UHY Advisors Mid-Atlantic, Inc.
City of Stockton, CA
Internal Audit Services
June 2026
2 Agenda
Questions and answers
General overview of services offered
Approach & risk assessment
Communication of audit findings and follow-up
Reporting and customization
3 General Overview
Distinguishing Characteristics
• More than 60 years of experience providing audit
services for the municipal industry through our
National Government Practice
• More than 30 years of experience providing continuous internal audit for public sector entities
• Providing close to 30 municipalities and organizations with internal audit services
• Participate in and follow guidance from the Institute of Internal Auditors (IIA)
• Our work complies with ethical obligations Code of
Conduct of the Institute of Internal Auditors (IIA),
COSO’s Internal Control Framework, GAGAS, AICPA, and
information systems and assurance standards issued by
ISACA, and with FISCAM, NIST, and PCI Security
• Project team members hold advanced degrees and
certifications (CICA, CIA, CFE, CPA)
• Hands-on partner involvement and more partner
attention
• Partners and senior executives serving you with an
average of 20 years of experience
The Next Level of Service
One California Office:
Irvine
4 General Overview
California Clients
• Orange County
• Riverside County
• Sonoma County
• Port of Los Angeles
• City of Los Angeles
• Los Angeles ISD
*ARPA & Internal Audit Clients
5 General Overview
Managing Director
Consulting Manager,
Internal Audit
Shannon Castillo, CFE
Consulting Manager,
Forensic Audit
Jack Reagan, CPA
Reina Hernandez, CIA
Kimberly Anderson
Managing Director
IT Audit
Senior Consultant
DeAndre Watson
Ty Coffee, AQSA, CISA
Principal
IT Security
Team
6 City-Wide Risk Assessment
• Communicate risk assessment framework to City Council and City management • Inform leadership of the City’s risk exposure results • Serve as the foundation for the City’s Internal Audit Plan Methodology
• Conducted in accordance with GAGAS (Yellow Book)
• Interview City Manager, Department Directors, and others • Standard questionnaire covering goals, risks, controls, and improvement opportunities • Review of Budget Book, ACFR, prior audits and corrective actions 7 Risk-Based Internal Audit Plan
Risk: The possibility that an event will affect the achievement of operational or other objectives of the City. • Operational Risk
• Financial Risk
• Compliance & Legal Risk
• Technology & Data Risk
• Reputational Risk
• Risk Management Governance Risk
• Infrastructure Risk
8 Types of Internal Audits
• Compliance
• Performance
• Forensic
• Assurance
• Other
9 Approach
10 Approach
11 Communication
We are dedicated to ongoing communication throughout the engagement. UHY will coordinate and monitor staff via the Project Manager, who assigns roles based on expertise, tracks hours and deliverables, and conducts internal quality reviews per AICPA as well as GAO standards. Access and communication are ensured through:
• Entrance Conferences: Remote/in-person kickoff meetings to refine objectives, scope, timeline, assign responsibilities, and address risks.
• Progress Reporting: Throughout the engagement, we will maintain regular communication with the Finance and Administration Committee through verbal and written updates, including monthly progress reports. To maintain communication continuity, we can provide weekly updates through calls, emails, and reports on status, milestones, and obstacles. Bi-weekly detailed summaries with metrics, via a secure portal for real-time access. 12 Communication cont.
• Audit Close-Out: Facilitate an audit closeout meeting with the City's Internal Auditor prior to drafting the report to review preliminary observations, risks, and proposed action plans. • Exit Conferences: Final remote/in-person meetings to present draft reports, discuss audit findings and recommendations, and incorporate feedback before issuance, ensuring balanced, actionable outcomes.
• Post Audit: Conduct follow-up audits to validate remediation, as requested. Provide a recommended model for the City’s internal audit program before contract conclusion. 13 Reporting & Customization
1) UHY will provide continuous status communications with key stakeholders over findings and observations to produce a draft report with no surprises. Transparency strengthens the value that management receives from UHY as your provider . Engagements such as this generally result in findings that must be reported, and we can also provide the City with recommendations for corrective action plans. For each finding, we include the following elements:
• Condition – What did we observe?
• Criteria – With what policy or procedure did we identify the condition to be inconsistent? • Cause – What is our conclusion on the reason the condition exists? • Effect – What is the result of the condition’s inconsistency with the criteria? • Recommendation – What changes to the City policies and procedures do we recommend in order to mitigate the risk of the condition occurring again in the future? 2) Draft findings will be reviewed by the engagement managing director prior to submission. City management will have the opportunity to respond, clarify, or provide additional documentation. Final reports will incorporate management responses and highlight industry best practices and process improvement opportunities.
Monthly progress reports will summarize:
• Work completed and upcoming tasks
• Preliminary findings and current issues
• Hours performed, hours remaining, and estimated cost to complete 3) Final report customization and template will be tailored to Springfield’s requirements 4) Discussion of sample report
14 Questions
What additional questions can we answer?
We have experienced a high level of professionalism
and quality work during the audit project – in
addition, UHY’s approach has made them an ideal
choice.
Stephanie Mergler - Deputy Chief of Staff, Wilmington, DE UHY has provided professional and thorough work for
us thus far, and I would not hesitate to utilize their
services again.
Mike Kingery - Independent Internal Audit Program Manager, Glendale, AZ
15 Reina Hernandez, CIA
Consulting Senior Manager
Phone: (410) 423-3502
Email: [email protected]
Jack Reagan, CPA
State and Local Government Practice Leader
Phone: (410) 423-4832
Email: [email protected]
Contact Us
Questions
“UHY” is the brand name under which UHY LLP and UHY Advisors, Inc. provide professional services.
The two firms operate as separate legal entities in an alternative practice structure. UHY LLP is a licensed independent CPA firm that performs attest services. UHY Advisors, Inc. provides tax and business consulting services through wholly owned subsidiary entities. UHY Advisors, Inc. and UHY LLP are U.S. members of Urbach Hacker Young International Limited (UHY International), a UK company, and form part of the international UHY network of legally independent accounting and consulting firms.
Any services described herein are provided by UHY Advisors and/or UHY LLP (as the case may be) and not by UHY International or any other member firm of UHYI. Neither UHY International nor any member of UHY International has any liability for services provided by other members. ©2024 UHY. All rights reserved.
uhy-us.com
Audit | Tax | Advisory | Consulting
Disclaimer:
UHY is NOT being engaged for any “Audit” or “Attest” work within the meaning of the AICPA rules and regulations. This engagement specifically EXCLUDES any “Audit” or “Attest” work. Rather, this is consultative accounting work which will be conducted in accordance with the terms of this engagement and proposal response.