Cash and Internal Controls Audits, Administrative Office and Public Guardian April 2025 Cash and Internal Controls Reports

COUNTY OF SAN LUIS OBISPO BOARD OF SUPERVISORS AGENDA ITEM TRANSMITTAL (1) DEPARTMENT (2) MEETING DATE (3) CONTACT/PHONE Auditor-Controller-Treasurer- 5/20/2025 Kari Lekvold (805) 781-4846 Tax Collector (4) SUBJECT Request to receive, review, and file the Cash Procedures and Internal Controls Audits of the County Administrative Office and the Health Agency - Public Guardian Division. (5) RECOMMENDED ACTION It is recommended that the Board receive, review, and file the Cash Procedures and Internal Controls Audit of the County Administrative Office and the Health Agency - Public Guardian Division and provide direction as deemed necessary. (6) FUNDING SOURCE(S) (7) CURRENT YEAR FINANCIAL (8) ANNUAL FINANCIAL (9) BUDGETED? N/A IMPACT IMPACT Yes $0 $0 (10) AGENDA PLACEMENT { X } Consent { } Presentation { } Hearing (Time Est. _______) { } Board Business (Time Est.______) (11) EXECUTED DOCUMENTS { } Resolutions { } Contracts { } Ordinances { X } N/A (12) OUTLINE AGREEMENT REQUISITION NUMBER (OAR) (13) BUDGET ADJUSTMENT REQUIRED? BAR ID Number: N/A { } 4/5th's Vote Required { X } N/A (14) LOCATION MAP (15) BUSINESS IMPACT STATEMENT? (16) AGENDA ITEM HISTORY N/A No { } N/A Date 3/24/2015 & 10/18/2011 (17) ADMINISTRATIVE OFFICE REVIEW Lisa M. Howe (18) SUPERVISOR DISTRICT(S) Page 1 of 3 COUNTY OF SAN LUIS OBISPO TO: Board of Supervisors FROM: James W. Hamilton, CPA, Auditor – Controller – Treasurer – Tax Collector DATE: May 20, 2025 SUBJECT: Request to receive, review, and file the Cash Procedures and Internal Controls Audits of the County Administrative Office and the Health Agency - Public Guardian Division. RECOMMENDATION It is recommended that the Board receive, review, and file the Cash Procedures and Internal Controls Audits of the County Administrative Office and the Health Agency - Public Guardian Division and provide directions as deemed necessary. DISCUSSION Cash handling is an area inherently vulnerable to error or misappropriation. To mitigate these risks, the Auditor- Controller-Treasurer-Tax Collector (ACTTC) has developed policies that establish safeguards over the use of change funds, cash receipts, and other cash equivalents. The objectives of our audits were to evaluate compliance with the County’s Cash Handling Policy, to confirm accountability for cash on hand, and to assess the adequacy of internal controls over departmental assets. These audits included both the Administrative Office and the Health Agency – Public Guardian Division. We found that all cash funds and receipts were in balance at the time of our counts, and that both departments are generally in compliance with the ACTTC’s Cash Handling Policy. However, we identified findings at each department that warrant attention. At the Administrative Office, we noted two findings related to untimely deposits and the lack of restrictive endorsements on checks, which could expose the County to unnecessary risk. At the Health Agency – Public Guardian Division, we identified four findings involving the delayed resolution of reconciling items, outdated policies and procedures, the Auditor-Controller-Treasurer-Tax Collector not being listed as a signatory on all bank accounts, and the failure to periodically change the safe combination. Page 2 of 3 Department responses to the findings are included in the attached reports. The Administrative Office findings will be subject to follow-up procedures by the Internal Audit Division within six to twelve months. For the Health Agency – Public Guardian Division, all recommendations have already been implemented. OTHER AGENCY INVOLVEMENT/IMPACT Administrative Office Health Agency - Public Guardian Division FINANCIAL CONSIDERATIONS There is no additional cost to the County for conducting cash and internal control reviews. Periodic cash and internal control reviews are part of the ACTTC’s compliance with Government Code Sections 26881 and 26883. RESULTS The ACTTC’s program of periodic reviews of cash procedures and other internal controls helps maintain and improve internal controls and procedures for cash handling by County staff and contributes to the County’s vision of a well-governed community. ATTACHMENTS 1 FY 24-25 County Administrative Office Cash Procedures and Internal Controls Final Audit Report 2 FY 23-24 Public Guardian Cash Procedures & Internal Controls Final Audit Report Page 3 of 3 Attachment #1 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Administrative Office Cash Procedures and Internal Controls Audit April 2025 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 4 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy TO: MATTHEW P. PONTES, COUNTY ADMINISTRATIVE OFFFICER FROM: JAMES W. HAMILTON, CPA, AUDITOR-CONTROLLER-TREASURER-TAX COLLECTOR DATE: APRIL 23, 2025 SUBJECT: CASH PROCEDURES AND INTERNAL CONTROLS AUDIT CONDUCTED ON JANUARY 9, 2025 Our office recently completed a cash procedures and internal controls audit that took place on January 9, 2025. Our review resulted in two findings. The department’s response to the findings is included in this report. The Internal Audit Division will perform follow-up procedures within six to twelve months to verify appropriate actions have been taken to address the Findings in this report. Purpose The purpose of our review was to determine compliance with the Auditor-Controller’s Cash Handling Policy and to establish accountability for the cash on hand at the time of the review. Scope The scope of our audit included cash, cash equivalents and receipts on hand on January 9, 2025, as well as deposits for the prior three months. Methodology We conducted our review in conformance with the International Standards for the Professional Practice of Internal Auditing. The Standards require that the internal audit activity be independent and internal auditors be objective in performing their work. The Standards also require that internal auditors perform their engagements with proficiency and due professional care; that the internal audit function be subject to a program of quality assurance; and that the results of engagements are communicated. Our procedures included physically counting all cash on hand for January 9, 2025, and reconciling the amount to the department’s accountability figures. We examined cash receipts and compared the amounts to the corresponding receipts total and to the subsequent deposit. Our review also included an evaluation of internal controls over cash receipts and cash equivalents. Page 2 of 4 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Results We determined cash funds and cash receipts on hand, in all material respects, to be in balance at the time of our count. The department is in general compliance with the Cash Handling Policy with the exception(s) noted in the Findings and Recommendations section below. Findings are issues which present a serious enough risk to require consideration by management and a written response. Findings & Recommendations 1. Untimely Deposits During our review, we noted that several assessment appeal payments were not deposited timely. One deposit included six checks dated more than 60 days prior to the deposit date. The Cash Handling Policy requires collections greater than $500 to be deposited on the next business day. Collections of less than $500 may be held and deposited less frequently at the department’s discretion; however, deposits must be made at least weekly. Staff indicated that assessment appeals are generally a small part of the staff’s duties, thus they are processed in batches to enhance efficiency. It was also noted that many applications require significant follow-up prior to payments being processed. Untimely deposits increase the risk of check expiration, insufficient funds, or disputes over stale-dated checks. Such delays heighten the risk of loss or misappropriation and can lead to inaccurate budgeting and financial reporting. Recommendation It is recommended that the department deposit collections greater than $500 by the next business day and no less than weekly for deposit collections of less than $500 for all deposits other than assessment appeals deposits. Following discussions regarding the challenges associated with assessment appeal deposits, the Auditor’s Office has agreed to issue written approval permitting the department to deposit assessment appeals payments on a bi-weekly basis. This will allow the department to address incomplete applications and staff workload, while ensuring consistency and timeliness in deposit practices. Department Response The department concurs with the finding and recommendation. To ensure compliance with the Cash Handling Policy, procedures have been implemented to deposit collections exceeding $500 by the next business day and collections under $500 at least weekly. As outlined in the Auditor’s Office- approved waiver, assessment appeal payments will be deposited on a bi-weekly basis to accommodate application processing requirements and staffing considerations. Page 3 of 4 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy 2. Checks Not Restrictively Endorsed When Received Checks were restrictively endorsed at the time of deposit, rather than upon receipt. The Cash Handling Policy requires all checks and money orders to be restrictively endorsed upon receipt. Endorsing checks upon receipt decreases the possibility of theft by safeguarding County assets. Staff noted that they were unaware of the requirement to endorse the checks upon receipt. Recommendation It is recommended that cash handlers restrictively endorse all checks and money orders at the time they are received. Department Response The department concurs with the finding and recommendation. Procedures have been implemented to ensure that all checks and money orders are now restrictively endorsed immediately upon receipt, in accordance with the Cash Handling Policy. This change reinforces internal controls and helps safeguard County assets by reducing risk of loss or misuse. We appreciate the courteous attitude of your staff and the cooperation we received during the course of our review. Cc: Tessa Cornejo, Administrative Services Manager Lisa Howe, Division Manager Olena Nagorna, Administrative Analyst Zachary Lute, Administrative Analyst Mike Stevens, Deputy Auditor-Controller-Treasurer-Tax Collector Melissa Blackburn, Treasury Manager Shantessy Kaye, Principal Auditor Analyst Lauren Solis, Auditor Analyst Page 4 of 4 Attachment #2 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy Public Guardian Cash Procedures & Internal Controls Final Audit Report April 2025 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 12 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy TO: NICHOLAS DREWS, HEALTH AGENCY DIRECTOR FROM: JAMES W. HAMILTON, CPA, AUDITOR-CONTROLLER-TREASURER-TAX COLLECTOR DATE: APRIL 28, 2025 SUBJECT: CASH PROCEDURES AND INTERNAL CONTROLS AUDIT CONDUCTED ON DECEMBER 21, 2023 Our office completed a cash procedures and internal controls audit that took place on December 21, 2023. Our review resulted in four findings and recommendations. A draft report was issued to the department on July 12, 2024 and an updated draft with a revised recommendation was issued on January 24, 2025. The department’s responses are included in this report. All recommendations have been implemented. Purpose The purpose of our audit was to: 1. Determine compliance with the Auditor-Controller-Treasurer-Tax Collector’s Cash Handling Policy. 2. Establish accountability and internal controls for the cash and cash equivalents on hand at the time of the audit. 3. Assess the controls over bank accounts and purchasing cards (Cal-Cards). 4. Determine compliance with the Countywide Information Security Program’s Acceptable Use Policy Acknowledgement requirement. Scope The scope of our audit included cash, cash equivalents and receipts on hand on December 21, 2023, as well as deposits for the prior three months. Additionally, we reviewed the department’s bank accounts, and Cal-Card activity. Countywide Information Security Program’s Acceptable Use Policy Acknowledgements were sampled and examined for acknowledgement in the past calendar year. Methodology We conducted our review in conformance with the International Standards for the Professional Practice of Internal Auditing. The Standards require that the internal audit activity be independent and internal auditors Page 2 of 12 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy be objective in performing their work. The Standards also require that internal auditors perform their engagements with proficiency and due professional care; that the internal audit function be subject to a program of quality assurance; and that the results of engagements are communicated. Our procedures included physically counting all cash on hand on December 21, 2023, and reconciling the amount to the department’s accountability figures. Our review also included an evaluation of internal controls over cash receipts, cash equivalents, and purchasing cards. Our evaluation of internal controls was limited to inquiries of departmental staff and direct observations. Additionally, we tested for compliance with the Countywide Information Security Program’s requirement that employees annually sign the Acceptable Use Policy Acknowledgement form. Results We determined all cash funds on hand to be in balance at the time of our count and that the Department’s internal controls over cash and purchasing cards appear to be adequate. The department is in general compliance with the Cash Handling Policy with the exception(s) noted in the Findings and Recommendations section below. Findings are issues which present a serious enough risk to require consideration by management and a written department response. All recommendations have been implemented. Details of the findings and recommendations are as follows: Findings & Recommendations Implemented 1. Untimely Resolution of Reconciling Items Three out of the four bank account reconciliations had unresolved reconciling items. This included a check deposit in the amount of $342.02 that was incorrectly deposited to the Conservator Payee account instead of the Representative Payee account, and a $1,133.43 disbursement that cleared the Conservator Payee account twice, once in March and again in June. California Probation Code Section 2940 requires that all funds coming into the custody of the Public Guadian be deposited and invested in a timely manner. Additionally, it is best practice that reconciling items be resolved within 60 days. Staff were still adjusting to the change in banks and ensuring incoming payments were being made timely and accurately, which led to the delay in addressing the reconciling items. Timely resolution of reconciling items increases the accuracy and reliability of financial reports. Recommendation We recommend that Public Guardian resolve reconciling items within 60 days when possible. Page 3 of 12 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy 2. Outdated Policies We found that many of the Public Guardian Policies had not been updated since October 2013 (e.g., Deposit Handling Policy). Best business practices require the review and update of policies on a regular basis. Staff stated that the policy changes are communicated verbally, which has worked for their department due to the small number of office staff. Written policies that do not have the most current information can cause errors, inefficiencies, and non-compliance. Recommendation We recommend that Public Guardian review policies and update, if applicable, on a regular basis. 3. Auditor-Controller-Treasurer-Tax Collector not listed as signatory on all bank accounts Certain financial oversight responsibilities, assigned in CA State Government Code to the Auditor- Controller Treasurer Tax-Collector (ACTTC), require direct access to bank records for independent examination of activity. Standard banking industry practices only allow the ACTTC direct account access when the ACTTC is a named signer on an account. As such, it is standard County practice for the ACTTC to be a named signer on any bank account administered by the County. The ACTTC, however, has historically not been a named signer on Public Guardian conservator or representative payee accounts. As part of this engagement, we requested the ACTTC be added as a named signer on all Public Guardian accounts in order to fulfill statutory oversight responsibilities. The Public Guardian’s Office did not support this recommendation, for reasons described below: The Public Guardian’s Office is not in agreement with the AC TTC being identified as a signer on the public guardian bank accounts. Although fiscal oversight is recommended, this is already being completed through the monthly reconciliation process. Each month an accountant from the health agency completes the monthly reconciliation which is then provided to the Auditor’s office. Additionally, the funds that are managed by the Public Guardian’s office are not County funds but are funds of conserved individuals. Lastly, it is recommended that all signers on the Public Guardian accounts be deputized in addition to being a part of the CAPAPGPC Association. For conservatorship of the estate funds, Probate Code § 2940 indicates that all funds coming into the custody of the public guardian shall be deposited or invested in the same manner and subject to the same terms and conditions as deposit or investment by the public administrator of money and in an estate pursuant to Article 3 (commencing with Section 7640) of Chapter 4 of Part 1 of Division 7. Section 7640(a) provides: The public administrator shall, upon receipt, deposit all money of the estate in an insured account in a financial institution or with the county treasurer of the county in which the proceedings are pending. Based on the PG review, there is not a requirement that the Treasurer be a signor if PG chooses to deposit in an insured account in a financial institution rather than with the county treasurer. Page 4 of 12 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy For Rep Payee funds, the Social Security Program Operations Manual System (POMS) provides the following guidance: GN 00603.020.E.: The following applies to collective account transactions: I. Deposits to the collective account IMPORTANT: Only the designated representative payee for a beneficiary can receive the beneficiary's Social Security or SSI funds. a. General deposit policy for collective accounts As a representative payee, the payee must receive the deposit of Social Security or SSI funds in a fiduciary account with the payee's name in the title. The payee must title the collective account as described in GN 00603.020A.1. and GN 00603.020.D in this section. The payee cannot deposit SSA benefits into a payee's operating account, business account, or any other account that does not have Social Security approval. GN 00603.020.D.2.: State/local government accounts and collective account titling There are account-titling exceptions for State and local government organizational payees. a. General depository account A State or local government may require a subordinate agency to deposit all receipts into the State/local government's general depository account that routes the deposits to an agency specific sub account. The agency payee may use a State/local general depository account provided; 1. The State/local government requires the use of the general depository account; 2. The State/local government promptly routes beneficiary's funds from the general depository account to a payee’s fiduciary collective account set up for the beneficiaries. The payee's fiduciary collective account can be an individual account or SSA-approved collective account; 3. The sub account protects beneficiaries funds from any State/local government use; and 4. The payee complies with the payee responsibilities set out in this section. While it is permitted to use Treasurer accounts to deposit payee funds (if the requirements are met) there is no requirement that the Treasurer of the County be a signor on outside accounts where the funds are deposited. Arguably, given the language that "only" the designated payee can receive the funds, having non- Public Guardian employees on the accounts may be an issue for Social Security. Upon receipt of the Department’s response, the ACTTC developed an alternate solution which we believe will effectively facilitate ACTTC oversight responsibilities without being a named signer on accounts. The alternative is that the Public Guardian provide ACTTC with direct online account login information to enable unimpeded viewing of all Public Guardian account activity. Final Recommendation We recommend that the Public Guardian provide the ACTTC with direct online account login information for all current and future bank accounts administered by the Public Guardian, sufficient to allow viewing of account balances and transaction details. 4. Safe Combination Not Changed We found that it is likely that terminated, transferred or employees who no longer handle cash have knowledge of the safe combination. The Cash Handling Policy requires that safe combinations be restricted to as few employees as possible and that the combination to the safe be changed Page 5 of 12 COUNTY OF SAN LUIS OBISPO Office of James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Public Administrator Michael Stevens, Deputy Justin Cooley, Deputy whenever an employee who has knowledge of the combination terminates County employment, is transferred to another department, or is removed from cash handling functions. Staff were unaware of the requirement to change the safe combination. Maintaining the same safe combination after employees with knowledge of the combination no longer require access puts the County's cash and other assets at risk. Recommendation We recommend that the Public Guardian the safe combination is changed whenever an employee who has knowledge of the combination terminates County employment, is transferred to another department, or is removed from cash handling functions. We appreciate the courteous attitude of your staff and the cooperation we received during the course of our review. Cc: Mike Stevens, Deputy Auditor-Controller-Treasurer-Tax Collector Briana McCoy, Auditor Analyst Sarah Hayter, Administrative Analyst Page 6 of 12 COUNTY OF SAN LUIS OBISPO HEALTH AGENCY OFFICE OF THE PUBLIC GUARDIAN Nicholas Drews, Health Agency Director/Public Guardian Ashley Bier, Chief Deputy Public Guardian April 2, 2025 Kari Lekvold, CPA Audit Chief Auditor-Controller-Treasurer-Tax Collector 1055 Monterey Street San Luis Obispo, CA 93408 RE: Public Guardian Cash Procedures & Internal Controls Audit Dear Kari Lekvold: The Public Guardian’s Office (hereafter “PG”) received the original Public Guardian Cash Procedures & Internal Controls Audit on July 12, 2024. A response was submitted on August 19, 2024, addressing all identified findings and recommendations. For your convenience, a copy of that response is attached for reference. On January 24, 2025, your office issued a second Public Guardian Cash Procedures & Internal Control Audit letter, which included a final recommendation related to a previously noted item. Specifically, the recommendation proposed that the Auditor-Controller-Treasurer-Tax Collector (ACTTC) be provided direct online account login information for all current and future bank accounts administered by the Public Guardian. Your follow up letter indicated, “Upon receipt of the Department’s response, the ACTTC developed an alternate solution which we believe will effectively facilitate ACTTC oversight responsibilities without being a named signer on accounts. The alternative is that the Public Guardian provide ACTTC with direct online account login information to enable unimpeded viewing of all Public Guardian account activity.” The PG Office has reviewed this follow-up and provides the following response: Final Recommendation We recommend that the Public Guardian provide the ACTTC with direct online account login information for all current and future bank accounts administered by the Public Guardian, sufficient to allow viewing of account balances and transaction details. County of San Luis Obispo Health Agency P.O. Box 1489 | San Luis Obispo, CA 93406 | (P) 805-781-5845 | (F) 805-781-5566 slocounty.ca.gov/health Page 7 of 12 Department Response The PG Office agrees to provide the ACTTC with direct online access to all current and future bank accounts administered by the PG Office. This access will allow real-time, view-only access to account balances and transaction details. This access will not permit ACTTC to initiate any transactions on the accounts. The PG Office will ensure login credentials are securely created and maintained, and that account access is updated as new accounts are established. Sincerely, Nicholas Drews Health Agency Director/Public Guardian County of San Luis Obispo Health Agency P.O. Box 1489 | San Luis Obispo, CA 93406 | (P) 805-781-5845 | (F) 805-781-5566 slocounty.ca.gov/health Page 8 of 12 Page 9 of 12 Page 10 of 12 Page 11 of 12 Page 12 of 12