Internal Audit Annual Reports and Peer Reviews, Acttc Internal Audit Division FY 2020-21 Annual Report and FY 2021-22 Audit Plan

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 8/24/2021 Mark Maier (805) 781-4267 Tax Collector (4) SUBJECT Submittal of the FY 2020-21 Internal Audit Division Annual Report and the FY 2021-22 Audit Plan. All Districts. (5) RECOMMENDED ACTION It is recommended that the Board 1) receive, review, and file the FY 2020-21 Internal Audit Division Annual Report and 2) approve the FY 2021-22 Audit Plan. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0.00 $0.00 (10) AGENDA PLACEMENT { X } Consent { } Presentation { } Hearing (Time Est. _______) { } Board Business (Time Est.______) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances { X } N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (13) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A { } 4/5th's Vote Required { X } N/A (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY N/A No { } N/A Date 9/22/2020 (17) ADMINISTRATIVE OFFICE REVIEW Zachary A. Lute (18) SUPERVISOR DISTRICT(S) All Districts Page 1 of 3 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor-Controller-Treasurer-Tax Collector DATE: 8/24/2021 SUBJECT: Submittal of the FY 2020-21 Internal Audit Division Annual Report and the FY 2021-22 Audit Plan. All Districts. RECOMMENDATION It is recommended that the Board 1) receive, review, and file the FY 2020-21 Internal Audit Division Annual Report and 2) approve the FY 2021-22 Audit Plan. DISCUSSION We are pleased to offer our annual report on the status of the County Auditor-Controller-Treasurer-Tax Collector’s Internal Audit Division in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our FY 2020-21 internal audit reports, a summary of the FY 2020-21 Whistleblower Hotline Complaints (page 8), and our proposed FY 2021-22 Audit Plan (page 9). Along with performing audits, the Internal Audit Division’s responsibilities include the coordination and preparation of various financial reports and review of the fee calculations prepared by departments. Our proposed FY 2021-22 Audit Plan is based on the estimated remaining time available to carry out audit work and allocated 1,600 hours for mandated and discretionary audits. Starting on page 10 of the report, detail on each audit engagement’s objectives is provided. We are asking the Board to approve our proposed FY 2021-22 Audit Plan. OTHER AGENCY INVOLVEMENT/IMPACT None. FINANCIAL CONSIDERATIONS None. RESULTS A well-functioning internal audit division inspires and elevates public trust in government by assisting and supporting the County, the Board of Supervisors and other stakeholders in achieving their mission with transparency and integrity. Page 2 of 3 ATTACHMENTS 1 FY 2020-21 Internal Audit Division Annual Report and FY 2021-22 Audit Plan Page 3 of 3 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Internal Audit Division FY 2020-21 Annual Report and FY 2021-22 Audit Plan August 2021 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Overview We are pleased to offer our annual report on the status of the County Auditor-Controller- Treasurer-Tax Collector’s Internal Audit Division in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our FY 2020-21 audit reports, a summary of the FY 2020-21 Whistleblower Hotline Reports (page 8), and our proposed FY 2021-22 Audit Plan (page 9). Purpose, Authority, & Responsibility The Internal Audit Division exists to inspire and elevate public trust in government by assisting and supporting the County, the Board of Supervisors, and other stakeholders in achieving their mission with transparency and integrity. We accomplish this vision by providing reliable, independent, and objective evaluations and advisory services which utilize a systematic and disciplined approach to add value and improve operations. We contribute expertise in the evaluation and enhancement of controls and other processes, minimization of risks, and enhancement of operational effectiveness for stakeholders. The authority for the Internal Audit Division is California Government Code Sections 26881 and 26883. In Accordance with Government Code Section 1236, we follow the International Standards for the Professional Practice of Internal Auditing (Standards). Our responsibilities include maintaining independence and objectivity, continually enhancing our skills and knowledge, and providing consistent, clear communication as we perform our work. Our audit duties include the performance of: Assurance Audits – the main purpose of assurance audits is to provide an objective assessment of evidence and an independent opinion or conclusion regarding an operation, function, process, system, or other subject matter. Such audits may focus on the reliability of financial or operational information, on systems of internal control over recordkeeping, and/or the adequate safeguarding of assets. These audits may also include a review of controls implemented to ensure compliance with policies, plans, procedures, laws, and regulations. Examples of assurance audits completed in prior fiscal years include: SLO Noor Foundation Community Based Organization Grant Agreement Transient Occupancy Tax Collection, Reporting and Remitting Page 2 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Consulting Audits – Consulting audits are advisory in nature and are generally performed at the specific request of a client. The nature and scope of the consulting engagement are subject to agreement with the client. Examples of consulting audits in prior fiscal years include: Department of Social Services’ Status of Claims Against Households Food and Nutrition Services 209 Report Validation District Attorney Workers’ Compensation Insurance Fraud Grant In addition to our audit duties, the Internal Audit Division is responsible for: Monitoring the County’s Whistleblower Hotline Leading the preparation of the County’s Annual Comprehensive Financial Report (ACFR) and acting as liaison with the external auditors Preparing the County Financial Transactions Report (CFTR) Monitoring special districts’ compliance with financial audit submissions (California Government Code Section 26909) Review of department fees and fee development methodologies Review of vehicle citation appeals Independence The Internal Audit Division consists of three staff auditors who report directly to the Auditor- Controller-Treasurer-Tax Collector (ACTTC). The ACTTC achieves organizational independence via election by the citizens of San Luis Obispo County. Both the ACTTC and the Internal Audit Manager have unhindered access to the County Administrative Officer and the Board of Supervisors. Each year the ACTTC, Assistant ACTTC, and individual members of the Internal Audit Division affirm their independence by signing a Statement of Independence and Objectivity. Page 3 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Likewise, Statements of Independence are completed for each individual engagement by team members assigned to the engagement. Internal Audit Division Charter The Internal Audit Division Charter is the guiding document for our audit work. The Charter includes the Core Principles for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors. No updates to the Charter have occurred in the past fiscal year. Quality Assurance and Improvement Program Results The auditing Standards require that we maintain a quality assurance and improvement program consisting of both ongoing and periodic assessments of our operations and audit work to determine conformance with the Institute of Internal Auditor’s Definition of Internal Auditing, Code of Ethics, and Standards. External Assessment The Standards specify that an external assessment, also known as a peer review, be conducted every five years. Our last peer review occurred in FY 2016-17 for the period July 1, 2011, through June 30, 2016. Our next peer review will be performed in FY 2022-23 and will cover July 1, 2016, through June 30, 2021. Internal Periodic Assessment Internal assessments are performed to evaluate conformance with the Standards and the Institute of Internal Auditor’s Code of Ethics. Our last internal assessment occurred in FY 2019-20. Ongoing Monitoring The Internal Audit Division complied with the ongoing monitoring requirement through soliciting stakeholder feedback, using checklists and taking advantage of automated systems to provide assurance that processes had been followed. We also monitored project budgets and analyzed additional performance metrics, including those reported below. The results of our ongoing monitoring demonstrate that we are perceived as being professional and knowledgeable, that our work helps management improve business processes and controls, and that our recommendations are being implemented. Page 4 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR The Internal Audit Division categorizes audit issues into two levels and provides recommendations for each issue identified. The seriousness of the issue determines the type of department response required: Findings – issues which present a serious enough risk to require consideration by management and a written response to our recommendation(s). The Internal Audit Division conducts follow-up monitoring on all issues identified as Findings. Verbal Recommendations – issues which are lower risk and/or a best practice that could be adopted to improve controls and/or enhance operations. Verbal Recommendations do not require a written department response and are not included in the individual engagement report. All Findings and Verbal Recommendations are discussed with the Department’s management prior to a report being issued. In most cases the department makes a change to address the issue before the audit is complete. At the end of fiscal year 2019-20 we had three open findings that had yet to be verified as implemented. Below is a summary of our recommendations and current status: Recommendation Department/Contractor Status as of 6/30/2021 Update Department’s Closed – Verified as implemented District Attorney computer inactivity settings in FY 20-21 follow-up audit Segregate cash receipting Not Implemented - To be verified in District Attorney and depositing duties FY 21-22 follow-up audit Mark Victim Witness Not Implemented - To be verified in Assistance Fund’s petty District Attorney FY 21-22 follow-up audit cash receipts as “Paid” Findings for consulting engagements are not included in this report as those audits are performed at the request of the department and typically do not have follow-up audits performed. In FY 2020-21 we made 9 total recommendations. 6 issues were classified as Findings and 3 issues were classified as Verbal Recommendations: Page 5 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Most of the audit issues we addressed related to financial reporting errors which made up 50% of audit findings for FY 2020-21. The following chart displays broad categories of audit findings and the percentage of each: Page 6 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR FY 2020-21 Internal Audit Plan Status The annual audit plan is intentionally created with an ambitious goal of completion and with the realistic understanding that the Division’s time is flexible and continuously changing to fit the needs of the both the ACTTC’s office and the County as a whole. Additionally, COVID-19 impacted the audit plan in two ways: 1. It reduced the number of audit hours available by 30% as staff were assigned to serve as disaster service workers to assist in the County’s response to the pandemic. 2. It eliminated the ability to conduct in-person fieldwork. The following table details the status of each of the audits in the FY 2020-21 audit plan. Type of Audit Plan Engagement Classification Audit (Assurance/ (Original/Amended Engagement Status as of Category Entity Consulting) ) 6/30/2021 Mandated State Worker's Compensation Insurance Fraud (District Attorney) Consulting Original Completed Workforce Innovation and Opportunity Act (DSS) ‐ 2020 Consulting Original In progress Annual Cash Shortages and Overages Report 2020 Assurance Original Completed In Progress Internal Quality Assurance and Improvement Program N/A Original Completed Follow‐up Cash Procedures and Internal Controls Review ‐ District Attorney Assurance Original Completed Integrated Waste Management Authority Internal Controls Assessment Consulting Original Completed Discretionary TOT ‐ Calendar Year 2020 Assurance Original Carried forward to 21‐22 Cannabis Business Tax Assurance Original Carried forward to 21‐22 Department #1 Assurance Original Carried forward to 21‐22 Department #2 Assurance Original Carried forward to 21‐22 Department #3 Assurance Original Carried forward to 21‐22 Department #4 Assurance Original Carried forward to 21‐22 SLO Noor Foundation FY 2019‐20 Grant Agreement Assurance Amended In progress Overall, we completed 5 audits and one change was made to the internal audit plan during fiscal year 2020-21: Audit Action Reason for Change SLO Noor Foundation FY 2019-20 Community Based Organization Added Management request Grant Agreement Page 7 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Whistleblower Hotline Results The Internal Audit Division monitors the Whistleblower Hotline, refers reports to related departments or agencies, and conducts follow-up procedures as necessary. In FY 2020-21, the Whistleblower Hotline received 48 reports of alleged fraud, waste, or abuse, a 20% increase from the prior year’s 40 reports. Reports related to employee misconduct that were not related to alleged fraud, waste, or abuse were referred to Human Resources and were not classified as substantiated or unsubstantiated. Quarterly Whistleblower Hotline reports are posted on the ACTTC website. Reports were received relating to the following categories: Page 8 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR FY 2021-22 Internal Audit Plan The Internal Audit Plan for Fiscal Year 2021-22 summarizes the audits we recommend performing during the year. The plan is based on the results calculated by our risk assessment, stakeholder input process, and available audit hours. It is important to note the plan is a working document and can be adjusted throughout the year as priorities and risks change. Individual engagement audit objectives and additional detail regarding the development of the audit plan are available in the following pages. Total Internal Audit Staff Hours Available 1 5,400 Audit Team Non-Audit Work Hours: Financial Reporting (ACFR and CFTR) and Fee Review 2,200 Administrative Tasks/Training/Vehicle Hearings/Whistleblower Hotline 600 Subtotal Non-Audit Work 2,800 Hours Available for Audit Work 2,600 Audit Staff Deployed to Support COVID-19 Disaster Service Work - Finance Division 1,000 Actual Hours Available for Audit Work 1,600 FY 2021-22 Audit Plan Estimated Type of Audit Category Audit Name Hours Engagement Mandated Workforce Innovation and Opportunity Act (DSS) - Program Year 2021-22 120 Consulting Food and Nutrition Services Reporting Validation (DSS) 110 Consulting State Worker's Compensation Insurance Fraud (District Attorney) 60 Consulting Annual Cash Shortages and Overages Report (Countywide) 40 Assurance In Progress Workforce Innovation and Opportunity Act (DSS) - Program Year 2020-21 10 Consulting Community Based Organization Grant - SLO Noor Foundation FY 2019-20 10 Assurance Follow-up Community Based Organization Grant - SLO Noor Foundation FY 2019-20 30 Assurance Cash Procedures and Internal Controls Review (District Attorney) 20 Assurance Discretionary Transient Occupancy Tax 240 Assurance Commercial Cannabis Business Tax Monitoring Program Plan 200 Assurance Food Bank Coalition of SLO County Community Based Organization Grant FY 2020-21 100 Assurance Cash and Internal Controls Department #1 100 Assurance Cash and Internal Controls Department #2 100 Assurance Cash and Internal Controls Department #3 100 Assurance Cash and Internal Controls Department #4 60 Assurance Department Requests and Consulting 300 Total Estimated Audit Hours 1,600 1 1,800 annual productive hours per staff, multiplied by 3 staff Page 9 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Engagement Objectives of the Proposed Audits The audit plan contains mandated audits, audits in progress, follow-up audits, and audits recommended for the current year, all of which align with the County’s vision, mission, and values. Mandated Audits Workforce Innovation and Opportunity Act Fiscal and Procurement Monitoring for Program Year 2021-22 (Consulting) To determine if WIOA funds used complied with federal and state laws, regulations, policies, and directives for Program Year 2021-22. Status of Claims Against Households – Food and Nutrition Services 209 Report Validation, Quarter Ended June 30, 2021 (Consulting) To validate the accuracy of the figures reported on the FNS-209 report submitted by the Department of Social Services to the State for quarter ending June 30, 2021. State Worker's Compensation Insurance Fraud Program Grant (Consulting) To determine if the District Attorney's Workers' Compensation Fraud Program is in compliance with grant award requirements and State regulations for FY 2020-21. Annual Cash Shortages and Overages Report (Assurance) To report on cash shortages and overages as required by Board Resolution 84-40 for FY 2021-22. Audits in Progress Workforce Innovation and Opportunity Act Fiscal and Procurement Monitoring for Program Year 2020-21 (Consulting) To determine if WIOA funds used complied with federal and state laws, regulations, policies, and directives for Program Year 2020-21. SLO Noor Foundation Community Based Grant Agreement (Assurance) To determine if SLO Noor Foundation satisfied the operational and financial components of the FY 2019-20 Community Based Organization Grant agreement. Page 10 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Follow-up Audits SLO Noor Foundation Community Based Grant Agreement (Assurance) To determine if the audit recommendations made in the audit report for the FY 2019- 20 grant agreement have been implemented. District Attorney Cash Procedures and Internal Controls (Assurance) To determine if the audit recommendations made in the October 2019 audit report have been implemented. Recommended Discretionary Audits Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County in calendar year 2021. Food Bank Coalition of San Luis Obispo County Community Based Organization and Preventative Health Grant FY 2020-21 (Assurance) To determine if the Food Bank Coalition of San Luis Obispo County adhered to the requirements outlined in the FY 2020-21 Community Based Organization and Preventative Health Grant. Departmental Cash Procedures and Internal Controls (Assurance) Audit objectives can vary by department but are generally performed to determine compliance with the Cash Handling Policy, establish accountability of cash on hand, and review internal controls of cash procedures. Development of Cannabis Business Tax Enforcement Program On June 22, 2021, the County Board of Supervisors approved, in concept, the Compliance Monitoring Program Plan for commercial cannabis businesses. The Plan included approval to use a third-party consultant to assist with the development of audit procedures specific to the cannabis industry. Solicitation of third-party consultants will begin in FY 2021-22, with engagements to begin after the completion of the required Plan’s fee study. The Plan also approved a full-time auditor position, funded through fees, to be fully dedicated to performing Commercial Cannabis Business Tax audits. This position will be filled after the completion of the fee study. Page 11 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Developing the Audit Plan The following guide shows the audit plan’s development process and relationship of the plan to the County’s objectives. County’s Vision, Mission, & Organizational Values Internal Audit Division’s Vision & Mission Internal Audit Internal Stakeholder Risk Audit Input Assessment Resources Proposed Audit Plan Board of Supervisors Approval Final Audit Plan Page 12 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR County Vision, Mission, and Organizational Values A Safe Community – The County will strive to create a community where all people – adults and children alike – have a sense of security and well-being, crime is controlled, fire and rescue response is timely and roads are safe. A Healthy Community – The County will strive to ensure all people in our community enjoy healthy, successful and productive lives, and have access to the basic necessities. A Livable Community – The County will strive to keep our community a good place to live by carefully managing growth, protecting our natural resources, promoting lifelong learning, and creating an environment that encourages respect for all people. A Prosperous Community – The County will strive to keep our economy strong and viable and assure that all share in this economic prosperity. A Well Governed Community – The County will provide high quality “results oriented” services that are responsive to community needs. Page 13 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Internal Audit Vision and Mission Vision Mission •We exist to inspire and elevate public trust in •Our Mission is to provide reliable, independent, government by assisting and supporting the objective evaluations and advisory services to County, the Board of Supervisors, and other County management, the Board of Supervisors, stakeholders in achieving their mission with and other stakeholders. By utilizing a transparencyandintegrity. systematic, disciplined approach, our services will add value to and improve operations. We will provide expertise to evaluate and improve the effectiveness of controls and other processes, minimize risks, and enhance operational effectiveness for stakeholders; as well as contribute to protecting and safeguardingresourcesandassets. To carry out our vision we will engage in the following core activities: We will provide excellent support to the County’s management, staff, and stakeholders by conducting independent, effective, and efficient analyses which enhance our customers’ ability to meet their objectives. We will provide reasonable assurance of accountability, transparency, and due diligence, by conducting audits and reviews of operations, programs, and projects to ensure public funds are spent appropriately and within the scope of the intended purpose. We will help to ensure public funds are used in the most efficient and effective manner through the development and monitoring of internal controls and processes. We will help to prevent fraud, waste, and abuse by continuous assessment, education, and monitoring of risk. We will help to ensure the County is in compliance with necessary reporting, monitoring and compliance requirements governed by various statutes, codes, and regulations. Page 14 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR We will ensure internal audit staff are properly trained and kept apprised of new accounting and auditing standards and best practices. We will conduct a quality assurance and improvement program which assesses the efficiency and effectiveness of the internal audit activity, including promoting effective control at a reasonable cost, and identifying opportunities for improving the internal audit activity’s performance and ability to add value. Audit Types The audits that we will perform will fall into two categories. Assurance Consulting To provide an objective assessment of evidence Advisory in nature and are generally performed at and an independent opinion or conclusion the specific request of a client. The nature and regarding an operation, function, process, system, scope of the consulting engagement are subject to or other subject matter. Such audits may focus on agreement with the client. the reliability of financial or operational information, on systems of internal control over recordkeeping, and/or the safeguarding of assets to ensure systems are adequate and effective. These audits may also include review of structures established to ensure compliance with policies, plans, procedures, laws, and regulations. Risk Assessment The risk assessment is a systematic process used to evaluate, identify, and prioritize potential audits based on the level of risk to the County. Risk is defined as the possibility of an event occurring that will have a financial or operational impact on the achievement of the County’s objectives and is measured in terms of impact and likelihood. The assessment identifies exposures that would disrupt the organization’s operations, interfere with County and departmental goals and business objectives, and serve as obstacles in the compliance of local and federal governances. Stakeholder Input Development of the plan allows for input from the Board of Supervisors, the County Administrator, departments, and other public stakeholders. At least annually, input is requested from the Board of Supervisors, the County Administrator, and departments. Page 15 of 16 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR Internal Audit Resources The Internal Audit Division consists of 3 full-time members. Collectively, staff have a broad range of professional and educational backgrounds. Staff have attained professional certifications as a Certified Public Accountant, Certified Internal Auditor and Certified Information Systems Auditor. In addition to conducting audits, the team performs a variety of other responsibilities, including, reviewing County fees and the preparation of the County’s annual financial statements and other financial State reporting. The audit plan takes into account the estimated amount of time staff will have available to perform audits. Number Total Annual Total Non- Total Disaster Total Audit of Staff Hours Available Audit Hours Service Work Hours Hours Available 3 5,400 2,800 1,000 1,600 A detailed breakout of hours is available in this audit plan on page 9. COVID-19 Impacts COVID-19 has presented two additional considerations in preparing the annual audit plan. First, overall audit hours for the year have been reduced by 1,000 hours for staff time allocated as disaster service work to assist in the County’s response to the virus in its declared state of emergency. Second, traditional in-person auditing will be reduced, or eliminated, when possible and be replaced with remote auditing. To facilitate remote auditing, technology will be used to provide alternatives to face-to-face meetings and interviews and allow for requested documentation to be shared electronically. Page 16 of 16