Internal Audit Annual Reports and Peer Reviews, Acttc Internal Audit Division FY 2023-24 Annual Report and FY 2024-26 Audit Plan

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 7/8/2025 Jim Hamilton (805) 781-5043 Tax Collector Kari Lekvold (805) 781-4846 (4) SUBJECT Request to 1) receive, review, and file the FY 2023-24 Internal Audit Division Annual Report, Employee Procurement Card Fraud Investigation Final Report, and CliftonLarsonAllen LLP Procurement Card Assessment; 2) approve the attached Multi-Year Audit Plan; and 3) provide direction as necessary. (5) RECOMMENDED ACTION It is recommended that the Board: 1. Receive, review, and file the attached FY 2023-24 Internal Audit Division Annual Report (Attachment #1), Employee Procurement Card Fraud Investigation Final Report (Attachment #2), and CliftonLarsonAllen LLP Procurement Card Process Assessment (Attachment #3); 2. Approve the Multi-Year Audit Plan (Attachment #1); and 3. Provide direction as necessary. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0.00 $0.00 (10) AGENDA PLACEMENT { x } Consent { } Presentation { } Hearing (Time Est. _______) { } Board Business (Time Est.______) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances { x } N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (13) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A { } 4/5th's Vote Required { x } N/A (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY N/A No { } N/A Date _1/23/2024___________ (17) ADMINISTRATIVE OFFICE REVIEW Zachary A. Lute (18) SUPERVISOR DISTRICT(S) Page 1 of 3 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor-Controller-Treasurer-Tax Collector DATE: 7/8/2025 SUBJECT: Request to 1) receive, review, and file the FY 2023-24 Internal Audit Division Annual Report, Employee Procurement Card Fraud Investigation Final Report, and CliftonLarsonAllen LLP Procurement Card Assessment; 2) approve the attached Multi-Year Audit Plan; and 3) provide direction as necessary. RECOMMENDATION It is recommended that the Board: 1. Receive, review, and file the attached FY 2023-24 Internal Audit Division Annual Report (Attachment #1), Employee Procurement Card Fraud Investigation Final Report (Attachment #2), and CliftonLarsonAllen LLP Procurement Card Process Assessment (Attachment #3); 2. Approve the Multi-Year Audit Plan (Attachment #1); and 3. Provide direction as necessary. DISCUSSION We are pleased to offer our FY 2023-24 annual report on the status of the County Auditor-Controller-Treasurer-Tax Collector’s Internal Audit Division. This report contains a status on our FY 2023-24 Audit Plan, a summary of the FY 2023-24 Whistleblower Hotline reports, and our proposed FY 2024-26 Audit Plan. We are asking the Board to approve our proposed Multi-Year Audit Plan. In addition, we’ve included the Internal Audit division’s Final Report on an Employee Procurement Card Fraud Investigation. This report presents the findings of the employee Procurement Card investigation and outlines the corrective actions taken in response. After a criminal investigation into misuse of a County Procurement Card, the Internal Audit Division initiated a comprehensive review of the County’s Procurement Card program, partnering with our external audit firm to support the effort. The attached CliftonLarsonAllen LLP Procurement Card Process Assessment details the scope of work completed with the audit firm, the procedures performed, key observations, and actionable recommendations for the County to consider. As a result of the criminal investigation and program review, the ACTTC has implemented several key safeguards to prevent future misuse, including mandatory segregation of duties, enhanced data analytics and continuous Page 2 of 3 monitoring of activity, and expanded training for all employees involved in Procurement Card processes. These policy changes are detailed in the Employee Procurement Card Fraud Investigation Final Report. OTHER AGENCY INVOLVEMENT None. FINANCIAL CONSIDERATIONS None. RESULTS A well-functioning Internal Audit Division inspires and elevates public trust in government by assisting and supporting the County, the Board of Supervisors and other stakeholders in achieving their mission with integrity and accountability. ATTACHMENTS 1 FY 2023-24 Internal Audit Division Annual Report and Multi-Year Audit Plan 2 Employee Procurement Card Fraud Investigation Final Report 3 CliftonLarsonAllen LLP Procurement Card Process Assessment Page 3 of 3 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Attachment #1 County of San Luis Obispo Internal Audit Division’s FY 2023-24 Annual Report and FY 2024-26 Biennial Audit Plan June 2025 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Overview We are pleased to offer our annual report on the status of the County Auditor-Controller- Treasurer-Tax Collector’s Internal Audit Division (IAD) in accordance with the International Standards for the Professional Practice of Internal Auditing requirements. A report on the FY 2023- 24 Audit Plan is included on page 6, a summary of the FY 2023-24 Whistleblower Hotline Reports is included on pages 6-8, and our proposed FY 2024-26 Multi-Year Audit Plan is included on page 9. Purpose, Authority, & Responsibility The Internal Audit Division exists to inspire and elevate public trust in government by assisting and supporting the County, the Board of Supervisors, and other stakeholders in achieving their mission with transparency and integrity. We accomplish this vision by providing reliable, independent, and objective evaluations and advisory services which utilize a systematic and disciplined approach to add value and improve operations. We contribute expertise in the evaluation and enhancement of internal controls, minimization and mitigation of risks, and enrichment of operational effectiveness for stakeholders. The authority for the Internal Audit Division is provided in California Government Code Sections 26881 and 26883. In Accordance with Government Code Section 1236, we currently follow the International Standards for the Professional Practice of Internal Auditing (Standards). Our responsibilities include maintaining independence and objectivity, continually enhancing our skills and knowledge, and providing consistent, clear communication as we perform our work. Our audit duties include the performance of: Assurance Audits – the main purpose of assurance audits is to provide an objective assessment of evidence and an independent opinion or conclusion regarding an operation, function, process, system, or other subject matter. Such audits may focus on the reliability of financial or operational information, on systems of internal control over recordkeeping, and/or the adequate safeguarding of assets. These audits may also include a review of controls implemented to ensure compliance with policies, plans, procedures, laws, and regulations. Examples of assurance audits completed in prior fiscal years include: Cannabis Tax Compliance Audits Departmental Cash and Internal Control Audits Page 2 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Transient Occupancy Tax Collection Audits Consulting Audits – Consulting audits are advisory in nature and are generally performed at the specific request of a client. The nature and scope of the consulting engagement are subject to agreement with the client. Examples of consulting audits in prior fiscal years include: Department of Social Services’ Workforce Innovation and Opportunity Act Grant Audit In addition to our audit duties, the Internal Audit Division is responsible for: Monitoring the County’s 24/7 Whistleblower Hotline, investigating and following up as needed Assisting in the preparation of the County’s Treasury’s quarterly Statement of Assets reviews Acting as liaison with the external auditors Monitoring special districts’ compliance with financial audit submissions (California Government Code Section 26909) Enterprise Financial System segregation of duties monitoring and investigation Reviewing departmental fee calculations for accuracy and appropriate methodology Managing the Countywide Cash Handling Policy, reviewing departmental cash overages, and approving departmental requests for relief from routine cash shortages Consulting on internal control implementation and updates Performing departmental inventory observations Serving as the County’s Vehicle Hearing Officer Page 3 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Independence The Auditor-Controller-Treasurer-Tax Collector (ACTTC) is elected by the citizens of San Luis Obispo County, thus achieving organizational independence. The Internal Audit Division consists of one staff auditor and one Internal Audit Manager who report directly to the ACTTC. Both the ACTTC and the Internal Audit Manager have unhindered access to the County Administrative Officer and the Board of Supervisors. Each year the ACTTC, Deputy Auditor-Controller, and individual members of the Internal Audit Division affirm their independence by signing a Statement of Independence and Objectivity. Likewise, Statements of Independence are completed for each individual engagement by team members assigned to the engagement. Internal Audit Division Charter The Internal Audit Division Charter is the guiding document for our audit work. The Charter includes the Core Principles for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors. No updates to the Charter have occurred in the past fiscal year. Quality Assurance and Improvement Program Results The auditing Standards require that we maintain a quality assurance and improvement program consisting of both ongoing and periodic assessments of our operations and audit work to determine conformance with the Institute of Internal Auditor’s Definition of Internal Auditing, Code of Ethics, and Standards. External Assessment The Standards specify that an external assessment, also known as a peer review, be conducted every five years. Our last peer review occurred in FY 2022-23 for the period July 1, 2016, through June 30, 2022. The Internal Audit Division was awarded a Certificate of Compliance , the highest possible rating, from the Association of Local Government Auditors recognizing that the organization’s internal quality control system was suitably designed and operating effectively to provide reasonable assurance of compliance with the International Standards for the Professional Practice of Internal Auditing for assurance and consulting engagements during the audit period. Our next peer review will be performed in FY 2027-28 and will cover July 1, 2022, through June 30, 2027. Internal Periodic Assessment Internal assessments are performed to evaluate conformance with the Standards and the Institute of Internal Auditor’s Code of Ethics. Our recent internal assessment is underway and will Page 4 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy ensure the effective implementation of the new Global Standards for the Professional Practice of Internal Auditing. Ongoing Monitoring The Internal Audit Division complied with the ongoing monitoring requirement through soliciting stakeholder feedback, using checklists and taking advantage of automated systems to provide assurance that processes had been followed. We also monitored project budgets and analyzed additional performance metrics, including those reported below. The results of our ongoing monitoring demonstrate that we are perceived as being professional and knowledgeable, that our work helps management improve business processes and controls, and that our recommendations are being implemented. The Internal Audit Division categorizes audit issues into two levels and provides recommendations for each issue identified. The seriousness of the issue determines if a departmental response is required: Findings – issues which present a serious enough risk to require consideration by management and a written response to our recommendations. The Internal Audit Division conducts follow-up monitoring on all issues identified as Findings. Verbal Recommendations – issues which are lower risk and/or a best practice that could be adopted to improve controls and/or enhance operations. Verbal Recommendations do not require a written department response and are not included in the engagement report. All Findings and Verbal Recommendations are discussed with the Department’s management prior to a report being issued. In most cases the department makes a change to address the issue before the audit is complete. If not, then Findings are followed up within six to twelve months. FY 2023-24 Internal Audit Plan Status The annual audit plan is intentionally created with an ambitious goal of completion and with the realistic understanding that the Division’s time is flexible and continuously changing to adapt to the needs of the ACTTC’s office and the County as a whole. The following table details the status of the audits in the FY 2023-24 audit plan. Page 5 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Report on FY 2023-24 Audit Plan Type of Engagement Category Audit Name Engagement Status Mandated Annual Cash Shortages and Overages Report (Countywide) Assurance Completed Food and Nutrition Services Reporting Validation (DSS) Consulting Completed State Worker's Compensation Insurance Fraud (District Attorney) Consulting Completed Workforce Innovation and Opportunity Act Grant Audit (DSS) Assurance Completed In Progress Cannabis Tax Compliance Audits (3 establishments) Assurance In progress Cash and Internal Controls Audit - Health Agency Public Guardian Assurance In progress Cash and Internal Controls Audit - Planning Department Assurance Completed Countywide Procurement Card Process Assessment Assurance In progress Follow-up Cash and Internal Controls Audit - Child Support Services Assurance Completed Discretionary Cannabis Tax Compliance Audits Assurance Completed Cash and Internal Controls Departmental Audits Assurance Carried forward Concessionaire Audit Assurance Carried forward Countywide IT Audit Assurance Carried forward Countywide Special Pay Audit Assurance Carried forward Whistleblower Hotline Results The Internal Audit Division monitors the Whistleblower Hotline, refers reports to related departments or agencies and conducts follow-up investigations as necessary. In FY 2023-24, the Whistleblower Hotline received 46 reports, a 130% increase from the prior year’s 20 reports. 50% of the reports received were referred to other County departments. All but two of the reports were received directly through the Whistleblower Hotline. 20 of the 46 reports received were submitted anonymously. Three of the reports were investigated by the District Attorney’s office. Page 6 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy The FY 2023-24 reports received were related to the following categories: Reports related to employee misconduct that were not related to alleged fraud, waste, or abuse were referred to Human Resources. The remainder of the reports were either referred, not related to County operations, unsubstantiated or did not contain sufficient information to investigate. Quarterly Whistleblower Hotline reports are available on the ACTTC website. 1 Departments with the highest incidence of referred reports for the fiscal year are Human Resources, Health Agency, and the Sheriff’s Department. Page 7 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy In addition to matters originating from the Whistleblower Hotline, the Internal Audit Division also aided with the investigation of an internal report alleging the misappropriation of County funds by a county employee. Details for that investigation are attached as special attachments to this report. Two of the FY 2023-24 Whistleblower reports resulted in employee terminations and resulted in enhanced internal controls and policy definition at the department level. FY 2024-26 Internal Audit Plan- Introduction of the Multi-Year Audit Plan The purpose of the multi-year audit plan is to offer a longer-term, flexible view of audit coverage that can adapt to changing priorities and resource needs as new risks emerge over time. The Internal Audit Plan for Fiscal Year 2024-26 summarizes the audits we recommend performing during the fiscal years. The plan is based on the results calculated by our Countywide risk assessment, stakeholder input process, and available audit hours based on two full-time equivalents. It is important to note the plan is a working document and can be adjusted throughout the year as priorities and risks change. Page 8 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy FY 2024-26 Audit Plan Type of Category Audit Name Engagement Mandated Annual Cash Shortages and Overages Report (Countywide) Assurance Workforce Innovation and Opportunity Act Grant Audit (DSS) FY 24-25 & 25-26 Assurance Food and Nutrition Services Reporting Validation (DSS) FY 24-25 Consulting Internal Quality Assurance and Improvement Program N/A In Progress Cannabis Tax Compliance Audits Assurance Cash and Internal Controls Audit - Health Agency Public Guardian Assurance Cash and Internal Controls Audit - Planning Department Follow-up Assurance Countywide Procurement Card Process Assessment Assurance Follow-up Cash and Internal Controls Audit - Health Agency Public Guardian FY 25-26 Assurance Countywide Procurement Card Process Assessment FY 25-26 Assurance Discretionary Transient Occupancy Tax Audits Assurance Cannabis Tax Compliance Audits Assurance Cash and Internal Controls Departmental A Assurance Concessionaire Audit Assurance Countywide IT Audit Assurance Countywide Special Pay Audit Engagement Objectives of the Proposed Audits The audit plan contains mandated audits, audits in progress, a follow-up audit, and audits recommended for the current year, all of which align with the County’s vision, mission, and values. Mandated Audits Annual Cash Shortages and Overages Report (Assurance) To report on Countywide cash shortages and overages as required by Board Resolution 84- 40 for FY 2024-25 and FY 2025-26. Food and Nutrition Services 209 Report Validation - Status of Claims Against Households, Quarter Ended June 30, 2025 (Consulting) To validate the accuracy of the figures reported on the FNS-209 report submitted by the Department of Social Services to the State for quarter ending June 30, 2025. Page 9 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Workforce Innovation and Opportunity Act Fiscal and Procurement Monitoring for Program Year 2024-25 and 2025-26 (Consulting) To determine if WIOA funds used complied with federal and state laws, regulations, policies, and directives for Program Year 2024-25 and 2025-26. Internal Quality Assurance and Improvement Program (Assurance) To ensure conformance with professional standards, enhance the efficiency and effectiveness of the internal audit activity, and provide stakeholders with assurance that the audit function is operating at a high level of quality and integrity. Audits in Progress Cannabis Tax Compliance Monitoring Program (Assurance) To determine the accuracy of Cannabis Business Tax (CBT) amounts remitted to the County. On September 13, 2022, the County Board of Supervisors approved the use of a third-party consultant to assist with cannabis business tax audits. Departmental Cash and Internal Controls Audits (Assurance) Audit objectives can vary by department but are generally performed to determine compliance with the Cash Handling Policy, establish accountability of cash on hand, and review internal controls of cash procedures and other applicable controls testing as deemed necessary. Countywide Procurement Card Process Assessment (Assurance) To determine if the County is in compliance with Cal-Card program policies and if adequate internal controls were maintained over the Program. Follow-up Audit Departmental Cash and Internal Controls Audits (Assurance) – Health Agency Public Guardian To determine if the audit recommendations made in the audit report have been implemented. Countywide Procurement Card Process Assessment (Assurance) To determine if the audit recommendations made in the audit report have been implemented. Page 10 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Recommended Discretionary Audits Transient Occupancy Tax (Assurance) To determine the accuracy of Transient Occupancy Tax (TOT), Tourism Marketing District (TMD), and Business Improvement District (BID) amounts remitted to the County. Cannabis Tax Compliance Monitoring Program (Assurance) To determine the accuracy of Cannabis Business Tax (CBT) amounts remitted to the County. On September 13, 2022, the County Board of Supervisors approved the use of a third-party consultant to assist with cannabis business tax audits. Departmental Cash and Internal Controls Audits (Assurance) Audit objectives can vary by department but are generally performed to determine compliance with the Cash Handling Policy, establish accountability of cash on hand, and review internal controls of cash procedures and other applicable controls testing as deemed necessary. Concessionaire Audit (Assurance) To determine if the concessionaire’s internal controls were adequate to safeguard and account for cash receipts and if concessionaire payments were timely and accurately remitted to the County. Countywide IT Audit (Assurance) To determine if specific Countywide IT policies and procedures were adhered to and adequate controls were maintained throughout the County. Countywide Special Pay Audit (Assurance) To determine if policies and procedures were in place to validate and monitor special pay and were being adhered to within the scope of applicable MOU’s. Page 11 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Developing the Audit Plan The following guide shows the ongoing process for developing the audit plan. The audit plan is developed to enhance integrity and accountability and to contribute to the County’s vision of a well-governed community. County's Values, Mission & Organizational Values Internal Audit Board of Supervisors Division's Vision & Mission Proposed Internal Audit Risk Audit Assessment Plan Internal Audit Stakeholder Resources Input Page 12 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy County Vision, Mission, and Organizational Values Organizational Values Integrity. We are dedicated to high ethical and moral standards and uncompromising honesty in our dealings with the public and each other. We behave in a consistent manner with open, truthful communication, respecting commitments and being true to our word. Collaboration. We celebrate teamwork by relying on the participation and initiative of every employee. We work cooperatively within and between departments and the public to address issues and achieve results. Professionalism. We are each personally accountable for the performance of our jobs in a manner which bestows credibility upon ourselves and our community. We consistently treat customers, each other, the County, and the resources entrusted to us with respect and honesty. Accountability. We assume personal responsibility for our conduct and actions and follow through on our commitments. We are responsible managers of available fiscal and natural resources. Page 13 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Responsiveness. We provide timely, accurate and complete information to each other and those we serve. We solicit feedback from customers on improving programs and services as part of a continuous improvement process. Our Vision and Community-wide Results A Safe Community: The County will strive to create a community where all people – adults and children alike – have a sense of security and well-being, crime is controlled, fire and rescue response is timely and roads are safe. A Healthy Community: The County will strive to ensure all people in our community enjoy healthy, successful and productive lives, and have access to the basic necessities. A Livable Community: The County will strive to keep our community a good place to live by carefully managing growth, protecting our natural resources, promoting lifelong learning, and creating an environment that encourages respect for all people. A Prosperous Community: The County will strive to keep our economy strong and viable and assure that all share in this economic prosperity. A Well Governed Community: The County will provide high quality “results oriented” services that are responsive to community needs. Internal Audit Vision and Mission Purpose Mission We exist to inspire and elevate public trust in Our Mission is to provide reliable, independent, governmentbyassistingandsupportingtheCounty, objective evaluations and advisory services to County the Board of Supervisors, and other stakeholders in management, the Board of Supervisors, and other achieving their mission with transparency and stakeholders. By utilizing a systematic, disciplined integrity. approach, our services will add value to and improve operations. We will provide expertise to evaluate and improve the effectiveness of controls and other processes, minimize risks, and enhance operational effectiveness for stakeholders; as well as contribute to protectingandsafeguardingresourcesandassets. Page 14 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy To carry out our vision we will engage in the following core activities: We will provide excellent support to the County’s management, staff, and stakeholders by conducting independent, effective, and efficient analyses which enhance our customers’ ability to meet their objectives. We will provide reasonable assurance of accountability, transparency, and due diligence, by conducting audits and reviews of operations, programs, and projects to ensure public funds are spent appropriately and within the scope of the intended purpose. We will help to ensure public funds are used in the most efficient and effective manner through the development and monitoring of internal controls and processes. We will help to prevent fraud, waste, and abuse by continuous assessment, education, and monitoring of risk. We will help to ensure the County is in compliance with necessary reporting, monitoring and compliance requirements governed by various statutes, codes, and regulations. We will ensure internal audit staff are properly trained and kept apprised of new accounting and auditing standards and best practices. We will conduct a quality assurance and improvement program which assesses the efficiency and effectiveness of the internal audit activity, including promoting effective control at a reasonable cost, and identifying opportunities for improving the internal audit activity’s performance and ability to add value. Risk Assessment The risk assessment is a systematic process used to evaluate, identify, and prioritize potential audits based on the level of risk to the County. The audit universe, a range of auditable components is reviewed and updated. An excerpt of the County’s audit universe is included in the illustration below. Risk is defined as the possibility of an event occurring that will have a financial or operational impact on the achievement of the County’s objectives and is measured in terms of impact and likelihood. The assessment identifies exposures that would disrupt the organization’s operations, interfere with County and departmental goals and business objectives, and serve as obstacles in the compliance of local and federal governances. Stakeholder Input Development of the plan allows for input from the Board of Supervisors, the County Administrator, departments, and other public stakeholders. At least annually, input is requested from the Board of Supervisors, the County Administrator, and departments. Page 15 of 15 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Attachment #2 County of San Luis Obispo Internal Audit Division Employee Procurement Card Fraud Investigation Final Report July 2025 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 6 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Case Background In September 2023 the ACTTC’s Internal Audit division became aware of suspected fraudulent activity on a county Procurement Card used by a county employee. Examination of records obtained independently from vendors by ACTTC’s Internal Audit unit did indicate transactions for non-county business, many with altered documentation presented to department officials for payment approval. The ACTTC reported the findings to the District Attorney and proceeded with further examination of historical records in collaboration with District Attorney investigators. The expanded investigation produced numerous instances of suspicious transactions by the employee, spanning several years. The investigation culminated in a prosecution by the District Attorney for misappropriation of public funds, receiving a guilty plea and a sentence of six years in state prison, and a court order to pay restitution to the County. In addition, since the felonies were committed during the performance of official County duties, the employee forfeited future Pension benefits accrued during the commission of the felonies pursuant to the California Public Employees' Pension Reform Act (PEPRA) enacted in 2013. Subsequent Countywide Procurement Card Program Review Upon conclusion of the criminal investigation, the Internal Audit division shifted efforts to a countywide review of departmental Procurement Card process and practices, engaging the County’s independent audit firm for assistance. The outcome of that review is documented in a report attached with this item containing multiple procedural and monitoring enhancements to consider. For historical background, the County has used Procurement Cards (aka Cal-Cards) for many years, and in 2003 the Central Services Purchasing division issued the Purchasing Card Program policy manual. The policy establishes baseline administrative procedures, internal controls, and approval requirements which County Departments must follow in using Procurement Cards. In recent years the use of Procurement Cards by County departments has grown significantly, both for administrative efficiencies and in some cases because credit cards are the only form of payment accepted by vendors. The County also saw the use of Procurement Cards expand Page 2 of 6 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy significantly during the pandemic due to remote work needs and a shift towards paperless transactions. Review of Procurement Card transactions has been conducted by the ACTTC’s Internal Audit division as part of its Cash Control audit program, however, due to the growing amount of activity, the need for expanded reviews has been a regular item in the ACTTC’s annual audit plan competing with other demands on Internal Audit’s capacity. For the review, the ACTTC engaged its independent audit firm CliftonLarsonAllen LLP (CLA) in April 2024 to collaborate in defining procedures and scope. The engagement began with data analysis including 58,025 credit card transactions over a 6-year period, from 357 cardholders totaling over $16M, across 25 departments. From these transactions nine individual departments were selected for in-depth process reviews with specific transitions flagged for examination. Department reviews included in-person interviews, procedural observations, and transaction testing for compliance with County policies. While the review was not intended to identify improper use of credit cards, no instances of improper transactions were noted during the review. The intent was to evaluate credit card practices and did identify numerous opportunities for strengthened controls, oversight, and monitoring. In many cases procedures observed in certain departments were identified as recommended practices for rollout across departments. CliftonLarsonAllen LLP’s final report (attached) details the scope of work, procedures performed, observations, and recommendations in the following broad categories: • Suggested Policy Updates • Suggested Best Practice Guidance to Departments • Training for Cardholders • Training for Accountants (Approvers or Coordinators) • Training for Operational Approvers • Training for Department Heads All report recommendations are under consideration by the ACTTC and the Central Services Purchasing division for implementation. Each will be evaluated with consideration to cost/benefit, feasibility for departments, and the County’s risk tolerance, however, the following three areas Page 3 of 6 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy have been elevated as the utmost priority for implementation and will form the foundational controls over the County’s Procurement Card program going forward: #1 - Mandatory Separation of Duties for Procurement Card Purchases During its review, the ACTTC observed instances where individual department staff were performing all stages of a purchasing transaction, including independent control over the submission of supporting documentation to the department’s designated “Approving Official” for review and transmission to the ACTTC for payment. The ability for one individual to control an entire transaction chain greatly limits the opportunity for checks and balances and increases the likelihood that improper transactions may go undetected. Going forward, individual credit card purchases will require certifying signatures by no less than two individuals within the transaction chain (requested by, ordered by, received by, etc.) for review by the department’s “Approving Official” before presentment to the ACTTC for payment. Additional signatures may be required for high-risk purchases such as portable technology or high-dollar purchases (and departments may institute additional sign-off requirements). Electronic signature tools (such as Adobe) will be leveraged to make signature captures efficient for department processing and will also provide a permanent electronic log of signatures for review by Internal Audits. The ACTTC will work individually with Departments to institute this new requirement over the coming months. #2 - Continuous Monitoring of Procurement Card Transactions A significant outcome of the review was the development of a Power-BI transaction analytics tool which the ACTTC is now using to centrally monitor Department Credit Card activity on an ongoing basis. Initially built by CLA to analyze historical transactions for identification of test cases for the review engagement, the tool was expanded (with the assistance from County IT staff) to intake transactions directly from the Procurement Card processor on a monthly basis for monitoring by the ACTTC. Page 4 of 6 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy This level of transaction detail was not previously available to the ACTTC without requesting paper backup from departments, and could only be reviewed manually on a case-by-case basis. The Power-BI tool enables the automated analysis of large volumes of native transactions and flags anomalies based on criteria set by the Internal Audits unit for further review. Another limitation to centralized transaction monitoring was the practice of storing source documentation (invoices, etc.) in paper form off-site in department locations. The only data provided to the ACTTC was summarized credit card statements submitted with the department’s approval to pay. Supporting paper invoices were not provided to the ACTTC due to practical limitations such as limited technical scanning and electronic storage capabilities, physical storage space, and efforts for department staff to copy, attach, and deliver paper support to the downtown ACTTC office. As part of the review, new procedures have been developed leveraging current paperless scanning technologies most departments are now using. Going forward, electronic scans of all individual transaction invoices will be required with Purchasing Logs provided to the ACTTC for payment. This will allow the ACTTC to efficiently and independently review any transactions flagged by the analytical tool. The ACTTC will work individually with Departments to institute this new requirement over the coming months. #3 - Expanded User and Approver Training Programs Ongoing training is a critical element to support compliance with all fiscal policies, particularly given staff turnover in Departments. Procurement Card policy guidance currently exists only in the form of the 2003 written policy document. Capabilities for on-demand video training curriculum, with Q&A and course completion logs, are being explored by Central Services’ Purchasing division and ACTTC, with the support of Human Resources Learning and Development Center, with the goal of developing a variety of training and policy reinforcement tools. Additionally, the ACTTC will add Procurement Card policy overviews to the annual fiscal training session delivered to Department fiscal staff. Page 5 of 6 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy While no system of internal controls can provide absolute assurance that no fraud will occur, we believe these policy and procedure enhancements will greatly enhance the oversight of Procurement Card purchases across County departments, in an administratively efficient manner for department operations. The ACTTC wishes to express its appreciation to the District Attorney, County Counsel and Human Resources departments for their professionalism and collaboration throughout the investigation, as well as the Central Services Department and CliftonLarsonAllen LLP for their collaboration in the development of policy improvements outlined in this report. Page 6 of 6 Attachment #3 County of San Luis Obispo Procurement Card Process Assessment September 6, 2024 Prepared by: Ryan Merryman, CPA/CFF/CITP, CFE Ayla Grady, CPA, CFE CliftonLarsonAllen LLP Page 1 of 19 CliftonLarsonAllen LLP CLAconnect.com September 6, 2024 James Hamilton, CPA, Auditor-Controller Office of the Auditor-Controller-Treasurer-Tax Collector County of San Luis Obispo 1055 Monterey Street, Room D290, San Luis Obispo, CA 93408-1003 RE: Procurement Card Process Assessment Dear Mr. Hamilton: CliftonLarsonAllen LLP was retained by the County of San Luis Obispo (“SLO County”), to perform risk assessment procedures and provide consultation services with regard to the above referenced matter. We have been asked to provide our services in this matter specifically related to, but not limited to, a risk assessment of the procurement card usage and processes at a selection of SLO County departments. The purpose of this report is to summarize the results of our work, including the risk areas identified and recommendations for improvements to processes to help mitigate the risks of significant fraud. We performed our engagement in accordance with the Statement on Standards for Consulting Services, Consulting Services: Definitions and Standards (codified as CS Section 100 in AICPA Professional Standards) of the American Institute of Certified Public Accountants (“AICPA”). In consulting engagements, the nature and scope of work is determined solely by the agreement between the practitioner (CLA) and the client (SLO County). This report does not constitute an audit, compilation, or review, in accordance with standards of the AICPA, the objective of which would be the expression of an opinion on any specified elements, accounts, or items. Accordingly, CLA does not express such an opinion. Because of the unique nature of fraud, and because our engagement was limited to the matters described in the Statement of Work, fraud and/or financial irregularities may exist within the organization that we may not have identified during the performance of our procedures. However, if during the performance of our services other matters had come to our attention suggesting possible financial improprieties and/or irregularities, we would have communicated such matters to SLO County. Respectfully submitted, CliftonLarsonAllen LLP Ryan Merryman, CPA/CFF/CITP, CFE Ayla Grady, CPA, CFE Principal Manager ©2020 CliftonLarsonAllen LLP | ii Page 2 of 19 TABLE OF CONTENTS Table of Contents 1. Executive Summary ............................................................................................................. 1 2. Scope of Work ..................................................................................................................... 2 3. Professional Standards Followed by CliftonLarsonAllen ..................................................... 4 4. Summary of Work Performed ............................................................................................. 5 5. Observations ........................................................................................................................ 7 A. Assessment of Department Processes ................................................................................. 7 B. Results from Sample Testing ................................................................................................ 8 6. Recommendations ............................................................................................................. 13 A. Countywide Purchasing Card Policy Considerations .......................................................... 13 B. Countywide Training for Departments Using Purchasing Cards ........................................ 14 C. General Recommendations ............................................................................................... 15 ©2020 CliftonLarsonAllen LLP | iii Page 3 of 19 EXECUTIVE SUMMARY | 1 1. Executive Summary On April 24, 2024, the County of San Luis Obispo (“SLO County”) retained CliftonLarsonAllen LLP (“CLA”) to perform a process assessment related to procurement cards in use at several departments within SLO County. CLA assessed the processes in place at nine of SLO County’s 25 departments by interviewing 26 individuals in various roles within those departments. CLA also selected a sample of 61 transactions from procurement card holders in those departments and obtained and reviewed the supporting documentation provided by the respective departments. Additionally, we obtained and reviewed the procurement card policies in place during the scope period of the previous six fiscal years, July 1, 2018, through June 30, 2024. CLA collaborated with our data analytics team to analyze the procurement card activity for all departments for the scope period. The analysis performed informed the department selection for process review and sample transaction testing. Additionally, the data analytics team prepared a Power BI dashboard to aid in historical and ongoing analysis and review. CLA has provided SLO County access to this dashboard for ongoing monitoring efforts. After performing the initial data analytics on the procurement card activity, CLA staff spent one week on site with the various SLO County departments selected for further review. As a result of this week of on-site interviews, detail review of processes, and sample testing, we developed 5 observations and 18 recommendations for policy improvements and additional training for individuals in various roles in the procurement card process. Several departments are already following both the SLO County policies and additional procedures they have put into place within their departments to aid in maintaining a complete documentation file for all procurement card purchases. However, CLA noted that use of the procurement cards in most departments we interviewed have been utilizing the cards for ease of purchasing rather than investing adequate time planning and using an alternate procurement method. The procurement cards should only be used when other procurement methods are not feasible. Additionally, due to the decentralized nature of the departments, there are limited centralized processes being followed by the departments, which has resulted in significant reliance being placed on the departments to monitor their own procurement card activity. Our recommendations include suggestions for increased oversight and monitoring both at the department level and the County-wide level. This project was conducted as a risk assessment of the SLO County’s processes related to the use of procurement cards by departments and individuals. This project was not an investigation of procurement card activity and was not intended to identify potentially improper use of the procurement cards. It is the responsibility of SLO County to determine which of the recommendations included in this report will be implemented and the specific processes to be implemented. There is no set of internal controls that can provide absolute assurance that no fraud will occur, and SLO County should consider the costs and benefit of implementing each recommendation, and how they align with SLO County’s risk tolerance. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 4 of 19 SCOPE OF WORK | 2 2. Scope of Work In late 2023, SLO County officials became aware of suspected fraudulent activity on the procurement card in use by a member of the Information Technology department. After an investigation into the activity by the SLO County Office of the Auditor-Controller (“Auditor’s Office”) and the District Attorney, the case was prosecuted by the District Attorney. The individual pleaded guilty to seven felony counts of misappropriation of public funds from April 2017 to October 2023 on July 17, 2024. This recent identification of fraud on the SLO County procurement card led officials to prioritize a countywide review of the procurement card processes and sample testing of transactions at departments with significant spending on their procurement cards. CLA was engaged to assist SLO County’s Auditor’s Office in this review. The scope period for the procurement card process assessment is the most recent six fiscal years, spanning from July 1, 2018, to June 30, 2024. Data analysis was performed on the entire population utilizing a Power BI dashboard developed by the CLA data analytics team. The population of procurement card transactions included 58,025 transactions by 357 cardholders in 24 departments, totaling over $16 million, as shown below.1 Spend During Spend During Department Scope Department Scope Health Agency $2,377,934.04 Airports $510,148.53 County Fire 1,889,064.26 District Attorney 382,897.33 Sheriff Coroner 1,843,567.59 Probation 325,269.38 Social Services 1,163,210.52 Planning and Building 292,732.97 Public Works 1,073,511.13 Assessor 267,446.20 Parks & Golf 914,640.93 Clerk Recorder 221,368.23 Administration 902,292.25 Child Support Services 141,820.11 Central Services 901,658.80 Auditor Controller 122,992.41 Treasurer Tax Collector Information Technology 780,948.03 Veterans Services 116,863.15 Human Resources 611,248.76 Agriculture Comm 68,894.90 Library 606,593.01 Farm Advisor 67,875.28 Facilities Management 593,923.80 County Counsel 49,562.79 Total Spend During Scope Period $16,226,464.40 While data analysis was performed on the entire population of procurement card transactions, a sample of departments were selected for a more in-depth review of processes followed. Additionally, a sample of transactions was selected for each of these departments identified through the data analysis for detailed testing for adherence to SLO County’s policies and department expectations. 1 These figures exclude all transactions made by the individual who made fraudulent transactions on the SLO County procurement card, whether the transactions were identified as fraudulent or not. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 5 of 19 SCOPE OF WORK | 3 The following departments were selected for detailed process review and sample transaction testing: Department # of Cardholders During Scope Period 1 County Fire 36 2 Sheriff Coroner 10 3 Health Agency 63 4 Social Services 29 5 Public Works 22 6 Administration 18 7 Central Services 11 8 Information Technology 15 9 Library 18 These departments were selected based on specific cardholders, vendors, and transactions identified that were high in volume or had the potential for personal misuse. These transactions included high spending at retailers such as Amazon, Apple, Target, and Wal-Mart, a significant increase or decrease in usage, purchases of what appeared to be gift cards (round dollar transactions), high volume on weekends, and transactions at restaurants, hotels, and other potentially travel-related vendors. Our sample transaction review did not include verification that the funding source was appropriate for the purchases tested. Additionally, this project was conducted as a risk assessment of the SLO County’s processes related to the use of procurement cards by departments and individuals. This project was not an investigation of procurement card activity and was not intended to identify potentially improper use of the procurement cards. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 6 of 19 PROFESSIONAL STANDARDS FOLLOWED BY CLIFTONLARSONALLEN | 4 3. Professional Standards Followed by CliftonLarsonAllen The overall scope of work and approach was conducted utilizing standards in accordance with the Statement on Standards for Consulting Services, Consulting Services: Definitions and Standards (codified as CS Section 100 in AICPA Professional Standards) of the American Institute of Certified Public Accountants (“AICPA). In consulting engagements, the nature and scope of work is determined solely by the agreement between the practitioner (CLA) and the client (County of San Luis Obispo). This report does not constitute an audit, compilation, or review, in accordance with standards of the AICPA, the objective of which would be the expression of an opinion on any specified elements, accounts, or items. Accordingly, CLA does not express such an opinion. Because of the unique nature of fraud, and because our engagement was limited to the matters described in the engagement letter, fraud and/or financial irregularities may exist within the organization that we may not have identified during the performance of our procedures. However, if during the performance of our services other matters had come to our attention suggesting possible financial improprieties and/or irregularities, we would have communicated such matters to the SLO County. The professional standards promulgated by the AICPA prohibit CLA from rendering an opinion as to whether there has been any fraud or other criminal activity by anyone associated with this engagement. Therefore, CLA does not render such opinions. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 7 of 19 SUMMARY OF WORK PERFORMED | 5 4. Summary of Work Performed On April 24, 2024, SLO County retained CLA to perform a procurement card process assessment related to the use of procurement cards at several departments throughout SLO County, including testing of a sample of transactions. As part of this engagement, CLA performed the following procedures: 1. Obtained and reviewed procurement card policies and procedures in effect during the scope period of FY19 through FY24. 2. Obtained a database of procurement card transactions for all cardholders and all departments during the scope period of FY19 through FY24. 3. Utilizing a Power BI dashboard built by the CLA data analytics team, performed data analysis on the population of transactions to inform the selection of departments and transactions for additional detailed review and testing. 4. Conducted interviews with 26 individuals across nine departments to gain an understanding of the processes followed within their respective departments and roles (cardholder, approver, or coordinator). 5. Obtained and reviewed documentation for 61 transactions from the various departments selected for detailed testing to assess transactions for adherence to SLO County policies and departmental expectations. 6. Documented observations throughout interviews and sample testing to inform SLO County of possible non-adherence to policies or potential need for increased training or updates to policies. As part of this engagement, CLA developed a Power BI dashboard to enhance SLO County’s ability to analyze and manage employee procurement card usage. This dashboard represents a significant advancement in procurement card governance, providing SLO County with a centralized and accessible platform to monitor procurement card transactions across all departments. The dashboard is designed to empower SLO County with insights needed to maintain a high standard of financial stewardship, ensuring transactions are in alignment with SLO County’s established procurement card policies and guidelines. The data for the dashboard is primarily sourced from two datasets: the US Bank Transactions Detail Summary and the US Bank Declined Transactions Authorization Summary. Data was collected covering the scope period. The data extraction encompassed all Agents, Companies, Divisions, and Departments within Bank 1425, in alignment with the account list provided by SLO County. Utilizing these two data sources, CLA compiled a comprehensive list of vendors with whom transactions occurred. Vendor names were normalized using standard data practices, including trimming leading and trailing spaces, removing store numbers, eliminating URL components, and other similar adjustments. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 8 of 19 SUMMARY OF WORK PERFORMED | 6 The source data can be updated and refreshed through various methods: manually, using an attended Power Automate Desktop flow, using an unattended Power Automate Desktop flow, or via an API. CLA has provided detailed information on each of these options to assist SLO County in making an informed choice. This newly developed dashboard serves as a powerful resource for gaining a comprehensive understanding of SLO County’s procurement card expenditures. It offers an overview of all procurement card transactions, along with a detailed analysis segmented by cardholder, department, vendor, and MCC classification. It also includes an analysis of specific transactions and declined transactions. Additionally, the dashboard features a risk analysis of transactions using Benford’s Law, outlier detection, and identification of duplicate and round dollar transactions. The dashboard is currently hosted on a secure Microsoft Power BI workspace within the CLA tenant. The dashboard’s user-friendly interface allows for intuitive navigation, ensuring that the users can quickly access the information they need for thorough analysis. This dashboard aims not only to boost transparency in SLO County’s procurement card usage information, but also empower users to make informed, data-driven decisions. This dashboard is more than just a tool – it is a strategic asset that will benefit SLO County for years to come. It provides a solid framework for improved oversight of procurement card usage, allowing SLO County to monitor procurement card transactions with greater precision and confidence. The results of work performed, our observations, and our recommendations are included in the sections below. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 9 of 19 OBSERVATIONS | 7 5. Observations Based on the above procedures performed, CLA identified the following observations in the processes performed at the various departments interviewed and through detailed testing of the sample of transactions selected. A. Assessment of Department Processes 1. While most individuals interviewed understood the SLO County procurement card policy, there were certain instances in which the policy was not properly understood or followed. All nine departments interviewed were aware of the countywide policy in place for use of the procurement card. Individuals interviewed were aware, generally, of the intended uses for the procurement card and aware of the types of purchases that are prohibited. However, there was mixed understanding of the transaction limits, splitting purchases, and determination of the correct procurement method. While some individuals understood their transaction and monthly limits for the procurement card, they did not understand the purpose of those limits in choosing the correct procurement method. This resulted in cardholders splitting purchases among multiple transactions to avoid the transaction limit and still make large or recurring purchases with the procurement card. According to SLO County procurement policies, these types of purchases should be made through procurement methods other than the procurement cards. While all individuals interviewed were aware of the policy against sharing procurement cards, a couple individuals admitted to occasionally providing the card in their name to other individuals. Finally, completeness and accuracy of the purchasing log varies amongst departments.2 Some departments utilize accounting staff within their department to assist with completing the purchasing log, while others rely on the knowledge of the accounting staff at the countywide level to catch errors in portions of their purchasing log that they may not have the knowledge to complete themselves. Understanding of the importance of details included in the purchasing log, such as sales tax, is not consistent across cardholders in all departments interviewed. This occasionally results in adjustments being required. Additionally, some cardholders complete their purchasing log in summarized form for certain purchases they deemed to be related. The combining of transactions into subtotals in the purchasing log can result in difficulties reconciling the log to the monthly statement. While CLA did not find any reconciliation discrepancies in the sample of transactions tested, not including the full details of each transaction separately in the log can make reconciliation and review less efficient. 2 The purchasing card log is a County document that is completed by each cardholder for each billing period (month) and includes for each transaction the following fields: date, vendor, description, cost center, general ledger account, functional area, internal order number, dollar amount of item, shipping, handling, sales taxes, tax code/type of tax, vendor state, status of billing, and total dollar amount of transaction. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 10 of 19 OBSERVATIONS | 8 To address these observations, CLA recommends conducting training sessions for cardholders, approvers, coordinators, and department heads (Recommendations 12-16 below). 2. Certain departments set additional expectations for their cardholders that the SLO County may benefit from adopting countywide. At some departments, CLA noted unique processes being followed that were not defined with any specificity in the countywide procurement card policy. These included documented prior authorization for purchases on an internal requisition form and documentation of receipt of goods. While documented prior authorization for a purchase is not required according to the countywide policy, multiple departments are utilizing their own internal department forms to document the purchase request and authorization before the cardholder makes the transaction. This document is then included with the receipt in the monthly packet by the cardholder. Other departments are using e-forms for purchase requests to aid in internal routing of the purchase to the cardholder. Some departments are using a form for only the purchase request, while others are using forms to document both the request and the approval by a supervisor. Additionally, some departments are consistently documenting the receipt of goods purchased with the procurement cards. The form of this documentation varies from department to department depending on the needs of the employees within the department. Some departments have a centralized purchasing process where only one or two individuals handle procurement card purchases, making the documenting of receipt of goods for the department more necessary. Other departments have multiple cardholders in operations roles making purchases for themselves and their team members, reducing the need to formally document the receipt of goods purchased. CLA recommends requiring departments implement segregation of duties between the cardholder and the receiver of delivered goods or increased compensating controls (Recommendation 2 below). B. Results from Sample Testing CLA selected a sample of 61 transactions from the population of 58,025 transactions during the scope period, spanning 16 cardholders at nine departments, to review for adherence to procurement card policies, sufficient documentation for purpose of purchase, and overall reasonableness of transaction. Only a small sample was selected as the primary objective was to assess whether processes were being followed as required by the SLO County policies and communicated by departments. To select the 61 transactions, CLA focused on identifying cardholders and departments with a high volume of usage in general and at certain retailers. These identified higher risk types of usage included spending at Amazon, Apple, Target, and Wal-Mart due to the nature of purchases available at those retailers. CLA also focused on selecting departments and cardholders with significant increases or decreases in usage, purchases of what appeared County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 11 of 19 OBSERVATIONS | 9 to be gift cards (round dollar transactions), high volume on weekends, and transactions at restaurants, hotels, and other potentially travel-related vendors. The testing criteria included validating the following: 1. Purchase was below the per transaction spending limit of $4,950. 2. Purchase was approved according to policy by signature of approving official on both the monthly statement and the purchasing card log. 3. Documentation provided by the cardholder supports the purchase by including all relevant details of the purchase on the documentation and ensuring those details agree between the documentation, the monthly statement, and the purchasing card log. 4. Documentation provided by the cardholder agrees to the description included in the purchasing card log. 5. Documentation provided by the cardholder includes evidence of prior authorization for the purchase (not required by SLO County policy but performed by some departments as communicated in interviews). 6. Purchase appears reasonable based on the cardholder's department and position and context included in the supporting documentation. 7. Purchase was not a prohibited transaction listed in the Purchasing Card Policies and Procedures document in effect at the time of purchase, unless specifically approved prior to the purchase. 8. Purchase does not appear to be a split purchase to circumvent transaction limits. 9. If purchase was for goods, evidence of receipt of goods is included in the supporting documentation provided by the cardholder (not required by the SLO County policy but performed by some departments as communicated during interviews). 10. If no receipt was provided by the cardholder, a Missing Receipt Form was completed and signed by the proper individuals. 11. Overall, the transaction appears reasonable and appropriate and includes sufficient information and documentation to support the purchase. CLA observed the following non-compliance with SLO County policies as described below. 3. Insufficient documentation or information was included with the supporting documentation for some purchases. In some instances, while a detailed receipt was included, a reasonable explanation of the nature and purpose of the purchase and how it related to business of SLO County was lacking. In nine of the 61 transactions reviewed, CLA observed that insufficient information and documentation was included in the monthly packet provided by the cardholder to determine the context or intended use of the purchase. These transactions spanned from July 2018 to April 2023 and were present with six cardholders in five departments. The descriptions of the purchases are such that a reasonable person might consider them personal in nature without additional context. SLO County is responsible for services such as fire and police protection, social services programs, and other community services. Due to the nature of these services, legitimate purchases to administer the programs could appear personal. Additional context from the cardholder is important, especially for these County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 12 of 19 OBSERVATIONS | 1 0 types of purchases, to document the relevance to the service being provided. CLA recommends requiring complete supporting documentation for each purchase and providing all documentation to the central Accounts Payable office each month (Recommendation 5 below). During interviews with cardholders and approvers at various departments, CLA learned that many departments are increasing the amount of documentation and information gathered and included in the monthly cardholder packets up front, rather than providing only in response to questions later. Because the sample selected included transactions incurred several years prior, not all transactions were subject to recent processes implemented by departments. In one instance of the 61 transactions reviewed, CLA observed that an itemized receipt was not included in the documentation provided by the cardholder for the purchase. This is in violation of the policy requiring itemized receipts containing all relevant information for the purchase. This transaction occurred in August 2019. In one instance, CLA observed that no Approving Official signature was obtained on the monthly Purchasing Card Log, as required by SLO County policy. This instance occurred in October 2023. CLA recommends not only reinforcing that these signatures are required but also specifying the type of signature that is appropriate (Recommendation 3 below). In one instance of the 61 transactions reviewed, CLA observed that prior approval for a purchase of gift cards was not properly obtained. While gift cards are a prohibited use for the procurement cards, they may be purchased if prior approval is granted by the SLO County Auditor’s Office.3 In this instance, no prior approval was documented as granted by the Auditor’s Office. This transaction occurred in July 2023. Each department purchases gift cards as they determine their needs and makes the purchase from retailers of their choosing with their own department procurement cards. CLA recommends continuing to require prior approval and tracking of all gift card purchases. Additionally, CLA recommends considering if alternative methods of purchasing gift cards is possible to centralize and create increased transparency around the process (Recommendation 6 below). 4. Prohibited transactions were identified. In one instance of the 61 transactions reviewed, CLA observed that a personal online account was used to make a purchase on the procurement card. This is prohibited per the SLO County policy. The transaction was through eBay, which the County does not have an official account with. This transaction occurred in July 2023. 3 Gift cards may be approved for purchase to further the objectives of certain community service programs such as the safe parking program, incentives for participation in surveys or vaccines, and victim witness needs. Gift cards approved for purchase are required to be tracked using a gift card log. All transactions tested that were for the purchase of gift cards had properly completed gift card tracking logs. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 13 of 19 OBSERVATIONS | 1 1 In seven of the 61 transactions reviewed, CLA observed evidence that the purchase was split into multiple transactions to avoid the per transaction limit of $4,950, which is prohibited per the SLO County policy. In each instance noted, an alternative procurement method should have been used. These transactions spanned from October 2023 to April 2024 and were present with three cardholders in two departments. Additionally, in six of the seven split transactions noted above, CLA observed evidence that the equipment purchased should likely have been capitalized either on its own or as part of a larger asset purchase. Due to these purchases being made on the procurement card, they were not properly tracked as possible capital asset additions. These transactions were present with two cardholders in one department. CLA recommends requiring tracking of small equipment purchases to assist in identifying items that may need to be capitalized as part of a larger asset (Recommendations 7 and 18 below). 5. Department-specific requirements were not always followed. While the following observations were not SLO County policy violations, CLA noted that specific requirements within some departments were not met in two instances within the sample of 61 transactions reviewed. In one instance, no internal department-required requisition form was completed and maintained as documentation for the purchase made. In a separate instance, no evidence of the receipt of goods ordered was documented for the purchase, as expected by department practice. Summary of Observations In the sample of 61 transactions reviewed, CLA noted observations in 22 instances. 20 of those instances were SLO County policy violations and two were department-specific requirements not being met but not SLO County policy violations. SLO County Policy Violations: Description Instances Not enough information provided 9 Evidence of split transaction 7 Personal online account used 1 No approval documented on purchasing card log 1 No itemized receipt retained 1 No prior approval for prohibited transaction documented 1 Subtotal 20 Department-Specific Requirements Not Met: Description Instances No internal requisition form completed 1 No record of receipt of goods 1 Subtotal 2 County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 14 of 19 OBSERVATIONS | 1 2 CLA also observed that the documentation method of cardholder and approver sign offs was inconsistent over time and across departments. The sign offs varied between wet signatures, typed names, and digital signatures. SLO County policy does not dictate the required method for the cardholder and approver sign offs, so CLA did not identify policy violations in this matter. However, CLA recommends that the method for signature be specified as a method that cannot be easily copied, such as a wet signature or digital signature using Adobe, DocuSign, or a similar digital signature program (Recommendation 3 below). CLA understands that the SLO County Auditor’s Office has not previously had the ability to monitor procurement card activity across the County as a whole. However, implementation of a Power BI dashboard is in progress and is expected to be used for ongoing monitoring by not only the Auditor’s Office but by department management as well (Recommendation 17 below). County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 15 of 19 RECOMMENDATIONS | 1 3 6. Recommendations Based on the work performed by CLA as described above, we make the following recommendations to SLO County. A. Countywide Purchasing Card Policy Considerations Suggested Policy Updates 1. Establish a process for monitoring and enforcing compliance with the Purchasing Card Program policy, including which departments (Purchasing Department, Auditor’s Office, or individual department head) is responsible for specific monitoring processes, identification of violations, and administration of consequences. The process should include to whom violations should be reported and specific consequences and escalation of consequences for different types of noncompliance with the Purchasing Card requirements. Consequences may include reassignment of the card to another employee in the department or deactivation of the card. 2. Require appropriate segregation of duties so that designated individuals other than the purchaser receive all goods ordered upon delivery. If duties cannot be fully segregated due to staffing constraints, mitigating or compensating controls should be established, such as enhanced oversight and review steps. 3. Update policy to define the type of signature that is allowable for both the cardholder and the approver for both the monthly statement and the purchasing card log. Consider requiring the signature to be of a method that is difficult to copy, such as a wet signature or a digital signature using a program such as Adobe or DocuSign. 4. Update the Purchasing Card Program policy to include a definition of an “emergency purchase,” the designated individuals that can approve an emergency purchase, and a list of approved vendors. Consider if food purchases may be an emergency purchase under specific circumstances, and if so, consider specifying those circumstances in the policy and including a list of approved vendors for those purchases. 5. Require all cardholders in all departments to send a copy of the complete packet of backup documentation to the central Accounts Payable office or upload to the accounting software each month. This will ensure that all relevant documentation for procurement card purchases is centrally located and accessible to the Auditor’s Office and accounting staff. 6. Consider whether a centralized process for purchasing gift cards could be implemented that would eliminate the need for individual departments to use procurement cards to purchase gift cards. This may allow more transparency around gift card requests, purchases, and distribution. 7. Require that departments maintain inventory records of small equipment purchases that are under the capitalization threshold but higher than an inconsequential County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 16 of 19 RECOMMENDATIONS | 1 4 threshold (such as $500). The inventory should track where the equipment is located and its expected replacement timeline. This will help ensure that all small equipment assigned to individuals is returned upon requesting a replacement item or upon departure from the department. A policy for periodically auditing and verifying the accuracy of department inventory records should be developed and implemented. 8. Consider updates to the Purchasing Card Log to include calculations of common sales tax percentages to aid in identifying adjustments that may be required by the Accounts Payable office. Also consider updates to the log that may be compatible with exports of the credit card transactions or import functions into the accounting software, which may reduce the need for data entry in multiple places. 9. Ensure that the Purchasing Card Program policy is reviewed and updated at least annually, maintained in a centralized location, and made accessible to all County employees and contractors participating in the Procurement Card program. Suggested Best Practice Guidance to Departments 10. Consider requiring departments to annually review all cardholders and card limits and submit the approved list to the Purchasing Department. This will encourage department heads to take an active role in determining the proper cardholders for their department and whether lower thresholds should be implemented for certain cardholders. Included in this annual review should also be the names of the proper approvers for each cardholder’s monthly statement and purchasing card log. If separate individuals are required for operational approval versus accounting approval, those should be defined in this annual review. 11. Encourage departments to identify vendors used regularly with the procurement cards so they can be evaluated by the Purchasing Department for set up of purchase orders or contracts. An increase in use of other procurement methods for routine vendors will reduce the number of transactions on the procurement cards. B. Countywide Training for Departments Using Purchasing Cards While the current policy in place requires all cardholders to attend annual training, there is not currently a thorough training program in place for the various roles individuals hold within the Purchasing Card Program. CLA recommends not only requiring annual training for cardholders but also for approvers and coordinators. Training should reiterate the policies and procedures governing the Purchasing Card Program with recertification of understanding required. For all individuals involved in the Purchasing Card Program, annual training should include a continued reminder that they are stewards of public funds and purchases made using the purchasing cards still require an assessment of reasonableness of cost even if not going through a competitive quote/bid process. Therefore, it is important to consider whether the cost of certain items is in the best interest of SLO County and to be aware of the potential perception surrounding these purchases. Additionally, consequences for noncompliance with training requirements County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 17 of 19 RECOMMENDATIONS | 1 5 should be established, such as reassignment of the card to another employee in the department or deactivation of the card. Training for Cardholders 12. Annual training for cardholders should include a review of the intended uses and prohibited uses of the Purchasing Card. It should also include detailed discussion of the escalation of consequences for noncompliance with the policy. Training for Accountants (Approvers or Coordinators) 13. Enhanced training for accountants in each department should be conducted and include flags and anomalies to look for during the Purchasing Card monthly process they take part in. Annual training for accountants should also include empowering them to look for unusual transactions and ask questions of the cardholders. A process should be implemented for escalating issues beyond the cardholder or department if questions or concerns are not adequately addressed. 14. Additionally, consider training for departmental accountants around sales tax calculations, which may reduce adjustments required by the Accounts Payable Manager after the close of the monthly statements. Training for Operational Approvers 15. Individuals within each department who are responsible for operationally reviewing the Purchasing Card transactions should be required to attend annual training covering the expectations for uses of the card and the specific prohibited uses of the card. It should be reiterated that they are responsible not only for review of adherence to policy but also for considering whether the purchase is reasonable and necessary for the operations of the department. Training for Department Heads 16. Department heads should also be required to attend annual training to understand their role in the oversight of spending within their department. They should understand the policy and procedures in place for the program and within their department. They are responsible for identifying and approving who has a need for a Purchasing Card in the department and who will be responsible for the operational review of all transactions on the card. C. General Recommendations In addition to policy updates and guidance and training for individuals involved in the program, CLA also has the following general recommendations. 17. SLO County should implement use of the Power BI dashboard to perform continuous monitoring steps. Additionally, SLO County should consider rolling out access to the County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 18 of 19 RECOMMENDATIONS | 1 6 departments using procurement cards to aid department leaders in their regular review of the activity. CLA understands that as of the date of this report, use of the dashboard is in the process of being implemented. 18. SLO County should consider implementing an item tagging process that includes small equipment purchases below the asset capitalization threshold. Additionally, this may include a tracking and monitoring system for computer equipment available through a hardware vendor such as Dell. County of San Luis Obispo CliftonLarsonAllen LLP Procurement Card Process Assessment Page 19 of 19