Cash and Internal Controls Audits, Planning and Building June 2024 Cash and Internal Controls Audit Report FY 23-24

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 6/18/2024 Kari Lekvold (805) 781-4846 Tax Collector (4) SUBJECT Submittal of a cash procedures and internal controls audit of Planning and Building conducted in October 2023. (5) RECOMMENDED ACTION It is recommended that the Board receive, review, and file the attached Planning and Building's Cash Procedures and Internal Controls Audit report. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0 $0 (10)AGENDA PLACEMENT { X} Consent { } Presentation { } Hearing (Time Est. ) { } Board Business (Time Est._) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances {X} N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (1.3) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A { } 4/5th's Vote Required { X} NIA (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY NIA No { } N/A Date 3/24/2015 (17) ADMINISTRATIVE OFFICE REVIEW (18) SUPERVISOR DISTRICT(S) Page 1 of 3 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor - Controller - Treasurer - Tax Collector DATE: June 18, 2024 SUBJECT: Submittal of a cash procedures and internal controls audit of Planning and Building conducted in October 2023. RECOMMENDATION It is recommended that the Board receive, review, and file the attached Planning and Building's Cash Procedures and Internal Controls Audit report. DISCUSSION Cash handling can be an area vulnerable to mistakes or misappropriation. The Auditor-Controller-Treasurer-Tax Collector (ACTTC) has developed policies to minimize the risk associated with use of change funds as well as cash receipts. Additionally, County computers are vulnerable to abuse. County Information Technology has developed policies to minimize the risk associated with misuse of County computing assets. The objectives of our audit were to determine compliance with the County Auditor-Controller-Treasurer-Tax Collector's Cash Handling Policy, to establish accountability for cash on hand, to determine the adequacy of internal controls surrounding department assets, and to determine compliance with the County IT Acceptable Use Policy Acknowledgement signature requirements. We determined the cash funds in all material respects, to be in balance at the time of our count. Planning and Building is in general conformance with the Cash Handling Policy except as outlined in the Findings and Recommendations section of the attached report. We identified two findings which related to untimely petty cash reconciliations and noncompliance with the Cash Handling Policy Acknowledgement requirements. The department's response to the findings is included in the report. The Internal Audit Division will perform follow up procedures within six to twelve months to verify that appropriate actions have been taken to address the Findings. OTHER AGENCY INVOLVEMENT/IMPACT Planning and Building. Page2of3 FINANCIAL CONSIDERATIONS There is no additional cost to the County for conducting cash and internal control reviews. Periodic cash and internal control reviews are part of the ACTTC's compliance with Government Code Sections 26881 and 26883. RESULTS The ACTTC's program of periodic reviews of cash procedures and other internal controls helps maintain and improve internal controls and procedures for cash handling by County staff and contributes to the County's vision of a well-governed community. ATTACHMENTS Planning and Building Cash Procedures and Internal Controls Final Audit Report FY 2023-24 Page 3 of3 Attachment 1 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilt on, CPA Auditor-Controller• Treasurer-Tax Collector• Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Planning and Building Cash Procedures & Internal Controls Audit May 2024 JAMES W. HAMILT ON, CPA Auditor-Controller• Treasurer-Tax Collector Page 1 of 5 COUNTY OF SAN LUIS OBISPO Office ofJames W. Hamilton, CPA Auditor-Controller• Treasurer-Tax Collector • Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy TO: TREVOR KEITH, DIRECTOR OF PLANNING AND BUILDING <Jt»II FROM: JAMES W. HAMILTON, CPA, AUDITOR-CONTROLLER-TREASURER-TAX COLLECTOR DATE: MAY 17, 2024 SUBJECT: CASH PROCEDURES AND INTERNAL CONTROLS AUDIT CONDUCTED ON OCTOBER 10, 2023 Our office completed a cash procedures and internal control audit that took place on October 10, 2023. Our review resulted in two findings, one suggested improvement, and the recognition of two impactful departmental internal controls. The Internal Audit Division will be performing follow-up procedures within six to twelve months to verify appropriate actions have been taken to address the Findings in this report. Purpose The purpose of our audit was to: 1. Determine compliance with the Auditor-Controller-Treasurer-Tax Collector's Cash Handling Policy (Policy). 2. Establish accountability and internal controls for the cash and cash equivalents on hand at the time of the audit. 3. Assess the controls over purchasing cards (Cal-Cards and travel cards). 4. Determine compliance with the Countywide Information Security Program's Acceptable Use Policy Acknowledgement annual requirement. Scope The scope of our audit included cash, cash equivalents and receipts on hand on October 10, 2023, as well as recent deposits. Additionally, we reviewed the department's Cal-Card and travel card activity and controls. Countywide Information Security Program's Acceptable Use Policy Acknowledgements were sampled and examined for acknowledgement in the previous twelve months. Page 2 of 5 COUNTY OF SAN LUIS OBISPO Office ofJames W. Hamilton, CPA Auditor-Controller• Treasurer-Tax Collector • Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Methodology We conducted our review in conformance with the International Standardsfor the Professional Practice ofInternal Auditing. The Standards require that the internal audit activity be independent and internal auditors be objective in performing their work. The Standards also require that internal auditors perform their engagements with proficiency and due professional care; that the internal audit function be subject to a program of quality assurance; and that the results of engagements are communicated. Our procedures included physically counting all cash on hand on October 10, 2023, and reconciling the amount to the department's accountability figures. Our review also included an evaluation of internal controls over cash receipts, cash equivalents, purchasing cards. Our evaluation of internal controls was limited to inquiries of departmental staff and direct observations. Additionally, we tested for compliance with the County of San Luis Obispo Information Security Program's requirement that employees annually sign the 'Acceptable Use Policy Acknowledgement form. Results We determined all cash funds on hand to be in balance at the time of our count and the Department's internal controls over cash and purchasing cards appear to be adequate. The department is in general compliance with the Cash Handling Policy with the exceptions noted in the Findings and Recommendations section below. Findings are issues which present a serious enough risk to require consideration by management and a written department response. Details of the findings and our recommendations are as follows: Findings & Recommendations 1. Untimely Petty Cash Reconciliation Planning and Building's petty cash fund was not being reconciled in accordance with the Cash Handling Policy, which requires petty cash funds to be reconciled on a periodic basis no less than monthly by the custodian and periodically by someone other than the custodian. Failure to perform frequent reconciliations of petty cash could result in the failure to detect the misuse or loss of County funds timely. Page 3 of 5 COUNTY OF SAN LUIS OBISPO Office ofJames W. Hamilton, CPA Auditor-Controller • Treasurer-Tax Collector • Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Recommendation We recommend that Planning and Building perform reconciliations no less than monthly by the custodian and periodically by someone other than the custodian. Department Response The department completed its reconciliation and replenishment of the fund in June of 2023 and no additional transactions had occurred up to October 2023 when the audit was performed. Based on the infrequency of use, the department discontinued the use of petty cash on 4/10/2024. 2. Cash Handling Policy Not Acknowledged Annually by Staff Not all cash handlers had certified in writing they had read the County's Cash Handling Policy in the twelve months prior to the audit. The Policy requires annual reading and written acknowledgment for all cash handlers, custodians, and managers; however, management neglected to have all cash handlers sign the acknowledgement annually. Written acknowledgement by employees stating they have read the Policy helps ensure consistent countywide procedures for cash handling. Recommendation We recommend that Planning and Building have all employees who are cash handlers, custodians and managers review and sign the Policy annually. Department Response The department typically does capture updated acknowledgements annually as part of its annual department wide policy review instituted by departmental human resources. Due to staff turnover, this process was interrupted. The department's cash handling acknowledgements (with the exception of one employee who transferred to the department within the year) were all within one calendar year (2022 versus October of 2023 when the audit was performed). All signatures have now been updated and captured. We have instituted a revised process to capture annual signatures. Page 4 of 5 COUNTY OF SAN LUIS OBISPO Office ofJames W. Hamilton, CPA Auditor-Control/er• Treasurer-Tax Collector • Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy lmpactful Departmental Internal Control Practices We identified two impactful departmental internal control practices below: 1. Planning and Building has successfully utilized NeoGov to ensure annual employee compliance with the Information Security Program's Acceptable Use Policy Acknowledgement requirement. 2. Additionally, Planning and Building has implemented a policy that requires pre-authorization for travel and conference registration expenses. An E-form is utilized on MySlo for record keeping and electronic approvals as well as selecting a date for the mandatory training de brief with the supervisor/team. We thank Planning and Building for positively contributing to the department's control activities, which further fortifies the County's internal control environment. Suggested Improvements Currently, the Point-of-Sale (POS) system allows a cashier to perform a payment void. Voids should be authorized by someone other than the cashier. The Department was aware of the issue prior to our audit; the Department has mitigated the risk with a compensating control, and they have requested that Tyler Technologies, the POS provider correct user credentialing so that cashiers are not able to process payment voids. We recommend that the department continue to work with Tyler Technologies to resolve this issue as soon as possible. We appreciate the courteous attitude ofyour staff and the cooperation we received during the audit. Signature: ~ Ja amllton (May 18, 2024 07:29 PDT] Email: jhamilton@co.slo.ca.us Page 5 of 5