Internal Audit Annual Reports and Peer Reviews, Acttc Internal Audit Division FY 2021-22 Annual Report and FY 2022-23 Audit Plan

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 10/4/2022 Kari Lekvold (805) 781-4846 Tax Collector (4) SUBJECT Submittal of the FY 2021-22 Internal Audit Division Annual Report and the FY 2022-23 Audit Plan. All Districts. (5) RECOMMENDED ACTION It is recommended that the Board 1) receive, review, and file the FY 2021-22 Internal Audit Division Annual Report and 2) approve the FY 2022-23 Audit Plan. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0.00 $0.00 (10) AGENDA PLACEMENT { X } Consent { } Presentation { } Hearing (Time Est. _______) { } Board Business (Time Est.______) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances { X } N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (13) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A { } 4/5th's Vote Required { X } N/A (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY N/A No { } N/A Date _______8/24/2021__________ (17) ADMINISTRATIVE OFFICE REVIEW Zachary A. Lute (18) SUPERVISOR DISTRICT(S) All Districts Page 1 of 2 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor-Controller-Treasurer-Tax Collector DATE: 10/4/2022 SUBJECT: Submittal of the FY 2021-22 Internal Audit Division Annual Report and the FY 2022-23 Audit Plan. All Districts. RECOMMENDATION It is recommended that the Board 1) receive, review, and file the FY 2021-22 Internal Audit Division Annual Report and 2) approve the FY 2022-23 Audit Plan. DISCUSSION We are pleased to offer our annual report on the status of the County Auditor-Controller-Treasurer-Tax Collector’s Internal Audit Division in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our audit reports (page 5), a summary of the FY 2021- 22 Whistleblower Hotline reports (page 7), and our proposed FY 2022-23 Audit Plan (page 9). Along with performing audits, the Internal Audit Division’s responsibilities include monitoring the Whistleblower Hotline, reviewing departmental fee calculations, and assisting with the preparation of the Annual Comprehensive Financial Report. Our proposed FY 2022-23 Audit Plan is based on the estimated 2,520 hours available to perform audit work. This is a significant increase compared to prior year due to the fact that our disaster service worker hours have declined sharply, and the primary responsibility of the Annual Comprehensive Financial Report has been transferred out of the Division. Details on Internal Audit Resources can be found on page 16 of the report and details on our audit engagement objectives can be found on page 10 of the report. We are asking the Board to approve our proposed FY 2022-23 Audit Plan. OTHER AGENCY INVOLVEMENT/IMPACT None. FINANCIAL CONSIDERATIONS None. RESULTS A well-functioning internal audit division inspires and elevates public trust in government by assisting and supporting the County, the Board of Supervisors and other stakeholders in achieving their mission with transparency and integrity. ATTACHMENTS 1 FY 2021-22 Internal Audit Division Annual Report and FY 2023-23 Audit Plan Page 2 of 2 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Attachment #1 County of San Luis Obispo Internal Audit Division’s FY 2021-22 Annual Report and FY 2022-23 Audit Plan October 2022 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Overview We are pleased to offer our annual report on the status of the County Auditor-Controller- Treasurer-Tax Collector’s Internal Audit Division (IAD) in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. This report contains a summary of issues from our FY 2021-22 audit reports (page 4), a summary of the FY 2021-22 Whistleblower Hotline Reports (page 6), and our proposed FY 2022-23 Audit Plan (page 8). Purpose, Authority, & Responsibility The Internal Audit Division exists to inspire and elevate public trust in government by assisting and supporting the County, the Board of Supervisors, and other stakeholders in achieving their mission with transparency and integrity. We accomplish this vision by providing reliable, independent, and objective evaluations and advisory services which utilize a systematic and disciplined approach to add value and improve operations. We contribute expertise in the evaluation and enhancement of controls and other processes, minimization of risks, and enhancement of operational effectiveness for stakeholders. The authority for the Internal Audit Division is provided in California Government Code Sections 26881 and 26883. In Accordance with Government Code Section 1236, we follow the International Standards for the Professional Practice of Internal Auditing (Standards). Our responsibilities include maintaining independence and objectivity, continually enhancing our skills and knowledge, and providing consistent, clear communication as we perform our work. Our audit duties include the performance of: Assurance Audits – the main purpose of assurance audits is to provide an objective assessment of evidence and an independent opinion or conclusion regarding an operation, function, process, system, or other subject matter. Such audits may focus on the reliability of financial or operational information, on systems of internal control over recordkeeping, and/or the adequate safeguarding of assets. These audits may also include a review of controls implemented to ensure compliance with policies, plans, procedures, laws, and regulations. Examples of assurance audits completed in prior fiscal years include: Community Based Organization Grant Audits - SLO Noor Foundation Transient Occupancy Tax Collection, Reporting and Remitting Audit Page 2 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Consulting Audits – Consulting audits are advisory in nature and are generally performed at the specific request of a client. The nature and scope of the consulting engagement are subject to agreement with the client. Examples of consulting audits in prior fiscal years include: Department of Social Services’ Workforce Innovation and Opportunity Act Grant Audit District Attorney Workers’ Compensation Insurance Fraud Grant Audit In addition to our audit duties, the Internal Audit Division is responsible for: Monitoring the County’s 24/7 Whistleblower Hotline Assisting in the preparation of the County’s Annual Comprehensive Financial Report (ACFR) and acting as liaison with the external auditors Monitoring special districts’ compliance with financial audit submissions (California Government Code Section 26909) Reviewing the accuracy of departmental fee calculations and the appropriateness of methodologies used Reviewing vehicle citation appeals while serving as the County’s Vehicle Hearing Office Independence The Auditor-Controller-Treasurer-Tax Collector (ACTTC) is elected by the citizens of San Luis Obispo County, thus achieving organizational independence. The Internal Audit Division consists of one staff auditor and one Internal Audit Manager who report directly to the ACTTC. Both the ACTTC and the Internal Audit Manager have unhindered access to the County Administrative Officer and the Board of Supervisors. Each year the ACTTC, Deputy Auditor-Controller, and individual members of the Internal Audit Division affirm their independence by signing a Statement of Independence and Objectivity. Likewise, Statements of Independence are completed for each individual engagement by team members assigned to the engagement. Page 3 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Internal Audit Division Charter The Internal Audit Division Charter is the guiding document for our audit work. The Charter includes the Core Principles for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors. No updates to the Charter have occurred in the past fiscal year. Quality Assurance and Improvement Program Results The auditing Standards require that we maintain a quality assurance and improvement program consisting of both ongoing and periodic assessments of our operations and audit work to determine conformance with the Institute of Internal Auditor’s Definition of Internal Auditing, Code of Ethics, and Standards. External Assessment The Standards specify that an external assessment, also known as a peer review, be conducted every five years. Our last peer review occurred in FY 2016-17 for the period July 1, 2011, through June 30, 2016. Our next peer review will be performed in FY 2022-23 and will cover July 1, 2016, through June 30, 2022. Internal Periodic Assessment Internal assessments are performed to evaluate conformance with the Standards and the Institute of Internal Auditor’s Code of Ethics. Our last internal assessment occurred in FY 2019-20. Ongoing Monitoring The Internal Audit Division complied with the ongoing monitoring requirement through soliciting stakeholder feedback, using checklists and taking advantage of automated systems to provide assurance that processes had been followed. We also monitored project budgets and analyzed additional performance metrics, including those reported below. The results of our ongoing monitoring demonstrate that we are perceived as being professional and knowledgeable, that our work helps management improve business processes and controls, and that our recommendations are being implemented. The Internal Audit Division categorizes audit issues into two levels and provides recommendations for each issue identified. The seriousness of the issue determines the type of department response required: Findings – issues which present a serious enough risk to require consideration by management and a written response to our recommendation(s). The Internal Audit Division conducts follow-up monitoring on all issues identified as Findings. Page 4 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Verbal Recommendations – issues which are lower risk and/or a best practice that could be adopted to improve controls and/or enhance operations. Verbal Recommendations do not require a written department response and are not included in the individual engagement report. All Findings and Verbal Recommendations are discussed with the Department’s management prior to a report being issued. In most cases the department makes a change to address the issue before the audit is complete. At the end of FY 2020-21 we had three open findings that had yet to be verified as implemented. Below is a summary of our recommendations and status: Recommendation Department/Contractor Status as of 6/30/2022 Confirm patients’ eligibility status at Closed – Verified as implemented in FY 21-22 SLO Noor Foundation least every 12 months follow-up audit Closed – Not Verified. Original recommendation was modified during the FY 21-22 follow-up audit. The original Retain copies of Medi-Cal denial recommendation impeded timely dental letters for patients receiving dental SLO Noor Foundation treatment for patients with acute pain. The treatment updated recommendation requires dental patients to self-attest to not having dental insurance prior to receiving treatment. Retain support documentation for Closed – Verified as implemented in FY 21-22 SLO Noor Foundation annual report metrics follow-up audit In FY 2021-22, we issued one finding related to a financial reporting error during a departmental consulting engagement. The finding related to the untimely recognition of grant expenses. It is our understanding that our recommendation to correct the error and request a carryover of unused grant funds has been implemented. Audit findings by broad category of financial reporting errors, insufficient internal controls, and noncompliance with contracts, policies, and regulations are relatively evenly distributed over the last five fiscal years as illustrated in the chart below. Page 5 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Percentage of Audit Findings by Category for the last five Fiscal Years 31% 32% 37% Financial Reporting Errors Insuffient Internal Controls Noncompliance with Contracts, Policies, Regulations FY 2021-22 Internal Audit Plan Status The annual audit plan is intentionally created with an ambitious goal of completion and with the realistic understanding that the Division’s time is flexible and continuously changing to fit the needs of the both the ACTTC’s office and the County as a whole. COVID-19 continued to impact the audit plan in the following ways: 1. Our audit hours for FY 21-22 were reduced by 40% due to disaster service worker assignments for the Finance team of the Emergency Operations Center. 2. In-person fieldwork stopped at the onset of the pandemic. Most audits have been performed remotely. The following table details the status of the audits in the FY 2021-22 audit plan. Overall, we completed six audits and two follow ups. Page 6 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Whistleblower Hotline Results The Internal Audit Division monitors the Whistleblower Hotline, refers reports to related departments or agencies and conducts follow-up investigations as necessary. In FY 2021-22, the Whistleblower Hotline received 26 reports of alleged fraud, waste, or abuse, a 45% decrease from the prior year’s 48 reports. The 45% decrease from prior year is attributed to a high incidence of Covid-related reports received in FY 20-21. Generally, reports related to Covid-19 were referred to the Health Agency or Human Resources. Page 7 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy The FY 2021-22 reports received were related to the following categories: FY 2021-22 Whistleblower Reports by Type Other 1 Safety/Sanitation 2 Misconduct 8 Violation of Federal, State, or County 15 Regulations Reports related to employee misconduct that were not related to alleged fraud, waste, or abuse were referred to Human Resources. The remainder of the reports were either unsubstantiated, referred, not related to County operations, or did not contain sufficient information to investigate. There were no substantiated reports of fraud, waste, or abuse in FY 2021-22. Quarterly Whistleblower Hotline reports are available on the ACTTC website. FY 2021-22 Report Disposition Non-County Operations, 4 Unsubstantiated, 1 Referred1, 15 Insufficient Info Provided 1 Departments with the highest incidence of referred reports are Human Resources, Health Agency, and the Department of Social Services. Page 8 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy FY 2022-23 Internal Audit Plan The Internal Audit Plan for Fiscal Year 2022-23 summarizes the audits we recommend performing during the year. The plan is based on the results calculated by our risk assessment, stakeholder input process, and available audit hours. It is important to note the plan is a working document and can be adjusted throughout the year as priorities and risks change. Individual engagement audit objectives and additional detail regarding the development of the audit plan are available in the pages that follow. Page 9 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Engagement Objectives of the Proposed Audits The audit plan contains mandated audits, audits in progress, follow-up audits, and audits recommended for the current year, all of which align with the County’s vision, mission, and values. Mandated Audits Workforce Innovation and Opportunity Act Fiscal and Procurement Monitoring for Program Year 2022-23 (Consulting) To determine if WIOA funds used complied with federal and state laws, regulations, policies, and directives for Program Year 2022-23. State Worker's Compensation Insurance Fraud Program Grant (Consulting) To determine if the District Attorney's Workers' Compensation Fraud Program is in compliance with grant award requirements and State regulations for FY 2021-22. Annual Cash Shortages and Overages Report (Assurance) To report on cash shortages and overages as required by Board Resolution 84-40 for FY 2022- 23. Audits in Progress Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County in calendar year 2021. Recommended Discretionary Audits Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County in calendar year 2022. Cannabis Tax Compliance Monitoring Program (Assurance) On September 13, 2022, the County Board of Supervisors approved the use of a third-party consultant to assist with cannabis field audits and the development of audit procedures specific to the cannabis industry in order to determine the accuracy and completeness of the cannabis business tax revenues remitted to the County. Page 10 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Food Bank Coalition of San Luis Obispo County Community Based Organization and Preventative Health Grant FY 2021-22 (Assurance) To determine if the Food Bank Coalition of San Luis Obispo County adhered to the requirements outlined in the FY 2021-22 Community Based Organization and Preventative Health Grant. Countywide IT Audit (Assurance) To determine if specific Countywide IT policies and procedures were adhered to and adequate controls were maintained throughout the County. Countywide Cal-Card Audit (Assurance) To determine if adequate controls were maintained for the Program and if Cal-Card Program policies were adhered to. Concessionaire Audit (Assurance) To determine if the concessionaire’s internal controls were adequate to safeguard and account for cash receipts and whether rent payments were timely and accurately remitted to the County. Departmental Cash Procedures and Internal Controls (Assurance) Audit objectives can vary by department but are generally performed to determine compliance with the Cash Handling Policy, establish accountability of cash on hand, and review internal controls of cash procedures and other applicable controls testing as deemed necessary. Page 11 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Developing the Audit Plan The following guide shows the audit plan’s development process and relationship of the plan to the County’s objectives. Page 12 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy County Vision, Mission, and Organizational Values A Safe Community – The County will strive to create a community where all people – adults and children alike – have a sense of security and well-being, crime is controlled, fire and rescue response is timely and roads are safe. A Healthy Community – The County will strive to ensure all people in our community enjoy healthy, successful and productive lives, and have access to the basic necessities. A Livable Community – The County will strive to keep our community a good place to live by carefully managing growth, protecting our natural resources, promoting lifelong learning, and creating an environment that encourages respect for all people. A Prosperous Community – The County will strive to keep our economy strong and viable and assure that all share in this economic prosperity. A Well Governed Community – The County will provide high quality “results oriented” services that are responsive to community needs. Page 13 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Internal Audit Vision and Mission Purpose Mission •We exist to inspire and elevate public trust in •Our Mission is to provide reliable, independent, governmentbyassistingandsupportingtheCounty, objective evaluations and advisory services to County the Board of Supervisors, and other stakeholders in management, the Board of Supervisors, and other achieving their mission with transparency and stakeholders. By utilizing a systematic, disciplined integrity. approach, our services will add value to and improve operations. We will provide expertise to evaluate and improve the effectiveness of controls and other processes, minimize risks, and enhance operational effectiveness for stakeholders; as well as contribute to protectingandsafeguardingresourcesandassets. To carry out our vision we will engage in the following core activities: We will provide excellent support to the County’s management, staff, and stakeholders by conducting independent, effective, and efficient analyses which enhance our customers’ ability to meet their objectives. We will provide reasonable assurance of accountability, transparency, and due diligence, by conducting audits and reviews of operations, programs, and projects to ensure public funds are spent appropriately and within the scope of the intended purpose. We will help to ensure public funds are used in the most efficient and effective manner through the development and monitoring of internal controls and processes. We will help to prevent fraud, waste, and abuse by continuous assessment, education, and monitoring of risk. We will help to ensure the County is in compliance with necessary reporting, monitoring and compliance requirements governed by various statutes, codes, and regulations. We will ensure internal audit staff are properly trained and kept apprised of new accounting and auditing standards and best practices. We will conduct a quality assurance and improvement program which assesses the efficiency and effectiveness of the internal audit activity, including promoting effective control at a reasonable cost, and identifying opportunities for improving the internal audit activity’s performance and ability to add value. Page 14 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Risk Assessment The risk assessment is a systematic process used to evaluate, identify, and prioritize potential audits based on the level of risk to the County. The audit universe, a range of auditable components is reviewed and updated. An excerpt of the County’s audit universe is included in the illustration below. Risk is defined as the possibility of an event occurring that will have a financial or operational impact on the achievement of the County’s objectives and is measured in terms of impact and likelihood. The assessment identifies exposures that would disrupt the organization’s operations, interfere with County and departmental goals and business objectives, and serve as obstacles in the compliance of local and federal governances. Stakeholder Input Development of the plan allows for input from the Board of Supervisors, the County Administrator, departments, and other public stakeholders. At least annually, input is requested from the Board of Supervisors, the County Administrator, and departments. Page 15 of 16 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Internal Audit Resources Prior to FY 22-23, the Internal Audit Division was responsible for a variety of non-audit related tasks, such as the preparation of the Annual Comprehensive Financial Report. As such, the Division has most recently consisted of three to four full-time employees. Effective for FY 22-23, one full- time position as well as the preparation of the Annual Comprehensive Financial Report was transferred from the Internal Audit Division to the newly created Financial Reporting Division. This change allows the Internal Audit Division to focus on their primary purpose of auditing. The graph below illustrates the effect of the new division of labor; it visually depicts the increase in audit hours despite the decrease of a full-time position. Internal Audit Division Audit Plans Hours and FTEs 4500 6 4000 5 3500 3000 4 2500 3 2000 1500 2 1000 1 500 0 0 2017-18 2018-19 2019-20 2020-21 2021-22 2022-23 # of Audit Hours in Audit Plan # of FTEs Page 16 of 16