FINAL REPORT
City of Stockton
CITY WIDE INTERNAL CONTROLS REVIEW
April 10, 2024
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Attachment A
Citywide Internal Controls Review Report
FOR INTERNAL USE OF CITY OF S TOCKTON ONLY
Table of Contents
Executive Summary 1
A. Scope and Methodology 1
Background, Scope, and Methodology 3
A. Background 3
B. Scope and Methodology 3
Internal Controls Review 5
Attachment A
Citywide Internal Controls Review Report | 1
FOR INTERNAL USE OF CITY OF S TOCKTON ONLY
EXECUTIVE SUMMARY
The City of Stockton (the City) engaged its internal auditor, Moss Adams LLP (Moss Adams, we, our), to perform an evaluation of the City’s internal controls framework. The internal controls review took place between April 2023 and February 2024. There were multiple delays that occurred which caused the project duration to be longer than our initial expectation. The internal controls review focused on assessing select key controls in areas deemed important to protecting the City’s assets and resources and to processing and reporting timely financial information.
The review of internal controls was completed in accordance with Standards for Consulting Services established by the American Institute of Certified Public Accountants (AICPA). As such, this work was not an audit of internal controls that resulted in a formal opinion or other form of assurance.
We reviewed the City’s internal controls for design but did not test those controls for operating effectiveness. Specific areas where controls were reviewed included:
Accounts Receivable
Cash Management
Financial Reporting, Close, and Reconciliations
Fixed Assets and Asset Management
Inventory
IT General Controls
Overall Control Environment
Purchasing and Accounts Payable
Revenue and Billing
During the planning of this engagement, the City was in the process of implementing the new payroll enterprise resource system and internal controls around this area would be changing. As such, we did not review payroll internal controls, which should be reviewed at another time.
The City appeared to have internal controls developed for many functions and was in the process of implementing internal controls for other functions. Some examples of commendable activities include:
Monitoring and reconciliation controls related to:
○ Accounts Receivable
○ Cash Management
○ Financial Reporting, Close, and Reconciliations
○ Fixed Assets and Asset Management
○ Inventory
○ Purchasing and Accounts Payable
○ Revenue and Billing
Monthly and quarterly review of budgets by department supervisors Attachment A
Citywide Internal Controls Review Report | 2
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Monitoring IT service requests to mitigate the risk of requests being inactive Reviewing purchase card users and user activity
Similar to most cities, there is an opportunity to strengthen policies, procedures, systems, and training. Gaps in internal controls of varying degrees were discovered in several of the functions reviewed, especially in the case of decentralized operations.
The primary conclusion from this review is that the City has an opportunity to improve internal controls and strengthen processes and procedures. Suggested priorities to address over the next six to 12 months include, but are not limited to:
Accounts Receivable
○ Documenting reviews and approvals for reconciliations and aging reports ○ Updating policies and procedures
Financial Reporting, Close and Reconciliations
○ Timelier reviews for month-end, quarter-end, and year-end closing journal entries ○ Updating policies and procedures
Fixed Assets and Asset Management
○ Updating policies and procedures
Purchasing and Accounts Payable
○ Updating policies and procedures
Revenue and Billing
○ Reviewing and approving invoices before sending to customers Attachment A
Citywide Internal Controls Review Report | 3
FOR INTERNAL USE OF CITY OF S TOCKTON ONLY
BACKGROUND, SCOPE, AND METHODOLOGY
The City engaged its internal auditor, Moss Adams, to perform an evaluation of the City’s internal controls framework and to identify opportunities for improvement that exist across City functions. The last internal controls review for the City was performed during fiscal year 2017-2018, which included reviewing controls in the following areas:
Payroll and Timekeeping
Cash Handling
Procurement and Accounts Payable
Monthly Close and Reconciliation
In the 2017-2018 internal controls review, we identified significant gaps in internal controls for all four of the areas assessed including a lack of defined policies and procedures, lack of thorough reviews, and lack of documented approvals. Since the time of that review, the City's management has been committed to making improvements and instilling a strong internal controls environment including a focus on updating/expanding policies and procedures, implementing monitoring and reconciliation controls in key financial areas, and ensuring proper segregation of duties.
The scope of our review included a high-level evaluation of the City’s key internal controls to determine the general adequacy of enterprise internal controls and identify areas warranting more in-depth review in the future.
The scope of the internal controls review included the following functional areas:
Accounts Receivable
Cash Management
Financial Reporting, Close, and Reconciliations
Fixed Assets and Asset Management
Inventory
IT General Controls
Overall Control Environment
Purchasing and Accounts Payable
Revenue and Billing
For each functional area assessed, we conducted a review of key controls which included:
Identifying control objectives in specific areas and controls that would satisfy each control objective
Reviewing policies and procedures (P&Ps)
Examining relevant documentation in support of select key controls Attachment A
Citywide Internal Controls Review Report | 4
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Performing control walkthroughs to observe the design of key controls and understand workflow processes
Obtaining an understanding of the characteristics of each relevant control activity (who performs it, how often it is designed to operate, whether it is designed to mitigate the risk of fraud, whether it is a manual or programmed/automated control, and whether it is a preventive, detective, or corrective control)
Assessing whether the controls in place would prevent or detect errors Providing recommendations on key controls that need to be implemented or changed The work performed included interviews with personnel involved in managing functions, processing and approving key accounting transactions, and handling physical assets in the following departments:
Finance
Information Technology
In support of the internal controls review, the matrix provided in Section III provides results for each key functional area reviewed and presents the:
Control objective
Control issue
Corresponding recommendation
Likelihood of occurrence
Impact of occurrence
Likelihood of occurrence is defined as the probability of a negative event occurring. Impact of occurrence is defined as the level of significance if a negative event occurs. Risk levels of low, moderate, or high were used to rate the likelihood and impact of occurrence for each finding.
Beyond those controls that have been noted within this report as an issue, additional controls were reviewed without exception. It should be noted that many controls were reviewed multiple times in relevant, separate department reviews, but not all controls or departments were reviewed.
Departments were selected to provide a broad understanding of the City’s control environment. Key controls with exception conditions are reported in Section III of this report.
Attachment A
Citywide Internal Controls Review Report | 5
FOR INTERNAL USE OF CITY OF S TOCKTON ONLY
INTERNAL CONTROLS REVIEW
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
A. Accounts Receivable
1 The Revenue Supervisor
reviews and approves the A/R
aging schedule.
The annual aging schedule for the
period of July 1, 2022, through
June 30, 2023, was not formally
reviewed and approved, which could
lead to not identifying vendors with
overdue invoices that need to be
sent through the collections process.
A/R management should establish a
process to formally review and approve
A/R aging schedules. A formal approval
might be made via the City’s A/R system,
email, or physical sign-off.
The review should be detailed to identify
specific vendors that are late on
payment, to allow the City to easily
identify which invoices need to be sent to
collections.
Additionally, the City should consider
including a “comments” column in the
aging schedule to include any relevant
comments about past due balances (over
120 days) and any actions that are being
taken to address these outstanding
balances.
High Low
2 The City-wide P&Ps for billing
and collection of A/R are
well-documented and current.
The current A/R P&Ps are not
comprehensive or complete, as they
do not address all key functional
areas of the A/R process.
Specifically, the City's A/R P&Ps do
not address key areas recommended
by best practices including A/R
tracking and reporting, systems
access controls, allowance for
doubtful accounts and bad debt
management, or collection efforts
including handling of past
While the City does not appear to have
control issues for the A/R process aside
from the items above, it should formally
document these processes via a City-
wide P&P, which should be developed to
include items such as:
● A/R management, including A/R
tracking and reporting, aging analysis,
and reporting on delinquent accounts
● Systems access controls related to
A/R management systems, to ensure
proper segregation of duties
Moderate Moderate
Attachment A
Citywide Internal Controls Review Report | 6
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
due/delinquent accounts and write-
offs.
● Allowance for doubtful accounts
establishment, recording of bad debt
expenses, and criteria for estimate
development
● Handling refunds and account credits,
including required documentation and
approvals
● Guidance to departments for
developing their specific billing P&Ps,
to ensure consistency and enhance
revenue capture
● The criteria used to determine when a
past due/delinquent account will be
sent to a collection agency, and how
revenue-collecting service providers
will be engaged and monitored
● When account write-offs can occur,
what approvals are required, and how
write-offs/account adjustments must
be documented and controlled
Departments that are responsible for
collecting funds on the City's behalf
should have department-specific
procedures documented to ensure that
billing and collection activities are
performed consistently and in a
controlled manner.
B. Cash Management
1 Petty cash use aligns with
applicable City and
department-specific policies
and procedures.
The Police Department’s petty cash
use appears to be for expenses that
would typically be reimbursed to
employees via payroll instead of
reimbursed via cash.
We recommend the City review the
Police Department’s petty cash use to
determine if the petty cash fund is being
used as intended. Specifically, the City
should consider reimbursing employees
for expenses via payroll to limit the use of
petty cash. Considering the inherently
High Low
Attachment A
Citywide Internal Controls Review Report | 7
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
risky nature of cash, the petty cash fund
should only be used when necessary and
should only be used for small
transactions (typically less than $30 per
the Petty Cash Fund Procedures).
C. Financial Reporting, Close, and Reconciliations
1 Month-end, quarter-end, and
year-end closing journal entries
are reviewed and approved by
the Accounting Manager or
Accounting Supervisor.
Closing entries are entered and
approved in Tyler Munis; however,
the entry was not performed timely.
Specifically, following closing entries
were not entered timely:
● Journal Reference 47 for monthly
closure of Bankcard fees for
February 2023 had an entry date
of May 10, 2023.
● Journal Reference 6 for monthly
closure of sales tax on credit card
purchases for February 2023 had
an entry date of June 27, 2023.
The City should review the process for
entering closing entries to ensure entries
are able to be reviewed and approved
timely within the close of the reporting
period. Timely entries and approvals are
essential to promote the overall accuracy
of financial reporting and to ensure
management is aware of the City’s
financial position.
For month-end and quarterly close
entries, entries and approvals should
occur within approximately two weeks
from the end of the period depending on
when supporting documentation is
available, such as the monthly bank
statement.
For year-end close entries, approvals
should occur approximately three weeks
from the end of the period.
Moderate Moderate
2 Month-end, quarter-end, and
year-end journal entry logs are
complete, with details
supporting the closing entries.
Month-end, quarter-end, and
year-end journal entry logs are
completed; however, the level of
detail, justifying the purpose of each
closing entry, is not consistent. The
inconsistent detail might cause
confusion on the purpose of journal
entries that do not include the level of
detail that other journal entries do.
Journal entry reviewers should perform
thorough reviews of journal entry forms
and supporting documentation to ensure
the level of detail is sufficient to justify the
purpose of the closing entry. The reviews
should ensure the legends, notes, and
descriptions are consistently completed.
Low Low
Attachment A
Citywide Internal Controls Review Report | 8
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
3 The City-wide P&Ps for
financial reporting, close, and
reconciliation are
well-documented and current.
The current financial reporting, close,
and reconciliation P&Ps are not
comprehensive or complete, as they
do not address all key functional
areas of the financial reporting,
close, and reconciliation process.
Specifically, the City's financial
reporting, close, and reconciliation
P&Ps do not address key areas
recommended by best practices
including chart of accounts setup,
timelines and responsibilities for
month-end and year-end close,
financial monitoring and reviews, and
reconciliation processes.
While the City does not appear to have
control issues for the financial reporting,
close, and reconciliation process aside
from the items above, it should formally
document these processes via a City-
wide P&P, which should be developed to
include items such as:
● Chart of accounts setup and General
Ledger maintenance
● Fund accounting and reporting
● Cost allocation, classification, and
tracking
● Month-end and year-end detailed
closing procedures, including
timelines, responsibilities, and details
● Financial monitoring and reviews
● Reconciliations, including details on
specific accounts, variance analysis,
segregation of duties, responsibilities,
reviews, and approvals
● Financial reporting, including
frequency, trend analysis, City
Council reporting, and management
oversight
● Audit coordination and oversight, and
monitoring of findings
Moderate Moderate
D. Fixed Assets and Inventory
1 The Accounting Manager or
Accounting Supervisor reviews
and approves the fixed asset
reconciliation at year-end.
The City provided the capital asset
roll forward, which confirmed the
balance of asset categories;
however, it is not a complete listing
and inventory of all capitalized assets
across the City, which is what this
control pertains to. An asset count at
The City should update the fixed asset
reconciliation process to include a
detailed listing of all capitalized assets
inventoried, to help ensure asset
accuracy, asset condition, and
interdepartmental transparency. Some
Moderate Low
Attachment A
Citywide Internal Controls Review Report | 9
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
year-end serves to confirm the
assets that the City has on-hand as
well as the status and condition of
each asset.
Additionally, the fixed asset
reconciliation for the year ending
June 30, 2022 was not reviewed and
approved timely, as it was not
approved until January 23, 2023.
details to include in the listing are as
follows:
● Asset ID
● Purchase date
● Asset value
● Depreciation
● Status/condition
We recommend the City review the fixed
asset reconciliation process to ensure
timely review and approval at year-end.
2 The Accounting Supervisor
reviews and approves capital
asset disposals before sending
to City Council for final
approval.
The City provided City Council’s
approval to dispose of assets in
March 2023, but we did not observe
Accounting Supervisor review and
approval prior to sending to City
Council. Having the Accounting
Supervisor review and approve the
proposed disposals helps to verify
that the proper assets are listed and
are truthfully ready to be disposed.
The City should confirm each asset
disposal is reviewed and approved, prior
to submission to City Council.
Specifically, the Accounting Supervisor
should ensure the following for each
asset scheduled to be disposed of:
● Status in Tyler Munis
● Accurate depreciation
● Updated inventory
● Custody
While the City Council’s approval is
sufficient for the disposal, it does not
ensure that the proper assets have been
listed for disposal.
Low Moderate
3 The City-wide P&Ps for fixed
assets and asset management
are well-documented and
current.
The City’s Administrative Directive
for Asset Accountability – Capital
Assets has not been updated since
2007, which poses a risk that current
policies and/or procedures do not
match the outdated Administrative
Directive. In addition, the
Administrative Directive does not
The City should review the Administrative
Directive for Asset Accountability –
Capital Assets and make updates, as
needed, to reflect current policies and
procedures. Having an updated
Administrative Directive will help to
ensure that employees across
departments understand the basics of
High Moderate
Attachment A
Citywide Internal Controls Review Report | 10
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
address key areas of the capital
asset function.
capital asset management. While the City
does not appear to have control issues
for the fixed asset and inventory process
aside from the items above, it should
formally document these processes via a
City-wide P&P, which should be
developed to include items such as:
● Accounting and reporting fixed assets
(including vehicles, equipment,
property, and other fixed assets)
● Cost criterion
● Capitalization thresholds
● Depreciation
● Methods of disposition
● Transfers
● Idle and surplus assets
● Accountability for assets
● Repairs and maintenance
● Physical inventory procedures
● Fixed asset listing
E. IT General Controls
1 The City-wide P&Ps for IT asset
disposals are well-documented
and current.
The City does not currently have a
policy in place relating to disposing of
IT assets, although they are working
to create a policy for this area.
A defined policy will help formalize and
standardize these processes to allow for
safe and secure disposal of IT assets.
While the City does not appear to have
control issues for the IT disposal process,
it should formally document these
processes via a City-wide P&P, which
should be developed to include items
such as:
● Roles and responsibilities
● Disposal methods
High Low
Attachment A
Citywide Internal Controls Review Report | 11
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
● Security measures
● Compliance with applicable
regulations
● Documentation and reporting
2 A formal Disaster Recovery
Plan (DRP) is documented,
implemented, and tested.
There is a written policy for a DRP,
but it has not been updated in
approximately five years and the
DRP is not formally tested.
The City’s documented DRP should be
formally tested and updated, if needed.
Testing should be documented and the
results should be addressed. The DRP
should be evaluated, updated, and tested
regularly to ensure that it addresses the
City’s current environment and systems
and the City is prepared in the event of a
major disaster.
Moderate High
F. Purchasing and Accounts Payable
1 The Procurement Department
compiles purchasing data into a
spreadsheet and reviews the
data for purchasing trends.
The City has demonstrated that it
can query the purchasing trends
report; however, the review of that
report is not formally documented.
The City should update the process for
reviewing and approving the purchasing
trends report to support budgeting,
forecasting, and decision-making, and
evaluate for any unusual trends that
warrant a deeper review. Reviews that
occur should be formally documented.
Low Low
2 The City-wide P&Ps for
procurement are
well-documented and current.
The due diligence thresholds defined
in the Informal Procurement Policy
and General Procurement Policy
differ from what was told to us during
interviews, which might indicate a
lack of understanding of the policy or
that the policies are not current.
During interviews performed, we
were informed of the following due
diligence thresholds:
● Purchases $10,000 and below
require one quote
The City should review its Informal
Procurement Policy and General
Procurement Policy and make updates to
due diligence thresholds as needed to
match current practices. If the policies
are correct, the City should consider
conducting a training for procurement
staff to ensure they understand and
adhere to the policies.
Moderate Moderate
Attachment A
Citywide Internal Controls Review Report | 12
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Control Objective Control Issue Recommendation
Likelihood of
Occurrence
Impact of
Occurrence
● Purchases over $10,000 up to
$100,000 require a minimum of
three quotes
● Purchases over $100,000 require
formal solicitation and City
Council approval
The Informal Procurement Policy and
General Procurement Policy state:
● Purchases up to $4,999 require
one quote
● Purchases between $5,000 and
$75,000 require a minimum of
three quotes
● Purchases $75,000 and above
require formal solicitation and
City Council approval
Attachment A
Attachment A