD
Revenue
Closed with the approved of
the Cash Handling Policy.
341 1 MA-CASH 9/27/2016
Several departments lacked adequate physical security and restricted access to cash assets.

In some departments, employees left safes, cash drawers, and doors to restricted areas unlocked during business hours. At some locations, too many employees knew the safe combination or the combination had not recently been changed. Additionally, in some departments, undeposited cash was not stored securely during the business day or overnight.

Within Citywide policies and procedures, outline requirements for physical security at all locations that collect cash, as well as document minimum requirements and best practices. Certain locations should consider implementing the following improvements:
o For certain locations, that handle large volumes of check payments, explore the ability to process secure payments online or consider the adoption of a lockbox or check encoder to facilitate remote check deposits or alternatives that will decrease the time between receiving payment and processing applications.
o Certain locations require improved security compliance such as locking all doors to the employee area and locking the safe when not in use.

ASD:

Revenue
Closed with the approved of
the Cash Handling Policy.
347 7 MA-CASH 9/27/2016
The requirements regarding the inspection of counterfeit bills are not well- defined. According to the City of Stockton’s Cash Handling training materials, bills must be checked for evidence of counterfeit, using a counterfeit detector pen or black light device, but the denomination that must be inspected is not specified. In the absence of specificity, we found that departments vary in the denominations that they state they are testing.
1) Update the City’s cash handling policies and procedures to specify the denominations that must be checked for counterfeit.
2) Consider a sporadic ongoing monitoring effort or incentive to promote consistent counterfeit detection efforts.
3) Identify whether all cash handling locations have counterfeit detection pens and/or black light detection tools and provide these tools to locations that lack them and direct relevant staff to use them.

ASD:

Revenue;
Cash Dept's
Closed with the approved of
the Cash Handling Policy.
349 9 MA-CASH 9/27/2016
Not all cash handling locations are in compliance with the City’s cash handling training requirement. The City’s current cash handling policy does not specify the time within which employees need to complete training after assuming cash handling responsibilities.
1) Redistribute City’s cash handling policy to locations where cash is handled and reiterate the importance of cash handling training for all individuals who perform these duties including part-time employees and staff who are filling in for other employees. 2) Modify current policy language to clarify the timing within which cash handling training must be attended after employment or assuming cash handling responsibilities. 3) Increase monitoring of cash handling training attendance records to ensure ongoing compliance.

ASD:

Revenue;
Cash Dept's
Closed with the approved of
the Cash Handling Policy.
353 13 MA-CASH 9/27/2016
Individual accountability for cash handling is not in place. During our fieldwork we observed weaknesses in controls that help to ensure accountability for each individual involved in cash handling. Specifically, at three locations we observed staff members sharing cash drawers. When the cash received is co-mingled, it is difficult to determine the individual who was responsible if cash is short or does not reconcile. Additionally, there are no mitigating controls in place such as performing cash counts between shift changes. For example, at one location, we could not determine which of the four employees who handled cash throughout the day was responsible for the inaccurate payment information in the deposit we counted.
1) Update Citywide cash handling policies and procedures to establish minimum standards for individual accountability related to cash handling.
2) Implement individual cash drawers wherever possible. Where shared drawers continue to be used, develop a simple form, and require that each individual count the cash drawer contents at the end of each shift and have a secondary individual verify and sign.

ASD:

Revenue;
Cash Dept's
Closed with the approved of
the Cash Handling Policy.
354 14 MA-CASH 9/27/2016
The City lacks standards regarding the departments’ responsibilities for monitoring of cash handling and revenue collection. In particular, the City’s cash handling policies and procedures do not address minimum standards and expectations for monitoring cash handling and revenue collection.

Additionally, we observed that fee waivers are not currently monitored within the system used by one division. These weaknesses in monitoring present opportunities for fraud and limit employee accountability to uphold City policies.
1) In conjunction with other recommended changes to the cash handling policies, update the City’s cash handling policies and procedures to establish minimum standards and expectations for monitoring cash handling and revenue collection.
2) Assign roles and responsibilities for monitoring cash handling and revenue collection, particularly at remote locations. Once these expectations are established, they should be documented in department- specific policies and procedures.
3) Remind staff of the existing policy regarding the waiving of fees. On-site managers should be required to perform fee waiving monitoring and department managers should periodically verify compliance.

ASD:

Revenue;
Cash Dept's
Closed with the approved of
the Cash Handling Policy.

← All documents from this meeting