Internal Audit Annual Reports and Peer Reviews, Acttc Internal Audit Division FY 2019-20 Annual Report, FY 2020-21 Audit Plan, and Qaip report

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 9/22/2020 Mark Maier (805) 781-4267 Tax Collector (4) SUBJECT Submittal of the FY 2019-20 Internal Audit Division Annual Report, Quality Assurance and Improvement Program Self-Assessment Report, and the FY 2020-21 Audit Plan. All Districts. (5) RECOMMENDED ACTION It is recommended that the Board 1) receive, review, and file the FY 2019-20 Internal Audit Division Annual Report and Quality Assurance and Improvement Program Self-Assessment Report and 2) approve the FY 2020-21 Audit Plan. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0.00 $0.00 (10) AGENDA PLACEMENT { X } Consent { } Presentation { } Hearing (Time Est. _______) { } Board Business (Time Est.______) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances { X } N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (13) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A N/A { } 4/5th's Vote Required { X } N/A (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY N/A No { } N/A Date __9/10/2019, Item #10______ (17) ADMINISTRATIVE OFFICE REVIEW Emily Jackson (18) SUPERVISOR DISTRICT(S) All Districts Page 1 of 3 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor-Controller-Treasurer-Tax Collector DATE: 9/22/2020 SUBJECT: Submittal of the FY 2019-20 Internal Audit Division Annual Report, Quality Assurance and Improvement Program Self-Assessment Report, and the FY 2020-21 Audit Plan. All Districts. RECOMMENDATION It is recommended that the Board 1) receive, review, and file the FY 2019-20 Internal Audit Division Annual Report and Quality Assurance and Improvement Program Self-Assessment Report and 2) approve the FY 2020-21 Audit Plan. DISCUSSION We are pleased to offer our annual report on the status of the County Auditor-Controller-Treasurer-Tax Collector’s Internal Audit Division in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our FY 2019-20 internal audit reports, a summary of the FY 2019-20 Whistleblower Hotline Complaints, and our proposed FY 2020-21 Audit Plan. Additionally, included are the results of our Quality Assurance and Improvement Program Self-Assessment. Along with performing audits, the Internal Audit Division’s responsibilities include the coordination and preparation of various financial reports and review of the fee calculations prepared by departments. Our proposed FY 2020-21 Audit Plan is based on the estimated remaining time available to carry out audit work and allocates time for departmental, transient occupancy tax, and cannabis related business tax audits. Further detail on the audits selected is available in the FY 2020-21 Audit Plan Report. We are asking the Board to approve our proposed FY 2020-21 Audit Plan. OTHER AGENCY INVOLVEMENT/IMPACT None FINANCIAL CONSIDERATIONS None Page 2 of 3 RESULTS A well-functioning internal audit division inspires and elevates public trust in government by assisting and supporting the County, the Board of Supervisors and other stakeholders in achieving their mission with transparency and integrity. ATTACHMENTS 1 FY 2019-20 Internal Audit Division Annual Report 2 FY 2020-21 Audit Plan 3 Quality Assurance and Improvement Program Self-Assessment Page 3 of 3 Attachment 1 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Internal Audit Division Annual Report to the County Board of Supervisors September 2020 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Overview We are pleased to offer our annual report on the status of the County Auditor-Controller- Treasurer-Tax Collector’s Internal Audit Division in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our FY 2019-20 audit reports, a summary of the FY 2019-20 Whistleblower Hotline Reports, and our proposed FY 2020-21 Audit Plan. Purpose, Authority, & Responsibility The Internal Audit Division exists to inspire and elevate public trust in government by assisting and supporting the County, the Board of Supervisors, and other stakeholders in achieving their mission with transparency and integrity. We accomplish this vision by providing reliable, independent, and objective evaluations and advisory services which utilize a systematic and disciplined approach to add value and improve operations. We contribute expertise in the evaluation and enhancement of controls and other processes, minimization of risks, and enhancement of operational effectiveness for stakeholders. The authority for the Internal Audit Division is California Government Code Sections 26881 and 26883. In Accordance with Government Code Section 1236, we follow the International Standards for the Professional Practice of Internal Auditing (Standards). Our responsibilities include maintaining independence and objectivity, continually enhancing our skills and knowledge, and providing consistent, clear communication as we perform our work. Our audit duties include the performance of: ➢ Assurance Audits – the main purpose of assurance audits is to provide an objective assessment of evidence and an independent opinion or conclusion regarding an operation, function, process, system, or other subject matter. Such audits may focus on the reliability of financial or operating information, on systems of internal control over recordkeeping, and/or the adequate safeguarding of assets. These audits may also include a review of controls implemented to ensure compliance with policies, plans, procedures, laws, and regulations. Examples of assurance audits completed in the past fiscal year include: ✓ District Attorney Cash Procedures and Internal Controls ✓ Transient Occupancy Tax Collection, Reporting and Remitting Page 2 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR ➢ Consulting Audits – Consulting audits are advisory in nature and are generally performed at the specific request of a client. The nature and scope of the consulting engagement are subject to agreement with the client. Examples of consulting audits in the past fiscal year include: ✓ Department of Social Services’ Status of Claims Against Households Food and Nutrition Services 209 Report Validation ✓ District Attorney Workers’ Compensation Insurance Fraud Grant In addition to our audit duties, the Internal Audit Division has a number of other responsibilities including: ➢ Monitoring the County’s Whistleblower Hotline ➢ Coordinating preparation of the County’s Comprehensive Annual Financial Report (CAFR) and acting as liaison with the external auditors ➢ Preparing the County Financial Transactions Report (CFTR) ➢ Monitoring special districts’ compliance with financial audit submissions (California Government Code Section 26909) ➢ Review of department fees and fee development methodologies ➢ Review vehicle citation appeals Independence The Internal Audit Division consists of three staff auditors who report directly to the Auditor- Controller-Treasurer-Tax Collector (ACTTC). The ACTTC achieves organizational independence via election by the citizens of San Luis Obispo County. Both the ACTTC and the Internal Audit Manager have unhindered access to the County Administrative Officer and the Board of Supervisors. Each year the ACTTC, Assistant ACTTC, and individual members of the Internal Audit Division affirm their independence by signing a Statement of Independence and Objectivity. Page 3 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Likewise, Statements of Independence are completed for each individual engagement by team members assigned to the engagement. Internal Audit Division Charter The Internal Audit Division Charter is the guiding document for our audit work. The Charter includes the Core Principles for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors. No updates to the Charter have occurred in the past fiscal year. Quality Assurance and Improvement Program Results The auditing Standards require that we maintain a quality assurance and improvement program consisting of both ongoing and periodic assessments of our operations and audit work to determine conformance with the Institute of Internal Auditor’s Definition of Internal Auditing, Code of Ethics, and Standards. External Assessment The Standards specify that an external assessment, also known as a peer review, be conducted every five years. Our last peer review occurred in FY 2016-17 for the period July 1, 2011 through June 30, 2016. Our next peer review will be performed in FY 2021-22 and will cover July 1, 2016 through June 30, 2021. Internal Periodic Assessment In the 2019-20 fiscal year, the Internal Audit Division completed a periodic internal assessment. We are submitting the results of our internal assessment along with this report. Our internal assessment identified one area of improvement related to the development of the audit plan. Ongoing Monitoring In the 2019-20 fiscal year, the Internal Audit Division complied with the ongoing monitoring requirement through soliciting stakeholder feedback, using checklists and taking advantage of automated systems to provide assurance that processes had been followed. We also monitored project budgets and analyzed additional performance metrics, including those reported below. Page 4 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR The results of our ongoing monitoring demonstrate that we are perceived as being professional and knowledgeable, that our work helps management improve business processes and controls, and that our recommendations are being implemented. The Internal Audit Division categorizes audit issues into two levels and provides recommendations for each issue identified. The seriousness of the issue determines the type of department response required: ➢ Findings – issues which present a serious enough risk to require consideration by management and a written response to our recommendation(s). The Internal Audit Division conducts follow-up monitoring on all issues identified as Findings. ➢ Verbal Recommendations – issues which are lower risk and/or a best practice that could be adopted to improve controls and/or enhance operations. Verbal Recommendations do not require a written department response and are not included in the individual engagement report. All Findings and Verbal Recommendations are discussed with the Department’s management prior to a report being issued. In most cases the department has made a change to address the issue before the audit is complete. At the end of fiscal year 2018-19 we had eight open recommendations that had yet to be verified as implemented. Below is a summary of the recommendations and current status: Recommendation Department/Contractor Status as of 6/30/2020 ➢ Improve bank reconciliation Health Agency – Animal Closed – New audit will be documentation Services performed at a later date. ➢ Improve timeliness of bank Health Agency – Animal Closed – New audit will be reconciliations Services performed at a later date. ➢ Document missing receipts Health Agency – Animal Closed – New audit will be for Cal-Card purchases Services performed at a later date. ➢ Document authorization for Health Agency – Animal Closed – New audit will be petty cash purchases Services performed at a later date. ➢ Obtain secondary approval One-Time Vendor Accounts: Closed – Verified as implemented of one-time vendor Airport, Clerk-Recorder, and in FY 19-20 follow-up audit payments Public Works Page 5 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Recommendation Department/Contractor Status as of 6/30/2020 ➢ Increase change fund Closed – Verified as implemented in Library security FY 19-20 follow-up audit ➢ Reconcile all sales to cash Closed – Verified as implemented in Library register receipts FY 19-20 follow-up audit Closed – Verified as implemented in ➢ Issue receipts for donations Library FY 19-20 follow-up audit In addition, the two following recommendations were issued in FY 2019-20 and resolved prior to the end of the fiscal year. Recommendation Department/Contractor Status as of 6/30/2020 ➢ Document all staff’s Closed – Verified as implemented acknowledgement of the District Attorney prior to completion of audit Cash Hash Handling Policy ➢ Document all staff’s acknowledgement of the Closed – Verified as implemented District Attorney Information Technology prior to completion of audit Acceptable Use Policy In FY 2019-20 we made 30 total recommendations. 26 issues were classified as Findings and 4 issues were classified as Verbal Recommendations: LEVEL OF ISSUES FOUND DURING AUDITS Findings Verbal Recommendations 13% 87% Page 6 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR The following three recommendations were made during FY 2019-20 and remain open as of June 30, 2020: Recommendation Department/Contractor Status as of 6/30/2020 ➢ Segregate cash receipting To be verified in FY 20-21 follow-up District Attorney and depositing duties audit ➢ Mark Victim Witness To be verified in FY 20-21 follow-up Assistance Fund’s petty District Attorney audit cash receipts as “Paid” ➢ Update department’s To be verified in FY 20-21 follow-up District Attorney computer inactivity settings audit Findings for consulting engagements are not included in this report as those audits are performed at the request of the department and do not routinely have follow-up audits performed. Most of the audit issues we addressed related to financial reporting errors which made up 37% of audit findings for FY 2019-20. The following chart displays broad categories of audit findings and the percentage of each: FY 2019-20 Percentage of Audit Finding by Category 13% 37% 25% 25% Financial Reporting Errors Weak Internal Controls Around Cash & Cash Equivalents Weak Internal Controls Around Payment & Procurement Noncompliance with Contracts, Policies, Guidelines, Laws, and/or Regulations Page 7 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR FY 2019-20 Internal Audit Plan Status The annual audit plan is intentionally created with an ambitious goal of completion and with the realistic understanding that the Division’s time is flexible and continuously changing to fit the needs of the both the ACTTC’s office and the County as a whole. Additionally, COVID-19 impacted the audit plan in two ways. 1. It reduced the number of audit hours available as a staff member was assigned as a disaster service worker to assist in the County’s response to the pandemic. 2. It eliminated the ability to conduct in-person fieldwork. Audit Type of Audit Plan Category Entity Engagement Classification Engagement Status Mandated State Worker's Compensation Insurance Fraud (District Attorney) Consulting Original Completed Workforce Innovation and Opportunity Act (DSS) - 2019 Consulting Original Completed Annual Cash Shortages and Overages Report Assurance Original Completed Internal Quality Assurance and Improvement Program N/A Amended Completed FNS-209 Validation (DSS) Consulting Added Completed In Progress Workforce Innovation and Opportunity Act (DSS) - 2018 Consulting Original Completed Bryan's House Recovery Home (Health Agency) Consulting Original Completed Cash Review - District Attorney Assurance Original Completed TOT - Calendar Year 2018 Assurance Original Completed Follow-up One-Time Vendor Payment Accounts Follow-Up Assurance Original Completed Library Cash Procedures and Internal Controls Follow-up Assurance Original Completed Transient Occupancy Tax TOT - Calendar Year 2019 Assurance Amended In Progress Cash and Internal Controls Department #1 Assurance Original Carried forward to 20-21 Department #2 Assurance Original Carried forward to 20-21 Clerk Recorder - Trust Funds, Disbursements Review Assurance Original Completed Department #4 Assurance Original Carried forward to 20-21 DInetpegarratmteedn Wt #a5ste Management Authority Assurance Original Carried forward to 20-21 Internal Control Assessment Consulting Added Completed Carry Forward From Prior Year Airport Concessionaire - Rental Cars Assurance Original Reassessed for 20-21 IT Asset Management Audit Assurance Original Reassessed for 20-21 Asset Verification (2-3 assets) Assurance Original Reassessed for 20-21 Page 8 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR The following changes were made to the internal audit plan during fiscal year 2019-20: Audit Action Reason for Change ➢ Integrated Waste Management Authority- Internal Controls Risk Added Management request Assessment ➢ Status of Claims Against Households Food and Nutrition Added Management request Services 209 Report Validation (DSS) Originally schedule to be performed ➢ Internal Quality Assurance and Hours in FY 2020-21 and was moved up to Improvement Program Increased accommodate COVID-19 scheduling Hours Operators audited were reduced to ➢ Transient Occupancy Tax Reduced accommodate COVID-19 scheduling Overall, we completed 15 audits, including 6 Transient Occupancy Tax audits. Feedback solicited from these engagements resulted in an average overall audit services ranking of 3.92 out of 4, an increase from the average of 3.72 in FY 2018-19. Non-Audit Highlights During the FY 2019-20, the Internal Audit Division addressed a diverse range of non-audit tasks in response to departmental and County needs. Highlights from these activities include: ➢ Consulted on the update to the County’s Cash Handling Policy. ➢ Conducted four fee calculation training sessions with staff from more than 15 different departments. ➢ Continuous monitoring of the segregation of duties in the County’s financial system for payment disbursements. Page 9 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Whistleblower Hotline Results The Internal Audit Division monitors the Whistleblower Hotline, refers reports to related departments or agencies, and conducts follow-up procedures as necessary. In FY 2019-20, the Whistleblower Hotline received 40 reports of alleged fraud, waste, or abuse, an 11% decrease from the prior year’s 45 reports. Reports were received regarding the following categories: FY 2019-20 Whistleblower Hotline Reports by Type Other Safety/Sanitation Violation of Civil Service Rules Violation of Federal, State or County Regulations Misconduct Conflict of Interest 0 2 4 6 8 10 12 14 16 18 Reports related to employee misconduct that were not related to alleged fraud, waste, or abuse were referred to Human Resources and were not classified as substantiated or unsubstantiated. The remainder of the reports were either substantiated, unsubstantiated, referred, or not related to County operations. Quarterly Whistleblower Hotline reports are posted on the ACTTC website. Page 10 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR FY 2020-21 Internal Audit Plan The proposed FY 2020-21 Audit Plan contains mandated audits, audits in progress, follow- up audits, and audits recommended for the current year. Details are presented below for the Board’s review and approval. The audit plan may be modified during the year to accommodate significant new issues or risks which may arise and require the immediate attention of the Internal Audit Division. Additional details on the development of the audit plan can be viewed in the attached audit plan report. Total Productive Internal Audit Staff Hours Available 1 5,400 Audit Team Non-Audit Work Hours: Financial Reporting (CAFR and CFTR) and Fee Review 2 ,200 Administrative Tasks/Training/Vehicle Hearings/ Whistleblower Hotline 820 COVID-19 Disaster Service Work 750 Subtotal Non-Audit Work 3,770 Audit Hours Available 1,630 Audit Hours Detail Estimated Type of Audit Category Audit Name Risk Hours Engagement State Worker's Compensation Insurance Fraud Mandated Low 60 Consulting (District Attorney) Workforce Innovation and Opportunity Act (DSS) Medium 140 Consulting Annual Cash Shortages and Overages Report Low 60 Assurance In Progress Transient Occupancy Tax - CY 2019 Medium 40 Assurance Internal Quality Assurance and Improvement Program N/A 40 N/A Cash Procedures and Internal Controls Review Follow-up Low 30 Assurance (District Attorney) Integrated Waste Management Authority Medium 20 Consulting Internal Controls Assessment Transient Occupancy Tax - CY 2020 Transient Occupancy Tax Medium 320 Assurance (6-8 establishments) Cannabis Business Tax Cannabis Business Tax (3-4 operators) High 600 Assurance Cash and Internal Controls Department #1 Medium 60 Assurance Department #2 Medium 100 Assurance Department #3 Low 60 Assurance Department #4 Low 100 Assurance Total Estimated Audit Hours 1,630 Total Internal Audit Staff Hours Scheduled 5,400 1 1,800 annual productive hours per staff ((2,080-280) * 3) Page 11 of 12 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR In developing our annual audit plan, we consider the assessed risk of programs and activities, any input received from management and the Board, and the time and staffing resources available within the division. The Internal Audit Division maintains a continuous risk assessment throughout the year. We calculate the risk of programs and activities based on three major factors: 1. Financial factors which include but are not limited to the dollar amount of receipts or expenditures and the types of funding being received. 2. Operational factors such as the vulnerability of the population being served, the types of services being provided, and significant staffing or systems changes. 3. The likelihood of significant financial or operational impact if internal controls should fail. COVID-19 Impacts COVID-19 has presented two additional considerations in preparing the annual audit plan. First, overall audit hours for the year have been reduced by 750 hours for staff time allocated as a disaster service worker to assist in the County’s response to the virus in its declared state of emergency. Second, traditional in-person auditing will be eliminated when possible and be replaced with remote auditing. To facilitate remote auditing, technology will be used to provide alternatives to face-to-face meetings and interviews and allow for requested documentation to be shared electronically. Page 12 of 12 Attachment 2 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER – TAX COLLECTOR Internal Audit Division Audit Plan Fiscal Year 2020-21 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Proposed Annual Audit Plan The Internal Audit Plan for Fiscal Year 2020-21 summarizes the audits we recommend performing during the year. The plan is based on the results calculated by our risk assessment, stakeholder input, and available audit hours. It is important to note the plan is a working document and can be adjusted throughout the year as priorities and risk change. Additional detail regarding the development of the audit plan is available in the following pages. Objectives of the audits listed can be found at the end of the report. Total Productive Internal Audit Staff Hours Available 1 5,400 Audit Team Non-Audit Work Hours: Financial Reporting (CAFR and CFTR) and Fee Review 2 ,200 Administrative Tasks/Training/Vehicle Hearings/ Whistleblower Hotline 820 COVID-19 Disaster Service Work 750 Subtotal Non-Audit Work 3,770 Audit Hours Available 1,630 Audit Hours Detail Estimated Type of Audit Category Audit Name Risk Hours Engagement State Worker's Compensation Insurance Fraud Mandated Low 60 Consulting (District Attorney) Workforce Innovation and Opportunity Act (DSS) Medium 140 Consulting Annual Cash Shortages and Overages Report Low 60 Assurance In Progress Transient Occupancy Tax - CY 2019 Medium 40 Assurance Internal Quality Assurance and Improvement Program N/A 40 N/A Cash Procedures and Internal Controls Review Follow-up Low 30 Assurance (District Attorney) Integrated Waste Management Authority Medium 20 Consulting Internal Controls Assessment Transient Occupancy Tax - CY 2020 Transient Occupancy Tax Medium 320 Assurance (6-8 establishments) Cannabis Business Tax Cannabis Business Tax (3-4 operators) High 600 Assurance Cash and Internal Controls Department #1 Medium 60 Assurance Department #2 Medium 100 Assurance Department #3 Low 60 Assurance Department #4 Low 100 Assurance Total Estimated Audit Hours 1,630 Total Internal Audit Staff Hours Scheduled 5,400 1 1,800 annual productive hours per staff ((2,080-280) * 3) Page 2 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Developing the Audit Plan The following guide shows the audit plan’s development process and relationship of the plan to the County’s objectives. County’s Vision, Mission, & Organizational Values Internal Audit Division’s Vision & Mission Internal Internal Stakeholder Audit Risk Audit Input Assessment Resources Proposed Audit Plan Board of Supervisors Approval Final Audit Plan Page 3 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector County Vision, Mission, and Organizational Values A Safe Community – The County will strive to create a community where all people – adults and children alike – have a sense of security and well-being, crime is controlled, fire and rescue response is timely and roads are safe. A Healthy Community – The County will strive to ensure all people in our community enjoy healthy, successful and productive lives, and have access to the basic necessities. A Livable Community – The County will strive to keep our community a good place to live by carefully managing growth, protecting our natural resources, promoting lifelong learning, and creating an environment that encourages respect for all people. A Prosperous Community – The County will strive to keep our economy strong and viable and assure that all share in this economic prosperity. A Well Governed Community – The County will provide high quality “results oriented” services that are responsive to community needs. Page 4 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Internal Audit Vision and Mission Vision Mission •Our Mission is to provide reliable, •Weexisttoinspireandelevatepublictrustin independent, objective evaluations and government by assisting and supporting the advisory services to County management, County, the Board of Supervisors, and other the Board of Supervisors, and other stakeholders in achieving their mission with stakeholders. By utilizing a systematic, transparencyandintegrity. disciplined approach, our services will add value to and improve operations. We will provide expertise to evaluate and improve the effectiveness of controls and other processes, minimize risks, and enhance operational effectiveness for stakeholders; as well as contribute to protecting and safeguardingresourcesandassets. To carry out our vision we will engage in the following core activities: ✓ We will provide excellent support to the County’s management, staff, and stakeholders by conducting independent, effective, and efficient analyses which enhances customers’ ability to meet their objectives. ✓ We will provide reasonable assurance of accountability, transparency, and due diligence, by conducting audits and reviews of operations, programs, and projects to ensure public funds are spent appropriately and within the scope of the intended purpose. ✓ We will help to ensure public funds are used in the most efficient and effective manner through the development and monitoring of internal controls and processes. ✓ We will help to prevent fraud, waste, and abuse by continuous assessment, education, and monitoring of risk. Page 5 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector ✓ We will help to ensure the County is in compliance with necessary reporting, monitoring and compliance requirements governed by various statutes, codes, and regulations. ✓ We will ensure internal audit staff are properly trained and kept apprised of new accounting and auditing standards and best practices. ✓ We will conduct a quality assurance and improvement program which assesses the efficiency and effectiveness of the internal audit activity, including promoting effective control at a reasonable cost, and identifying opportunities for improving the internal audit activity’s performance and ability to add value. Types of Audits The audits that we will perform will fall into two categories. Assurance Consulting To provide an objective assessment of evidence Advisory in nature and are generally performed and an independent opinion or conclusion at the specific request of a client. The nature and regarding an operation, function, process, scope of the consulting engagement are subject system, or other subject matter. Such audits may to agreement with the client. focus on the reliability of financial or operation information, on systems of internal control over recordkeeping, and/or the safeguarding of assets to ensure systems are adequate and effective. These audits may also include review of structures established to ensure compliance with policies, plans, procedures, laws, and regulations. Risk Assessment The risk assessment is a systematic process used to evaluate, identify, and prioritize potential audits based on the level of risk to the County. Risk is defined as the possibility of an event occurring that will have a financial or operational impact on the achievement of the County’s objectives and is measured in terms of impact and likelihood. The assessment identifies exposures that would disrupt the organization’s operations, interfere with County and departmental goals and business objectives, and serve as obstacles in the compliance of local and federal governances. Page 6 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Stakeholder Input Development of the plan allows for input from the Board of Supervisors, the County Administrator, departments, and other public stakeholders. At least annually, input is requested from the Board of Supervisors, the County Administrator, and departments. Internal Audit Resources The Internal Audit Division consists of 3 full-time members. Collectively, staff have a broad range of professional and educational backgrounds. Staff have attained professional certifications as a Certified Public Accountant, Certified Internal Auditor and Certified Information Systems Auditor. In addition to conducting audits, the team oversees a variety of other responsibilities, including, reviewing County fees and the preparation of the County’s annual financial statements and other financial State reporting. The audit plan takes into account the estimated amount of time staff will have available to perform audits. Total Annual Number of Hours Total Non- Total Audit Hours Staff Available* Audit Hours Available 3 6,240 4,610 1,630 * A detailed breakout of hours is available in the audit plan. COVID-19 Impacts COVID-19 has presented two additional considerations in preparing the annual audit plan. First, overall audit hours for the year have been reduced by 750 hours for staff time allocated as a disaster service worker to assist in the County’s response to the virus in its declared state of emergency. Second, traditional in-person auditing will be eliminated when possible and be replaced with remote auditing. To facilitate remote auditing, technology will be used to provide alternatives to face-to-face meetings and interviews and allow for requested documentation to be shared electronically. Page 7 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Proposed Audit Plan The audit plan contains mandated audits, audits in progress, follow-up audits, and audits recommended for the current year, all of which align with the County’s vision, mission, and values. Mandated Audits (All Required Annually) State Worker's Compensation Insurance Fraud Program Grant (Consulting) To determine if the District Attorney's Workers' Compensation Fraud Program is in compliance with grant award requirements and state regulations for FY 2019-20. Workforce Innovation and Opportunity Act Fiscal and Procurement Monitoring (Consulting) To determine if WIOA funds used complied with federal and state laws, regulations, policies, and directives for PY 2020-21. Annual Cash Shortages and Overages Report (Assurance) To report on cash shortages and overages as required by Board Resolution 84-40 for FY 2020-21. Audits in Progress Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County in CY 2019. Follow-up Audits District Attorney Cash Procedures and Internal Controls (Assurance) To review any unresolved recommendations issued in the October 2019 audit report. Integrated Waste Management Authority Internal Controls Assessment (Consulting) To review any unresolved recommendations issued in the September 2019 audit report. Page 8 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Recommended Audits Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County in CY 2020. Cannabis Business Tax (Assurance) To determine the accuracy of Cannabis Business Tax amounts remitted to the County. This is the first year cannabis business tax audits have been included in our annual audit plan. Departmental Cash Procedures and Internal Controls (Assurance) Audit objectives can vary by department but are generally performed to determine compliance with the Cash Handling Policy, establish accountability of cash on hand, and review internal controls of cash procedures. Page 9 of 9 Attachment 3 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER – TAX COLLECTOR Internal Audit Division Quality Assurance and Improvement Program Self-Assessment September 2020 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Overview The San Luis Obispo County Internal Audit Division is required by auditing standards to have an external assessment of our operations once every five years along with ongoing internal monitoring. Auditor-Controller-Treasurer-Tax Collector policy requires an internal quality improvement and assurance assessment biennially, in order to assess the division’s strengths, challenges, and compliance with standards. The background and results of our assessment are detailed below. Structure and Reporting Standards The Internal Audit Division is comprised of three Auditor-Analysts who report directly to the Auditor-Controller-Treasurer-Tax Collector. The Internal Audit Division follows the International Standards for the Professional Practice of Internal Auditing (Standards) put forth by the Institute of Internal Auditors (IIA). The Standards are encompassed within the IIA’s International Professional Practices Framework, commonly referred to as the Red Book. The Standards require the Internal Audit Division to have a quality assurance and improvement program (QAIP) which includes periodic internal and external assessments, as well as on-going monitoring of performance. The purpose of the QAIP is to evaluate the Internal Audit Division’s conformance with the Standards, to assess the efficiency and effectiveness of the internal audit function, and to identify opportunities for improvement. This report presents the results of our internal assessment, covering April 1, 2018 through June 30, 2020. To perform the self-assessment, we utilized the IIA’s Quality Assessment Manual and conducted surveys and interviews of selected County management and internal audit staff. Results We determined the Internal Audit Division is in general compliance with the Standards overall, and we identified several best practices the division utilizes consistently. There were no identified areas of noncompliance with the Standards; however, a best practice area where improvement could be made was identified. A summary of conformance with individual standards is available in Appendix A. Page 2 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Best Practices Being Utilized 1. Commitment to Internal Audit Division’s vision and adding value Internal audit staff demonstrate a strong dedication to the team’s vision of inspiring and elevating public trust in government by assisting and supporting the County, the Board of Supervisors, and other stakeholders in achieving their mission with transparency and integrity. The division focuses on performing audits that add value to County operations. 2. Collaborative and educational approach The Internal Audit Division makes an effort to work with departments and other stakeholders in a collaborative manner and keeps the focus on education and finding workable solutions to identified issues. 3. Risk-based approach The Internal Audit Division performs a thorough risk assessment of County activities and operations in developing its audit plan. In developing the audit plan, department and management input is sought to help identify high risk areas. Additionally, individual engagement areas of focus are determined based on an evaluation of high-risk activities. 4. Use of electronic tools to facilitate continuous monitoring The Internal Audit Division utilizes electronic audit workpaper software to document adherence to the Standards, document supervision provided throughout an audit, and track audit recommendations requiring future follow-up. These methods allow for greater efficiency in achieving compliance with the Standards. Best Practice Area for Improvement 1. Improve strategic audit plan While elements of a strategic audit plan were included in the audit plan presented in the Internal Audit Division’s annual report to the Board of Supervisors, creation of a stand- alone strategic audit plan expands on the plan’s development process and clarifies the alignment of the audit plan with the County’s objectives as an organization. Current Status: The strategic audit plan will be reported to the Board of Supervisors with the Division’s annual report. Page 3 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Follow-up to August 2018 QAIP Self-Assessment Best Practice Recommendations 1. Finalize and update procedures The internal audit manual is out of date, and the electronic workpaper and risk assessment procedures manuals are unfinished. Standard 2040 requires the Chief Audit Executive (CAE) to establish policies and procedures to guide the Internal Audit Division; however, the form and content of policies and procedures may be dependent upon the size and structure of the Internal Audit Division and the complexity of its work. Because the Internal Audit Division is small, and policies and procedures are easily communicated, formal documentation has not been a priority. Follow-up: Completed. The Internal Audit Division issued a finalized Internal Audit Manual in June 2019. 2. Create a strategic plan The Internal Audit Division does not have a strategic plan. Best internal auditing practices require the Internal Audit Division to have developed a Strategic Plan as outlined in the IIA's Practice Guide, Developing an Internal Audit Strategic Plan. Staff have been focused on the update of policies and procedures; however, the Division may be missing critical areas that should be assessed due to lack of a strategic plan. Follow-up: Completed. The strategic audit plan will be reported to the Board of Supervisors with the Division’s annual report. 3. Formalize Electronic Records Retention Policy The Internal Audit Division does not have a documented retention policy for electronic records. Standard 2330 requires the CAE to develop policies governing the custody and retention requirements for engagement records regardless of the medium used to store each record. Follow-up: Completed. The Internal Audit Division electronic records retention policy was created and implemented on July 31, 2018. 4. Report Open Audit Recommendations to the Board of Supervisors Annually The Division has historically tracked and followed-up all unresolved recommendations, the status of these recommendations has not been summarized and periodically reported to the Board of Supervisors. Standard 2500 requires the CAE to establish a follow-up process Page 4 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action. In the County setting, it is the Board of Supervisor's responsibility to determine the acceptance of inaction. The CAE did not realize it is a best practice to report open recommendations to the Board periodically. The Board may have been denied the opportunity to question or take actions on open recommendations. Follow-up: Completed. Open audit recommendations are included in the Internal Audit Division’s annual report to the Board of Supervisors. 5. Update Audit Charter to Include IPPF Core Principles Element The prior audit charter did not reference the mandatory IPPF Core Principles of Professional Practice and Internal Auditing element. Standard 1010 requires that the internal audit charter recognize the mandatory nature of the Core Principles for the Professional Practice of Internal Auditing, Definition of Internal Auditing, Code of Ethics, and the Standards. Staff believed the charter had satisfied all the required elements of the IPPF; however, the Internal Audit Division is not in full compliance with the Standards. Follow-up: Completed. The Internal Audit Charter was updated to include the required element and approved by the Board of Supervisors on August 21, 2018. Page 5 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector APPENDIX A Quality Assessment Evaluation Summary—Overall Evaluation GC PC DNC OVERALL EVALUATION √ Quality Assessment Evaluation Summary—Major/Supporting Standards GC PC DNC 1000 Purpose, Authority, and Responsibility √ 1010 Recognition of the Definition of Internal Auditing, the Code of Ethics, and the Standards in the Internal Audit Charter √ 1100 Independence and Objectivity √ 1110 Organizational Independence √ 1111 Direct Interaction with the Board √ 1112 Chief Audit Executive Roles Beyond Internal Auditing √ 1120 Individual Objectivity √ 1130 Impairment to Independence or Objectivity √ 1200 Proficiency and Due Professional Care √ 1210 Proficiency √ 1220 Due Professional Care √ 1230 Continuing Professional Development √ 1300 Quality Assurance and Improvement Program √ 1310 Requirements of the Quality Assurance and Improvement Program GC = Generally Conforms PC = Partially Conforms DNC = Does Not Conform Page 6 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Quality Assessment Evaluation Summary—Major/Supporting Standards GC PC DNC 1311 Internal Assessments √ √ 1312 External Assessments 1320 Reporting on the Quality Assurance and Improvement Program √ √ 1321 Use of “Conforms with the International Standards for the Professional Practice of Internal Auditing” √ 1322 Disclosure of Nonconformance √ 2000 Managing the Internal Audit Activity √ 2010 Planning √ 2020 Communication and Approval √ 2030 Resource Management 2040 Policies and Procedures √ √ 2050 Coordination √ 2060 Reporting to Senior Management and the Board √ 2070 External Service Provider & Org Responsibility for Internal Auditing √ 2100 Nature of Work √ 2110 Governance √ 2120 Risk Management √ 2130 Control GC = Generally Conforms PC = Partially Conforms DNC = Does Not Conform Page 7 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Quality Assessment Evaluation Summary—Major/Supporting Standards GC PC DNC √ 2200 Engagement Planning √ 2201 Planning Considerations √ 2210 Engagement Objectives √ 2220 Engagement Scope √ 2230 Engagement Resource Allocation √ 2240 Engagement Work Program √ 2300 Performing the Engagement √ 2310 Identifying Information √ 2320 Analysis and Evaluation √ 2330 Documenting Information √ 2340 Engagement Supervision √ 2400 Communicating Results √ 2410 Criteria for Communicating 2420 Quality of Communications √ √ 2421 Errors and Omissions √ 2430 Use of “Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing” √ 2431 Engagement Disclosure of Nonconformance GC = Generally Conforms PC = Partially Conforms DNC = Does Not Conform Page 8 of 9 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector Quality Assessment Evaluation Summary—Major/Supporting Standards GC PC DNC √ 2440 Disseminating Results √ 2450 Overall Opinions √ 2500 Monitoring Progress √ 2600 Communicating the Acceptance of Risks GC = Generally Conforms PC = Partially Conforms DNC = Does Not Conform Page 9 of 9