Industry, City of - Internal Control System

CITY OF INDUSTRY Review Report INTERNAL CONTROL SYSTEM January 29, 2016, through April 12, 2018 BETTY T. YEE California State Controller January 2019 BETTY T. YEE California State Controller January 23, 2019 Troy Helling, City Manager City of Industry 15625 Stafford Street City of Industry, CA 91744 Dear Mr. Helling: The State Controller’s Office conducted a review of the City of Industry’s internal control system to determine the adequacy of the city’s efforts to implement the recommendations and responses to the findings noted in our prior review report for the period of July 1, 2012, through June 30, 2014, issued on January 28, 2016; and to evaluate the adequacy of the city’s existing internal control system for conducting its operations, preparing financial reports, safeguarding assets, and ensuring proper use of public funds. Our review found that the city did not satisfactorily resolve all of the findings noted in our prior review report (Appendix A). Specifically, the city did not fully implement our recommendations in all of its operations, as indicated by its lack of controls over the Expo Center and the city’s rental properties. In addition, the city’s current internal control system is mostly inadequate, as described in the Findings and Recommendations section of our report. The results of our review and evaluation of the city’s internal control system are included in this report as Appendix B. Our evaluation of the internal control attributes was based on conditions that existed during the review period of January 29, 2016, through April 12, 2018. We used Standards for Internal Control in the Federal Government (Green Book), established by the Government Accountability Office, to assess various aspects of the city’s internal control system. The Green Book outlines the fundamental components, principles, and attributes of an effective internal control system. Of the 48 control attributes evaluated, we found that 36, or 75%, were not present. Only 12, or 25%, were present and functioning. If you have any questions, please contact Efren Loste, Chief, Local Government Audits Bureau, by telephone at (916) 324-7226. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Troy Helling, City Manager -2- January 23, 2019 cc: The Honorable Mark D. Radecki, Mayor City of Industry Cory C. Moss, Mayor Pro Tem City of Industry Abraham N. Cruz, Councilmember City of Industry Catherine Marcucci, Councilmember City of Industry Newell W. Ruggles, Councilmember City of Industry Yamini Pathak, Director of Finance City of Industry City of Industry Internal Control System Contents Review Report Introduction ....................................................................................................................... 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 3 Conclusion .......................................................................................................................... 4 Follow-up on Prior Review Findings ............................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Findings and Recommendations ........................................................................................... 5 Appendix A—Follow-up on Prior Review Findings ........................................................... A1 Appendix B—Evaluation of Internal Control System ........................................................ B1 Attachment—City of Industry’s Response to Draft Review Report City of Industry Internal Control System Review Report Introduction The State Controller’s Office (SCO) conducted a follow-up review to determine the adequacy of the City of Industry’s efforts to implement the recommendations and responses to the findings noted in our prior internal control system review report for the period of July 1, 2012, through June 30, 2014, issued on January 28, 2016. In addition, we reviewed the city’s existing internal control system. This review report covers the period of January 29, 2016, through April 12, 2018. We expanded our testing as necessary to include prior and current transactions to follow up on issues identified by interviewing city officials, and reviewing other audit reports and work done by independent auditors. We conducted this review pursuant to Government Code (GC) section 12422.5, which authorizes the Controller to “audit any local agency for purposes of determining whether the agency’s internal controls are adequate to detect and prevent financial errors and fraud.” We used Standards for Internal Control in the Federal Government (Green Book), established by the Government Accountability Office (GAO), to assess various aspects of the city’s internal control system. The Green Book outlines the fundamental components, principles, and attributes of an effective internal control system. This assessment is intended to help management evaluate how well the city’s internal control system is designed and implemented, and determine where improvements can be made. This report presents the findings and conclusions that we reached in our review of the city’s internal control system. Background City of Industry The City of Industry is an industrial suburb of Los Angeles in the San Gabriel Valley region of Los Angeles County. The city is home to over 2,500 businesses and 80,000 jobs but only 219 residents at the 2010 census—down from 777 residents in 2000. The city is almost entirely industrial. The city has a total area of 12.1 square miles, 11.8 square miles of which is land and 0.3 square miles of which is water. The city was incorporated on June 18, 1957. The City Council is composed of five members elected at large by the city’s citizens to serve for four-year overlapping terms. As the city’s legislative body, the City Council acts upon city laws and is bound to uphold State and Federal laws; the city adopted its own charter on June 8, 1976. The city sets its own laws and policies by ordinance, resolution, and minute action. The City Council appoints members to the various city boards, commissions, and committees, including the Civic-Recreational-Industrial Authority (CRIA). The CRIA was originally established in 1972 by a joint exercise of powers agreement between the City of Industry and its redevelopment agency, the Industry Urban-Development Agency (IUDA). -1- City of Industry Internal Control System The IUDA was dissolved as a legal entity on February 1, 2012; therefore, it is no longer a member of the CRIA. On May 24, 2012, the city adopted Resolution No. CC 2012-10, amending and restating the existing joint exercise of powers agreement and admitted the City of La Puente as a member of the CRIA. The purpose of this agreement is to provide for management, maintenance, operation, and oversight of property, including the Industry Hills Expo Center (Expo Center). The City Council also appoints members to the Industry Property and Housing Management Authority (IPHMA). The IPHMA is a joint powers authority between the City of Industry and the CRIA; it is the governing authority that manages and maintains the city’s housing assets. The IPHMA is administered by a Board of Directors consisting of three Directors—two appointed by the City Council, and one appointed by the CRIA. The Industry Property and Housing Management Authority Fund is an enterprise fund that is supported by rental income, its fund balance reserves, and subsidies from the city’s General Fund. The City Council Members also serve as Board Members/Commissioners to the Successor Agency to the Industry Urban-Development Agency, Industrial Development Authority, Industry Public Utilities Commission, and Industry Public Facilities Authority, with the Mayor serving as Chairman/President of the Board. Administrative and Internal Accounting Controls Review Report On January 28, 2016, the SCO issued a report for its review of the city’s internal control system, which included the following findings:  Sixty-seven of 79 internal control elements were inadequate, rendering accounting controls effectively non-existent.  The city paid $14.7 million to a contractor, the Industry Manufacturers Council, for advertising and promotion despite the lack of proper supporting documentation, making it impossible for SCO and other reviewers to determine what services had been provided.  The city paid $12.3 million to Zerep Management Corporation for maintenance and miscellaneous services although invoices consistently lacked detailed descriptions of the services provided. Several invoices were paid without proper authorization from the finance department or the city manager, as called for in departmental procedures. Some of the work may have been outside the scope of the contract.  The City Council failed to exercise sufficient oversight of the city’s finances and operations, approving contracts without detailed reviews and failing to analyze measures that it had approved. Over eight years, all resolutions and ordinances but one were passed unanimously, and the average City Council meeting (excluding closed sessions) lasted approximately 18 minutes. The City Council approved contract extensions without considering other options or seeking bids from other companies. -2- City of Industry Internal Control System  The city failed to exercise adequate control over city-issued credit cards. Of $235,189 in credit card charges over five years, 83% were found to be questionable, including meals and hotel rooms charged by managers, elected officials, and other employees. One meal charged by a manager in 2014 cost $560. A former manager charged travel expenses of $4,636 on one day in 2012, including $253 for alcoholic beverages and $661 for massage services. Other questionable charges included $796 for an iPad for an elected official, $4,142 for flowers, $446 for a wine-tasting, and $2,185 for a 65-inch television.  Some employees may have been paid twice for the same work.  The city did not maintain timesheets or provide documentation for annual employee reviews. Objectives, Scope, The objectives of our review were to: and Methodology  Determine the adequacy of the city’s efforts to implement the recommendations and responses to the findings noted in our prior review report for the period of July 1, 2012, through June 30, 2014, issued on January 28, 2016; and  Evaluate the city’s internal control system for the period of January 29, 2016, through April 12, 2018, to ensure the: o Effectiveness and efficiency of operations; o Reliability of financial reporting; o Compliance with applicable laws and regulations; and o Adequate safeguarding of public resources. To achieve our objectives, we:  Identified what actions, if any, the city has taken in response to our prior findings and recommendations;  Identified recommendations from our prior review report that have not yet been implemented;  Evaluated the city’s formal internal policies and procedures;  Conducted interviews with city employees and observed the city’s business operations to evaluate the city’s internal control system;  Reviewed the city’s supporting documentation, including financial records;  Performed tests of transactions on a non-statistical sample basis to ensure adherence with prescribed policies and procedures, and to test and validate the effectiveness of controls; and  Evaluated various aspects of the city’s internal control system in accordance with the Green Book. -3- City of Industry Internal Control System Conclusion Our review found that:  The city did not satisfactorily resolve all of the findings noted in our prior review report for the period of July 1, 2012, through June 30, 2014, issued on January 28, 2016. Specifically, it did not fully implement our recommendations in all of its operations, as indicated by its lack of controls over the Expo Center and the city’s rental properties. The results of our follow-up on the prior review findings are described in Appendix A of this report.  The city’s internal control system appears to be mostly inadequate, as described in the Findings and Recommendations section. These findings include: o Insufficient oversight of the Expo Center (Finding 1); o Insufficient oversight of rental properties (Finding 2); o Lack of controls over equipment and vehicle usage (Finding 3); o Lack of controls for a loan to the Industry Convalescent Hospital (Finding 4); o Lack of an audit committee (Finding 5); and o Lack of approved meeting minutes (Finding 6). Of the 48 control attributes evaluated pertaining to internal control components and principles, we found that 36, or 75%, were not present. Only 12, or 25%, were present and functioning. The results of our review and evaluation of the city’s internal control system are included in this report as Appendix B. Follow-up on The city did not satisfactorily resolve all of the findings noted in our prior review report for the period of July 1, 2012, through June 30, 2014, issued Prior Review on January 28, 2016. The results of our follow-up on the prior review Findings findings are described in Appendix A of this report. Views of We issued a draft report on November 28, 2018. Troy Helling, City Manager, responded by email on December 14, 2018, and in a letter Responsible postmarked December 14, 2018. The city stated that it has taken steps to Officials address the issues noted in our findings and will continue to make efforts to enhance its internal control system. The city’s response is included in this final review report as an Attachment. Restricted Use This review report is solely for the information and use of the City of Industry and the SCO; it is not intended to be and should not be used by anyone other than these parties. This restriction is not intended to limit distribution of this review report, which is a matter of public record. Original signed by JIM L. SPANO, CPA Chief, Division of Audits January 23, 2019 -4- City of Industry Internal Control System Findings and Recommendations FINDING 1— The city, as a member of the CRIA, did not exercise sufficient oversight of the financial and operational activities of the Expo Center. As a result, Insufficient the Expo Center, which the CRIA oversees, incurred average annual losses oversight of the of $1.53 million dollars from fiscal year (FY) 2011-12 to FY 2016-17. Expo Center Civic-Recreational-Industrial Authority The CRIA is a separate legal entity formed under a joint exercise of powers agreement. It is noted that the CRIA’s financial statements are included in every fiscal year of the city’s government-wide financial statements as a blended component unit. In addition, the CRIA’s day-to-day operations are administered by the City Manager, and its financial affairs are the responsibility of the City Treasurer and the Director of Finance of the City of Industry. From FY 2011-12 to FY 2016-17, the city transferred $6.86 million to support the CRIA’s operation and management, of which the CRIA transferred $5.31 million directly to the Expo Center, as shown below: FY 2011-12 FY 2012-13 FY 2013-14 FY 2014-15 FY 2015-16 FY 2016-17 Total Average/Year Transfers-in from City of Industry $ 1 ,332,840 $ 1 ,384,382 $ 1 ,325,441 $ 1,349,473 $ 9 18,268 $ 5 46,799 $ 6 ,857,203 $ 1,142,867 Transfers-out to Expo Center $ (1,119,559) $ (1,232,237) $ (1,080,000) $ (849,250) $ (582,000) $ (449,906) $ (5,312,952) $ (885,492) Industry Hills Expo Center The CRIA’s primary function is to oversee the management of the Expo Center, a multi-purpose recreational, meeting, and event facility. The CRIA has contracted with CNC Equestrian Management Services, Inc. (CNC Equestrian) to manage the daily operations of the Expo Center. A City Councilmember is also employed by CNC Equestrian to manage the Expo Center’s accounting functions. The Expo Center’s operating revenue from events and rentals was not sufficient to cover its operating expenses. During the period of July 1, 2011, through June 30, 2017, the Expo Center experienced total net losses of $9.18 million dollars, an average of $1.53 million dollars per fiscal year, as shown below: FY 2011-12 FY 2012-13 FY 2013-14 FY 2014-15 FY 2015-16 FY 2016-17 Total Average/Year Total Operating Revenue $ 1,430,399 $ 1 ,535,020 $ 1 ,433,242 $ 1 ,290,492 $ 1 ,507,883 $ 1 ,552,885 $ 8,749,921 $ 1,458,320 General Administration 1,197,876 1 ,167,067 1 ,220,862 1 ,124,188 1 ,038,152 1 ,037,654 6,785,799 1,130,967 Expo Center Operation 1,178,005 1 ,261,214 1 ,185,308 9 01,744 1 ,064,418 1 ,127,486 6,718,175 1,119,696 Depreciation 728,828 7 49,372 7 51,458 7 47,153 7 51,277 7 47,916 4,476,004 746,001 Total Operating Expenses 3,104,709 3 ,177,653 3 ,157,628 2 ,773,085 2 ,853,847 2 ,913,056 17,979,978 2,996,663 Operating Income (Loss) ( 1,674,310) (1,642,633) (1,724,386) (1,482,593) (1,345,964) (1,360,171) (9,230,057) ( 1,538,343) Other Income 6,164 8 ,373 8 ,232 6 ,532 7 ,384 7 ,932 44,617 7,436 Net Income (Loss) $ ( 1,668,146) $ (1,634,260) $ (1,716,154) $ (1,476,061) $ (1,338,580) $ (1,352,239) $ (9,185,440) $ ( 1,530,907) The city transferred funds to the CRIA, which the CRIA subsequently transferred to the Expo Center to compensate for the losses. Between FY 2011-12 and FY 2016-17, the CRIA transferred a total of $5.31 million to the Expo Center. -5- City of Industry Internal Control System Lack of internal controls over Expo Center The Expo Center lacks internal controls, such as formal policies and procedures, supporting documentation for payments, adequate oversight of purchasing, and adequate maintenance of records. Lack of formal policies and procedures We attempted to assess the Expo Center’s written policies and procedures regarding its operations to ensure that the control procedures were complete and sufficient to protect public resources from misuse. However, city management did not provide us with any written policies and procedures. In addition, city management was not directly involved in the Expo Center’s daily operations and could not demonstrate an understanding of the internal control system over Expo Center activities. Without written policies and procedures to evaluate, we attempted to interview Expo Center staff to gain an understanding of its operations and controls. However, we were not permitted to interview anyone because city management claimed that Expo Center staff were contractors and not employees; therefore, the city could not compel them to cooperate. Inadequate supporting documentation for expenses We reviewed the Expo Center’s Expense Ledger Detail Listing for FY 2016-17, and requested supporting documentation, such as invoices and purchase orders, for 14 transactions to ensure that the expenses were for official business, classified correctly, recorded in a timely manner, and approved by management prior to payment. However, the city did not provide supporting documentation. We could not verify that any Expo Center expenses were for official business. Lack of supporting documentation for questionable transactions in Check Register Summaries All of the Expo Center’s expenses were listed in monthly Check Register Summaries and were presented to the CRIA Board for final approval. For the period of January 1, 2016, through April 30, 2018, we noted several issues in Check Register Summaries that warrant follow-up review:  Fifty-one entries for Automated Teller Machine (ATM) replenishments totaling $480,040 were questionable. Except for one entry of $9,540, entries for ATM replenishment were generally in multiples of $500 or $1,000. For example, ATM replenishment on July 5, 2016, was $30,000 and on July 24, 2016, was $2,500. Normally, funds in ATMs are replenished based on the money withdrawn by users and not always perfectly rounded in multiples of $500 or $1,000. Despite multiple requests, the city has not provided any documentation of its ATM replenishment process, such as activity logs or a formal internal policy and procedures. -6- City of Industry Internal Control System We were unable to verify that these ATM replenishments were for official business.  Forty-six checks were voided, for which the city has not provided any documented justification. Proper explanations for voided checks should be presented before the CRIA Board fully accepts the monthly Check Registers. We were unable to verify that these checks were properly voided.  Fifty-seven checks were not included in the Check Register Summaries. Check numbers were periodically skipped in the Check Register Summaries; the city did not provide any documented justification upon request. The city should cancel these checks to ensure that they are voided and cannot be used. Inadequate oversight of purchasing The city does not provide sufficient oversight of the Expo Center’s purchasing and payment processes. The city gave CNC Equestrian complete control and authority over the city’s bank account. CNC Equestrian can authorize and make its own purchases without any oversight from city management. CNC Equestrian can also produce checks for these purchases. The city granted this contractor almost complete control of the purchasing and payment process with minimal city management involvement, which is contrary to the city’s established financial responsibilities as stated in the CRIA’s joint powers agreement. Inadequate record keeping The City Treasurer claims that she reviewed supporting documentation, such as invoices, before she signed checks for Expo Center expenses. However, we could not confirm this, because the city did not maintain copies of these documents. The city is responsible for maintaining supporting documentation to support that it spent public resources appropriately. Lack of management oversight to mitigate operational losses On June 1, 2002, the CRIA assumed control over the Expo Center’s operations. Since that time, Expo Center has consistently lost money for the city. The city established the Expo Center activities as an enterprise fund; therefore, it should be fully supported by its revenue activities with minimal support from other financing sources such as transfers. Based on the documents reviewed and interviews with city management, it appears that the city failed to:  Address the Expo Center’s operational losses;  Develop formal policies and procedures; -7- City of Industry Internal Control System  Exercise sufficient oversight of the purchasing and payment processes; and  Maintain adequate supporting documentation relating to expenses and the handling of checks. Recommendation We recommend that the city, as a member of the CRIA:  Develop a plan to address Expo Center operational losses;  Develop formal policies and procedures;  Exercise additional oversight for the purchasing and payment processes; and  Maintain adequate supporting documentation relating to expenses and the handling of checks. City’s Response The Report states that annual losses from the Expo Center result from insufficient oversight. However, the Report fails to offer any facts which support that a lack of oversight caused any losses experienced by the Expo Center. While there are certain changes that can improve daily operations and accounting, a fundamental understanding of the Expo Center’s public purpose helps to clarify why the facility does not operate as a profit center…. Similar to parks and recreation departments of cities across California, this community resource is not operated purely for the purpose of generating profit for CRIA and may incur operational losses, which the City has subsidized to allow continued service…. Expo Center revenues have steadily increased by 21.6% during the past three (3) years, from $1,295,861 in 2015, to $1,576,126 in 2017. CRIA will continue to seek opportunities to increase facility utilization, including both revenue generating and those that benefit the City, neighboring communities and residents. The political nature of this Report is again noted when the Controller’s office states that “a City Councilmember is also employed by CNC Equestrian Management Services, Inc. (“CNC Equestrian”) to manage the Expo Center’s accounting functions.” It is unclear how that statement is relevant to the analysis (or lack thereof) concerning the operations at the Expo Center. The notation concerning the Councilmember is likely an effort by the Controller and her cronies to intimidate an Industry Councilmember and as retaliation against that Councilmember for actions related to the Tres Hermanos project. Inadequate oversight of purchasing/Inadequate Record Keeping: Contrary to what is stated in the Report, the City does not give CNC Equestrian complete control and authority over the City’s bank account, or purchasing and payments. -8- City of Industry Internal Control System Presently, CRIA contracts with CNC Equestrian to manage all day-to- day operations, including operation of the facility, staffing, and bookkeeping. All invoices are reviewed by CNC Equestrian, then a check is prepared and submitted for authorization and payment by CRIA. Payment authorization requires dual signatures by City administrators. Thereafter, month end closing and reconciliation is prepared by Rogers, Clem & Company, an accounting firm, and reviewed by CRIA, at a public meeting, and audited by The Pun Group, another accounting firm. With respect to the issue of voided checks, those checks are included in the warrant register for CRIA’s review. It is also the City’s understanding that CNC Equestrian has plans to contract out the ATM replenishment process. There are also instances where the Controller indicates that it was “unable to verify that checks were properly voided” or that it could “not verify that any Expo Center expenses were for official business,” yet the Report does not demonstrate that the checks were not properly voided, or that expenses were not for official business. These remarks are used to make the reader believe that the City or CNC Equestrian are somehow engaged in illicit activities, however there is nothing to substantiate these allegations. To address other concerns identified in the Report, formal policies and procedures to define appropriate operations and expenditures will be drafted, submitted for CRIA’s consideration, and implemented consistent with the City Resolution 2013-12. For example, both CRIA and the City will further outline the purchasing and payment process, as well as ensure preservation of supporting documentation in accordance with a records retention schedule. SCO Comment Our finding and recommendations remain unchanged. As presented in the report, the Expo Center experienced annual losses of $1.53 million during the last six fiscal years that we reviewed. Although the city did not make individuals who were knowledgeable about the Expo Center operation available for our inquiry and provided only limited documentation for our review, the finding identified several internal control weaknesses that may contribute to the Expo Center’s operating losses. The prevention and control of weaknesses in internal control is a responsibility of the city, as a member of CRIA, and its management. The Expo Center is accounted for in the city’s basic financial statements as an enterprise fund. In accordance with standards that the city claims it adheres to, the Government Finance Officers Association (GFOA) advises that “It is essential that a government maintain adequate levels of working capital in its enterprise funds to mitigate current and future risks (e.g., revenue shortfalls and unanticipated expenses) and to ensure stable services and fees.” We were unable to analyze the Councilmember’s role regarding the Expo Center’s operations because the city did not provide substantive documentation or make knowledgeable individuals available for inquiry. Similarly, we were unable to determine if there were any conflicts of interest related to the Councilmember’s role of approving Expo Center purchases and payments to CNC Equestrian. We did not identify the Councilmember in the report. -9- City of Industry Internal Control System The city states that “the Report does not demonstrate that the checks were not properly voided, or that expenses were not for official business.” As previously stated, SCO auditors were unable to analyze the voided checks, supporting documentation, or expenses because, despite repeated requests, the city did not provide substantive documentation or make knowledgeable individuals available for inquiry. We did not make any statement regarding whether the city or CNC Equestrian were engaged in illicit activities. We would welcome the city’s response to our repeated requests for additional information and substantive documentation to support the city’s assertion that public funds were spent appropriately. The purpose of the finding was to encourage the city to develop and implement formal policies and procedures to ensure that public funds are properly accounted for and spent appropriately. The finding presented in this report is based on inquiry with city management and personnel, and evaluation of documentation provided during our review. FINDING 2— The city, as a member of the IPHMA, incurred significant losses due to insufficient oversight of its rental properties. The IPHMA incurred losses Insufficient in its yearly operations of $169,705 in FY 2014-15, $683,277 in oversight of rental FY 2015-16, and $340,425 in FY 2016-17. properties The city’s rental properties are managed by the IPHMA, which is a joint powers authority between the City of Industry and the CRIA; it is the governing authority that manages and maintains the city’s 29 rental properties. The IPHMA is administered by a Board of Directors (IPHMA Board) consisting of three Directors—two appointed by the City Council and one appointed by the CRIA. The Industry Property and Housing Management Authority Fund is an enterprise fund supported by rental income, fund balance reserves, and subsidies from the city’s General Fund. The IPHMA is a separate legal entity under the joint powers act; however, the IPHMA’s day-to-day operations are administered by the City Manager, and its financial affairs are the responsibility of the City Treasurer of the City of Industry. We identified several issues that may have contributed to the operating losses of the rental properties. Lack of a clear objective The city does not have a clear objective for the IPHMA, or a strategic plan for its operations. The Basic Financial Statements for FY 2016-17 mention that the IPHMA was established “to manage the property and housing rental activity within the City.” We spoke with city management on several occasions in an attempt to understand the objective of the IPHMA; however, city management could not explain the IPHMA’s purpose beyond managing the city’s properties and rental activity. -10- City of Industry Internal Control System City management was unclear about whether the city’s housing properties are for low-income residents, city representatives and their family members, or city contractors. Without a clear purpose, it is difficult to determine whether the IPHMA’s operations are aligned with its objective. Lack of formal policies and procedures The city lacks formal policies and procedures for its rental housing operation, such as the housing application process, the methodology for determining rents charged to tenants, and the house remodeling process. Lack of a formal application process According to the city, the informal application process is initiated by a prospective tenant, who submits a letter describing his or her hardships and need for housing in the city. The IPHMA Board reviews the letters and approves new tenants at its sole discretion, without any documented justification. The vacancies are usually not advertised. The IPHMA Board’s methodology and criteria for selecting tenants is questionable. For example, a Councilmember’s spouse expressed difficulties with climbing stairs while living in a city rental house and requested tenancy in a single-story house. The IPHMA Board allowed the Councilmember and family to move to a newly-renovated house that had been remodeled for $528,028. The IPHMA Board’s methodology in tenant selection is not transparent and appears questionable. To improve the process, the city should establish a formal application process based on a priority list, with a documented methodology to ensure that public funds are not misused. Lack of rent calculation methodology On September 20, 2018, the price range to rent a house in the city area is $2,200 to $3,250 per month. The city charges rental rates of $600 to $700 per month for houses which vary in size and number of bedrooms and bathrooms. These rates are significantly below the market rate. The city lacks a documented methodology to substantiate how it determines the below-market rental rate for its tenants. As stated in Note 17 of the Basic Financial Statements for FY 2016-17, the city’s housing properties are occupied by current and former City Council members, current Commissioners, and current Boards members. GC section 8314 provides in relevant part: (a) It is unlawful for any elected state or local officer, including any state or local appointee, employee, or consultant, to use or permit others to use public resources for…personal or other purposes which are not authorized by law. (b) For purposes of this section: (1) ‘Personal purpose’ means those activities the purpose of which is for personal enjoyment, private gain or advantage, or an outside endeavor not related to state business… -11- City of Industry Internal Control System (3) ‘Public resources’ means any property or asset owned by the state or any local agency, including, but not limited to, land, buildings, facilities, funds, equipment, supplies, telephones, computers, vehicles, travel, and state-compensated time. The city does not consider the difference between the city’s rental rate and market rate as a form of compensation for city representatives. Without policies and procedures, it is unclear whether this dollar amount is a form of taxable compensation or a gift of public funds. Based on our review of the IPHMA Board meeting minutes, housing rental rates have not been adjusted since September 2012. Additionally, other documents that were made available for our review did not show whether rent was ever adjusted for city housing. The city’s failure to adjust housing rental rates contributed to a loss of additional city revenue. No policy and procedures for the remodeling process The city does not have a policy or procedures for the remodeling process. Normally, remodeling is approved by the IPHMA Board; however, we were not able to verify the approval for the remodeling of the house in which a Councilmember’s spouse currently resides, which cost approximately $528,028, because the city did not provide the auditors with complete IPHMA Board or City Council meeting minutes. Without established formal policies and procedures, the city is at risk of being unable to prevent and detect abuse of public funds. Demand for payments lacked proper analysis and review Payments for goods and services were approved by the city without adequate review. From January 2015 to July 2017, demand for payments amounted to $1.88 million dollars. The city approved these payments without question or scrutiny. We noted the following questionable payments:  $418,000 for CNC Engineering’s professional services costs relating to house remodeling were paid without an IPHMA Board-approved contract agreement. We reviewed the meeting minutes between September 2014 and November 2016, and found no approval of CNC Engineering’s contract agreement.  Material variances in monthly maintenance costs for Satsuma, maintenance contractor for the city, were neither reviewed nor questioned. The billing invoices fluctuated between $9,000 and $17,000 a month, but the city did not justify these variances. Lack of controls for remodeling expenses On January 6, 2015, the City Engineer solicited bids for Project IPHMA-001 with estimated project costs of $525,000. The project was for the remodeling of houses located at 15714 and 15722 Nelson Avenue, City of Industry. -12- City of Industry Internal Control System On February 8, 2015, the IPHMA Board reduced the scope of improvements to only the house at 15722 Nelson Avenue, and revised the remodeling cost estimate to $175,000. This property features two bedrooms and two bathrooms with 1,044 square feet of living space. At that time, a city employee was renting this property for $700 per month. Several instances demonstrate that the city failed to exercise sufficient oversight of the project. Based on our review of available documents, we noted that:  The city selected a bid for $373,577 although the revised scope’s estimated cost was $175,000; and  The total costs incurred for the remodeling project grew to over $788,000. The total costs included construction and other professional services. Some of the professional services provided by CNC Engineering and Kleinfelder were incurred without contracts approved by the IPHMA Board. We also noted that the approved construction contract agreement for remodeling is contradictory. Article 1 of the contract between the IPHMA and CNC Engineering states that IPHMA will provide the contractor with the materials for the work to be performed. However, Article 3 states that the contractor will provide the materials, contrary to Article 1. There were no contract amendments to correct this misstatement regarding who should provide materials. Additionally, the agreement did not include the maximum billable amount, which should have been included to help control costs. IPHMA’s operating losses The city established the IPHMA activities as an enterprise fund; therefore, it should be fully supported by its revenue activities with minimal support from other financing sources. -13- City of Industry Internal Control System However, as a result of the city’s lack of oversight, formal policies and procedures, and rental calculation methodology; and severe deficiencies in controls over the handling of renovations, the IPHMA operated at a loss for FY 2014-15 through FY 2016-17, averaging approximately $398,000 annually per fiscal year, as shown below: FY 2014-15 FY 2015-16 FY 2016-17 Total Average Operating Revenue: Rental Income $ 2 19,700 $ 1 75,007 $ 1 91,300 $ 5 86,007 Total Operating Revenue 2 19,700 1 75,007 1 91,300 5 86,007 $ 195,336 Operating Expenses: Personnel Services - - 2 3,245 2 3,245 Cost of housing authority operations 2 91,866 7 59,130 3 96,205 1 ,447,201 Depreciation 9 7,539 9 9,154 1 12,275 3 08,968 Total Operating Expenses 3 89,405 8 58,284 5 31,725 1 ,779,414 593,138 INCOME (LOSS) FROM OPERATIONS $ (169,705) $ (683,277) $ (340,425) $ (1,193,407) $ (397,802) Recommendation We recommend that the city, as a member of the IPHMA:  Establish a clear objective and strategic plan for the IPHMA, to align with its operating activities;  Establish formal policies and procedures for the application process;  Advertise vacancies to create a fair opportunity to receive housing; and  Develop a methodology to determine fair market value for its rental properties to offset operating losses and remodeling expenses. City’s Response Lack of clear objective: … Per the JPA [Joint Powers Agreement], the purpose of the IPHMA is to manage City and CRIA owned residential properties Lack of formal policies and procedures: The IPHMA Board has directed staff to prepare standard applications, lease agreements, and a methodology for rent determinations to comply with best practices. To provide a comprehensive set of policies and procedures, staff is preparing a Request for Qualifications to retain a consultant, with public housing expertise, to advise and assist with standardization of practices, commensurate with a housing objective to be defined by IPHMA and, as the matter relates to land use and development, the City Council. Once these policies and procedures are completed, concerns listed in the Report will be fully resolved. Please note that, on Page 9, under Lack of rent calculation methodology, the second paragraph states that “the city’s housing properties are occupied by . . . current IPHMA Board members.” In fact, no past or present IPHMA Board members live in any property managed by the IPHMA, and none of the IPHMA Board Members are City residents…. -14- City of Industry Internal Control System With respect to Satsuma, it is unclear how the Controller came to the conclusion that the monthly maintenance costs were “neither reviewed nor questioned,” and that there was nothing to justify the variances in the invoice amount. Invoices from Satsuma are processed in the same manner as all requests for payment from vendors. Once received, the invoice is submitted to Accounts Payable staff, within the Finance Department, who compare it against the Purchase Order (“PO”) terms. If the type of service, allocated time, and cost is consistent with the PO, then the invoice is transmitted to the City Manager for signature. Prior to authorizing payment, the City Manager, or his authorized designee, will verify that work performed was actually needed and ordered by the City, satisfactorily completed, and the time and materials billed are reasonable. Afterwards, all records are retained. Concerning the variances in Satsuma’s invoices, it is only logical for invoices to vary for maintenance services based on the level of services performed each month. Further, consistent with the tone of the Report, statements were made once again to intimidate a Councilmember and as political retribution. While repairs and renovations have been made to most of the housing managed by the IPHMA, the Controller chose to single out a Councilmember’s home to use as an example. SCO Comment We have updated this finding based on the city’s clarification; our recommendations remain unchanged. The draft version of this report stated: As stated in Note 17 of the Basic Financial Statements for FY 2016-17, the city’s housing properties are occupied by current and former City Council members, current Commissioners, and current IPHMA Board members. This final version states: As stated in Note 17 of the Basic Financial Statements for FY 2016-17, the city’s housing properties are occupied by current and former City Council members, current Commissioners, and current Board members. As stated in the finding, “city management was unclear about whether the city’s housing properties are for low-income residents, city representatives and their family members or city contractors.” Without a clear objective, we could not determine how the IPHMA Board could properly and reasonably manage these city-owned properties. The city disagreed with our conclusion that the IPHMA lacked a clear objective or strategic plan for its operations, and claimed that the purpose of IPHMA is simply to manage residential properties. However, the city stated that it plans “to retain a consultant, with public housing expertise [emphasis added], to advise and assist with standardization of practices, commensurate with a housing objective to be defined by IPHMA [emphasis added].” This statement seems to indicate that the IPHMA Board is considering updating or redefining IPHMA’s objective for a public housing-related purpose. -15- City of Industry Internal Control System As noted in the report, questionable expenses were included in the list presented to the city for approval. However, for the period of January 2015 through July 2017, the city did not question or disapprove any of these expenses. The city’s response included a statement regarding the intimidation of a Councilmember. This report is not intended to single out any city officer or employee, but to present examples of circumstances that showed weaknesses in internal controls. We could not determine whether there were any conflicts of interest, such as preferential treatment regarding the rent calculation, or approval of the rental application, because the city lacked documentation, policies, procedures, and methodologies. It is unclear whether the Councilmember was approved for housing because of the Councilmember’s employment with Square Root (a city landscaping vendor) or the Councilmember’s role in city governance. We did not identify the Councilmember. FINDING 3— The city lacks formal policies and procedures and active oversight of contractors’ use of city-owned equipment and vehicles. Lack of controls over equipment We assessed the city’s policies and procedures regarding equipment and and vehicle usage vehicle usage to ensure that the control procedures were complete and sufficient to protect public resources from misuse. We noted that the city did not have any formal policies and procedures for equipment and vehicle usage by city employees or contractors. The city provided contractors with equipment and vehicles for use in their work on city projects. For example, two supervisors for a maintenance contractor (Square Root), were provided city-owned Ford F-150s. These supervisors are also City of Industry Councilmembers. The city did not stipulate in the contract agreement that contractors must abide by the same rules that city employees are required to follow. The city also lacks compensating controls to prevent the personal use of equipment and vehicles by contractors for which the city incurs additional costs for maintenance and upkeep. Without effective controls, city-owned equipment and vehicles are potentially susceptible to theft, vandalism, and misuse of public resources. Recommendation We recommend that the city:  Establish formal policies and procedures for the use of authorized equipment and vehicles by city employees; and  Establish compensating controls for contractors who use city-owned equipment and vehicles. City’s Response Concerns of theft, vandalism, and misuse of city-owned equipment and vehicles will be addressed by preparing a policy that all publicly owned equipment and vehicles may only be used by authorized City employees to conduct official business. -16- City of Industry Internal Control System Any current agreements will be evaluated for compliance and future agreements will include clear contract language to ensure that neither City owned vehicles nor equipment are used. This does not, however, preclude a contractor or consultant from requesting reimbursement for related equipment or vehicle expenses incurred from actual pre- authorized service to the City. Once again, the Controller’s office took an opportunity to make an example of Councilmembers while ignoring the greater use of City owned vehicles by other contractors. This blatant targeting of City officials further supports the City’s conclusion that the purpose of this Report was nothing more than political gamesmanship by the Controller on behalf of those private parties with an interest in the Tres Hermanos project. SCO Comment Our finding and recommendations remain unchanged. The city’s response included a statement regarding the targeting of Councilmembers. We could not determine whether there were any conflicts of interest regarding the Councilmembers’ role in the approval of the contract, because the city did not have meeting minutes. We did not identify the Councilmembers. FINDING 4— The city lacks policies and procedures for the collection of an outstanding loan to the Industry Convalescent Hospital (dba El Encanto Healthcare and Lack of controls Habilitation Center). for a loan to the Industry The balance on the loan from the city to Industry Convalescent Hospital is Convalescent an estimated $44.6 million, with a principal balance of $20.0 million and Hospital an additional $24.6 million balance from accrued interest, as stated in the Basic Financial Statements for FY 2016-17. According to city records, the city has received only one principal payment of $400,000, on October 10, 2008, and one interest payment of $100,000, on April 15, 2009, since the loan was formalized on December 6, 1990. The loan agreement states, in part: Hospital agrees to repay the advances…at such time as hospital has surplus funds sufficient to pay some portion or all of the obligation and, in that event, upon demand by City, Hospital agrees to make such payments. The city stated that it does not have policies and procedures in place to collect on the loan to the hospital, nor has it attempted to collect on the loan. According to the Basic Financial Statements for FY 2015-16, 100% of the outstanding balance was offset by an allowance for doubtful account, which means that the city does not think it will be able to collect the full loan amount. The city did not regularly invoice the hospital for loan payments. Given the size of this loan and the city’s failure to make any collections, the city has not demonstrated an intent to adequately safeguard public resources. -17- City of Industry Internal Control System Recommendation We recommend that the city:  Establish formal policies and procedures for the collection of loan payments. This should include the timely issuance of invoices to request payment; and  Regularly evaluate the collectability of loans. City’s Response [O]n August 9, 2018, the City Council directed staff to begin negotiating a restructuring of the loan to recover the principal balance.…The City commits to working with the facility operator to develop an agreeable and realistic repayment process and, upon establishment of a payment schedule, will establish a clear invoice system. FINDING 5— The city lacks an audit committee to advise the City Council. Lack of an audit On June 30, 2012, the Los Angeles County Civil Grand Jury (Grand Jury) committee issued a final report of its findings and recommendations pertaining to county government matters during FY 2011-12. In its report, the Grand Jury recommended to 24 charter cities within Los Angeles County—City of Industry included—that they establish formal audit committees to provide independent review and oversight for the cities’ financial reporting processes, internal control system, and independent auditors. Furthermore, the GFOA recommends that every state and local government establish an audit committee as a way of implementing best practices. As stated on the GFOA website: An audit committee is a practical means for a governing body to provide much needed independent review and oversight of the government’s financial reporting processes, its internal controls, and its independent auditors. An audit committee also provides a forum separate from management in which auditors and other interested parties can candidly discuss concerns. By effectively carrying out its functions and responsibilities, an audit committee helps to ensure that management properly develops and adheres to a sound system of internal controls, that procedures are in place to objectively assess management’s practices, and that the independent auditors, through their own review, objectively assess the government’s financial reporting practices. The City Council does not perform the aforementioned functions, and is therefore not considered an audit committee. As noted previously in this report, the city:  Lacks formal policies and procedures for various processes;  Lacks oversight of operations throughout the city; and  Failed to adequately resolve all findings from the prior report. -18- City of Industry Internal Control System The City Council failed to develop and adhere to a robust internal control system, especially concerning its component units, the CRIA and the IPHMA. This can be attributed to the lack of an audit committee. The purpose of an audit committee is to advise and provide recommendations regarding financial reporting, internal control functions, risk management systems, and audit findings. If the city had an independent audit committee, or if the City Council acted as one, then city management would have ensured that policies and procedures were in place to ensure: • Effectiveness and efficiency of operations; • Reliability of financial reporting; • Compliance with applicable laws and regulations; and • Adequate safeguarding of public resources. Recommendation We recommend that the city establish an audit committee to ensure that proper internal controls are in place to help the city operate efficiently and effectively. To maintain its independence, the audit committee should not include members of city management. City’s Response Enclosed herewith, please find a copy of RESOLUTION NO. CC 2013-18, A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF INDUSTRY, CALIFORNIA, ESTABLISHING AN AUDIT COMMITTEE AND DESIGNATING ITS FUNCTIONS, adopted on September 26, 2013. The committee membership does not include members of City Management. Section 5.A of Resolution No. CC 2013-18 provides, in part, that the Audit Committee will: “Hold an annual meeting at least once each fiscal year.” For the audited time period, there are no records of convened meetings. Staff will schedule an agenda item for the City Council to appoint members and establish a regular meeting schedule. A copy of the Resolution is attached hereto as Exhibit C. FINDING 6— The city lacks a substantial amount of approved meeting minutes for its governing bodies including the City Council, Industry Public Utilities Lack of approved Commission, CRIA, IPHMA, Planning Commission, Industry Public meeting minutes Facilities Authority, the Successor Agency to the Industry Urban- Development Agency, and the Oversight Board of the Successor Agency to the Industry Urban-Development Agency. We reviewed the minutes posted to the city’s website for meetings held between January 1, 2016, and October 1, 2018, and noted that many minutes were missing. -19- City of Industry Internal Control System A summary of the missing meeting minutes as of October 1, 2018, is as follows: Percentage Available Missing of Missing Meeting Meeting Meeting Calendar Year Agendas Minutes Minutes Minutes 2016 105 65 40 38.1% 2017 104 6 98 94.2% Jan. 1 to Oct. 1, 2018 88 2 86 97.7% Total 297 73 224 75.4% The city is missing 224 of 297, or 75.4%, completed minutes for meetings held between January 1, 2016, and October 1, 2018. By not posting meeting minutes to the city’s website, the city’s operations lack transparency. Meeting minutes of the city’s various governing bodies should be transcribed, reviewed, approved, and posted to the city’s website in a timely manner. The lack of timely approved meeting minutes is troubling, as city citizens and other interested parties are left unaware of the governing bodies’ actions and their direction for the city. Recommendation We recommend that the city establish policies and procedures to ensure that meeting minutes for the city’s governing bodies are promptly transcribed, reviewed, approved, and posted to the city’s website. City’s Response Transparency and accountability are high priorities of this City Council and administration. Accordingly, timely adoption of Board/ Commission and/ or City Council meeting minutes has been addressed. Since September 2018, minutes for all City Council meetings have been completed and scheduled for City Council adoption by the next regularly scheduled meeting. In addition, a formal policy, to standardize content, form, timeliness, and public availability of minutes, is being prepared for City Council adoption. Given the substantial number of past Board/Commission and/ or City Council meeting minutes that have neither been prepared nor adopted, staff is also developing a plan to ensure steady progress toward bringing all minutes up-to-date. The city’s response included a statement indicating confusion about the OTHER ISSUE 1— review period. Review Period City’s Response In 2015, your office conducted a prior review of the City for the period of July 1, 2012 through June 30, 2014. It is unclear why any subsequent review does not cover the period beginning July 1, 2015 to ensure a complete review of the City’s internal financial controls. -20- City of Industry Internal Control System SCO Comment Although the prior SCO review covered the period of July 1, 2012, through June 30, 2014, as stated in the January 28, 2016 review report, the review included testing of pertinent transactions and an evaluation of the city’s responses through January 28, 2016. Hence, the follow-up review was conducted for a period subsequent to issuance of the prior review report. Additionally, as previously stated in this report, we expanded our testing as necessary to include prior and current transactions, outside of the stated review period, to follow up on issues identified. The city’s response included a statement indicating objections to the OTHER ISSUE 2— follow-up review. Follow-up Review City’s Response Curiously, during the City’s entrance conference with staff from your office, it was communicated that the Controller had not engaged in any subsequent review of any other agency throughout the State, and that the Controller’s first follow-up review was being conducted in Industry. Based on documents obtained through a request to your office under the California Public Records Act [Exhibit A of the Attachment], it appears that this subsequent review is nothing more than a politically motivated attack on the City and its elected and appointed officials, and an attempt by your office to assist private individuals with whom your office maintains personal and political relationships. SCO Comment Contrary to the city’s statement, the follow-up review of the City of Industry is not the first follow-up engagement performed by the SCO. During the follow-up review entrance conference on April 12, 2018, the city asked if the SCO had performed a follow-up review with any other agencies. The SCO advised the city that, for its internal control review program, the SCO had previously performed a follow-up review of the City of Bell and issued a report on May 22, 2013, subsequent to its initial audit report issued on September 22, 2010. The SCO performed this follow-up review to evaluate the city’s implementation of the recommendations identified in the January 28, 2016 review report. The findings and recommendations made in this report are for purposes of detecting and recommending solutions to internal control weaknesses that make the city vulnerable to fraud and abuse. As a local agency, the city is responsible for establishing an internal control system to deter and detect fraudulent behavior and errors, and for retaining adequate supporting documentation to demonstrate that public monies were spent appropriately. -21- City of Industry Internal Control System The documents contained in Exhibit A of the city’s response are not relevant to the findings and recommendations. It is unclear how Exhibit A shows that this review of the city’s internal control system was a “politically motivated attack on the city and its elected and appointed officials.” Exhibit A does not mention any elected or appointed officials, nor does our report identify any elected or appointed officials. The city’s response included a statement objecting to the review scope. OTHER ISSUE 3— Project Selection – City’s Response Review Scope [Y]our staff indicated that much of what is reviewed is precipitated by newspaper articles, whistleblowers or comments by staff members with the targeted agency. For at least the past year, there have been countless articles written about the City’s purchase of the property known as Tres Hermanos, and the transaction is currently subject to seven lawsuits. Despite the high profile nature of this transaction, the fact that $20 million in public funds were spent on the project, and that the party with whom the City contracted has failed to provide any substantive documents which support its use of the $20 million, the Controller’s office failed to review the Tres Hermanos project. This failure exists despite my request for a review of the transaction by the Controller. SCO Comment We discussed the project during a meeting with city officials on July 19, 2018, and continued that conversation via emails on July 24, August 6, and August 20. We did not receive responses regarding Tres Hermanos. In a telephone conversation on August 29, 2018, a city official informed us that the city would not be responding to our inquiries. The city’s response included a statement expressing the opinion that SCO OTHER ISSUE 4— did not review all relevant reports. Bill Lockyer, City’s Former City’s Response Independent Reform Advisor’s [T]he Controller should have reviewed Mr. Lockyer’s reports, as they Reports routinely discussed the City’s compliance with the Controller’s recommendations, and lauded the City, its elected and appointed officials, for its/their progress. SCO Comment SCO auditors reviewed Mr. Lockyer’s reports during fieldwork. We requested an additional report that had not been included in the first set of reports that the city provided; however, we could not review it, because the city did not respond to that request. Our request for additional information is still active, and we would welcome the city’s input. -22- City of Industry Internal Control System The city’s response included a statement indicating confusion about the OTHER ISSUE 5— internal control standards used to conduct our review. Standards for Internal Control in City’s Response the Federal Government It has also been noted that your office used Standards for Internal Control in the Federal Government (Green Book), established by the Government Accountability Office (GAO), for your assessment of the City’s internal control system. What was not explained to the City is why those standards are used, and whether those standards are used by the majority of cities in California. SCO Comment In compliance with GC section 12422.5, the State Controller developed and published the 2015 Internal Control Guidelines for California Local Agencies. This publication incorporates various standards, including the Committee of Sponsoring Organizations (COSO) of the Treadway Commission Internal Control Standards and the Green Book, published by the GAO. The SCO uses the Green Book for its assessment of a state or local agency’s internal control system. The Green Book adapts the COSO 2013 internal control guidance for a government environment. -23- City of Industry Internal Control System Appendix A— Follow-up on Prior Review Findings -A1- City of Industry Internal Control System City’s Overall In response to our prior review report, issued on January 28, 2016, the City Council approved a contract agreement for independent reform Response to Prior advisory consulting services on May 26, 2016, to make independent Findings assessments of the city’s efforts to address administrative, managerial, and governing deficiencies. The City Council terminated the Reform Advisor’s work engagement on January 11, 2018. On February 27, 2018, the City Council voted to terminate the employment of the City Manager. The Director of Development Services and the Director of Finance tendered their resignations on March 15, 2018, and May 21, 2018. We noted that the city did not satisfactorily resolve all of the findings noted in our prior review report. Specifically, it did not fully implement our recommendations in all of its operations, as indicated by its lack of controls over the Expo Center and the city’s rental properties. The results of our follow-up on the prior review findings are noted below. PRIOR SCO Recommendation FINDING 1— The City should develop and implement policies and procedures to Questionable ensure that responsible city officials perform a detailed review and gain payments of full understanding of the professional services to be provided before $14.7 million paid entering into a contractual agreement. Contractual agreements should to a contractor be presented to the City Council with full explanation of the services to be provided and benefits to the City prior to approval and before formal execution. The contractual agreements should specify services to be delivered and such services should be definitive and measurable. Finally, proper oversight should be provided by the City to ensure that services are delivered as required and payments should only be authorized and made after detailed review and confirmation that services were actually performed. The City should also revisit this contractual agreement and all of the billings to ensure that payments were made for services performed and not just based on the City’s budget and quarterly allocation basis. If the City determines that the payments to the IMC [Industry Manufacturers Council] were made for services not delivered, it should seek monetary recourse to recover these funds. City’s Response Regarding Corrective Action Taken or Planned The City is currently in the process of reviewing all of its professional services agreements. Once this review is complete, Staff will create a schedule for the City Council to review the agreements. Those agreements which contain critical deficiencies will be presented to the Council first, and the Council will subsequently review the balance of the agreements. The City will comply with its procurement ordinance, as well as the adopted policies and procedures when awarding future contracts. Further, the City may utilize interim agreements to allow City staff sufficient time to prioritize the competitive procurement of the City’s agreements. Status of Corrective Action The city partially implemented our recommendation. We noted that the city reimbursed IMC based on incurred expenses but the city did not implement formal policies and procedures. -A2- City of Industry Internal Control System In addition, the city’s Finance Department does not perform a detailed review of invoices before paying CRIA expenses and does not retain supporting documentation. City’s Response Formal policies and procedures will be developed to clearly identify services performed (e.g. promotional activities, business assistance, information distribution, training/ seminars, regular newsletter/ media, maintain local business directory, liaison services to provide business input to local government, represent City and businesses at meetings / events, provide welcoming program to new businesses, etc.) and outline invoice submittal and review process. Presently, IMC invoices are reviewed by City staff, then authorized by the City Manager, prior to payment, with a register submitted monthly to the City Council for approval at a public meeting. Both the review procedure and recordkeeping for audits will be examined. SCO Comment The city failed to submit documentation to show that detailed review of CRIA invoices was conducted before payments were made. As policies and procedures approved by the city council are pending, our conclusion as stated in the Status of Corrective Action remains the same. PRIOR SCO Recommendation FINDING 2— The City should implement appropriate internal control measures to Payments for ensure proper review and approval of all invoices for contracted general services. These measures should include: maintenance and miscellaneous  Re-evaluating current procedures in place to ensure that proper and reasonable reviews are completed before payments are authorized; services totaling to and $12.27 million were questionable  Ensuring that invoices from contractors include proper documentation to substantiate services provided. City staff should perform a detailed review and analysis before processing and approving payments. When reviewing the invoices for contracted services, the nature and type of work provided and materials used should be examined closely to ensure compliance with the terms of the contract. City’s Response Regarding Corrective Action Taken or Planned In late June and July 2015, the City hired a new City Manager and created a Director of Administrative Services position, a position created to oversee and evaluate City processes. As a result of this organizational change, the City is currently reviewing all of its contracts with outside vendors to determine whether the contracts comply with best practices, contain deficiencies that require amendments, and/or should be competitively bid given the length of time of the contract and/or the type of services being provided. Further, the City has begun implementing additional review procedures as it processes invoices for services provided to the City by third party vendors. -A3- City of Industry Internal Control System Status of Corrective Action The city partially implemented our recommendation. City management who were overseeing and evaluating the city processes to implement the recommendation are no longer employed by the city. The city terminated the City Manager’s employment, and the Director of Finance and Director of Administrative Services both resigned. In addition, the city’s Finance Department does not perform a detailed review of invoices before paying CRIA expenses and does not retain supporting documentation. City’s Response Since 2015, the City has worked diligently to implement best practices in the processing of payments to City contractors. On April 12, 2018, the City Council appointed me as Acting City Manager and, on October 25, 2018, the City Council selected me as the permanent City Manager. Further, additional staff have been hired within the last several months, including an experienced and well-trained Assistant City Manager, a competent and capable Finance Director, and a knowledgeable and skilled deputy city clerk. Each has extensive experience with the procurement and invoicing processes, including initiation, review, and authorization of requests for payment. Collectively, this new administration is evaluating all contracts with outside vendors, including general maintenance and miscellaneous services, for public benefit and an accountable method to review work performed and receive authorization for payment. Also, formal policies and procedures will be developed for the City, CRIA, and all other entities to ensure that future contracts consistently include best practices for processing invoices and approving payments, as well as provide for clarity and standardization of recordkeeping. Until more comprehensive policies and procedures are developed, any invoices are currently reviewed by City staff, then authorized by the City Manager, prior to payment, with a warrant register submitted monthly to City, CRIA, and any other appropriate entities, for approval at public meetings. SCO Comment The city did not submit documentation to support its claim that detailed review of invoices was conducted before paying CRIA expenses. SCO auditors were unable to analyze invoices because, despite repeated requests, the city did not provide documentation or make knowledgeable individuals available for inquiry. Accordingly, our conclusion as stated in the Status of Corrective Action remains the same. -A4- City of Industry Internal Control System PRIOR SCO Recommendation FINDING 3— The City Council should fulfill its fiduciary responsibility by engaging The City Council in oversight over the City’s affairs. The City also should develop and did not exercise implement policies and procedures to ensure that its management sufficient oversight performs a detailed review and gains full understanding before entering over the City’s into any type of legally binding agreement. This is especially critical when the City Council approves long-term extensions to existing financial and contracts. All proposed agreements should be presented to the City operational Council with full explanation of the services to be provided and benefits activities to the City prior to approval and before formal execution. In addition, the City should consistently follow its policies and procedures relating to processing payments for goods and services and ensure that all invoices are properly supported by detailed documentation before making payments. City’s Response Regarding Corrective Action Taken or Planned The city did not agree with the finding; therefore, the city did not take corrective action for this finding. Status of Corrective Action The city did not implement our recommendation. The city, as a member of the CRIA and the IPHMA, failed to exercise sufficient oversight of the financial and operational activities of the Expo Center and the city’s rental properties. City’s Response The City Council has provided clear direction to the new administration, that all practices must be evaluated and upgraded to ensure transparency, accountability, and conformity to the City’s vision as a leader in service to the business community. The elected body relies upon Staff for day- to-day operations, with the expectation that Staff fulfills the fiduciary responsibility of providing the City Council with complete, accurate assessments for policy direction and decision making. The City Council’s commitment to increase oversight is demonstrated by the focus on developing policies and procedures to both standardize and make transparent City operations. PRIOR SCO Recommendation FINDING 4— The City should implement appropriate control measures to ensure The City failed to proper review and approval of all charges relating to meals, lodging, exercise adequate and other miscellaneous expenses including City-issued credit card control over charges. This should include: expenses charged  An updated and comprehensive travel policy that establishes clear to City-issued guidance for travel, including the purpose of the trip and credit cards documentation requirements, and set limits on lodging rates, meals, and other travel expenses; and  A policy governing circumstances for which business meals are authorized, including documentation requirements and limits on the maximum amount allowable for business meals. -A5- City of Industry Internal Control System We also recommend that the City review the questionable charges noted above and determine whether the City officials and employees should be required to refund the City for all or part of them. The City should also consider performing a review of travel and meal expenses for the period of our review to determine whether additional refunds should be sought. City’s Response Regarding Corrective Action Taken or Planned … the City is currently evaluating its policies on travel to determine whether any amendments are necessary. Once the policies have been evaluated, and any necessary amendments have been completed, all City staff will be provided with an overview of the City's policies on travel. Status of Corrective Action The city implemented our recommendation. The city established policies and procedures for credit card usage and travel costs, and enforces discipline for misuse. The city currently only has one credit card, which is carefully monitored by an employee, who ensures that purchase order forms are completed prior to purchases and verifies whether credit card expenses are business-related. City’s Response As noted in the Report, the City has implemented the California State Controller’s recommendation and, therefore, this finding has been resolved. PRIOR SCO Recommendation FINDING 5— The City should review the payments made to these employees and Some City determine whether the City did, in fact, make double payments. Any employees were overpayment should be returned to the City. The City should also overpaid develop policies and procedures to identify and prevent salary overpayments, promptly notify members of overpayments when they occur, and collect overpayments in a timely manner. City’s Response Regarding Corrective Action Taken or Planned The city did not agree with the finding; therefore, no corrective action was taken by the city for this finding. Status of Corrective Action This is no longer an issue. The city does not run payroll for the IUDA, where the double payment was incurred. The city plans to begin processing payroll in-house, and is developing policies and procedures for its payroll system. The city did not overpay its employees for FY 2016-17. The City Council approved pay range adjustments for some positions, which fell within the salary pay scale. -A6- City of Industry Internal Control System City’s Response This finding was erroneous as City employees never received double- payment. Instead, the salaries of certain employees were assigned to multiple entities, to appropriately account for services rendered. In every case, the total received from the multiple entities never exceeded the salary of that employee. The confusion likely originated from several staff members receiving the same exact amount from two (2) entities, but that resulted from their salary distribution being 50% from each entity and not double-payment. SCO Comment The city did not provide source documentation, such as timesheets, to support its assertion that it accurately paid its employees. The prior finding and recommendations remain unchanged. PRIOR SCO Recommendation FINDING 6— The City should include a written procedure in its policy informing Lack of timesheet employees that they are responsible for accurately recording the times prepared by they arrive and leave work. This policy also should inform employees employees of the consequences for deliberately falsifying time cards, which may include immediate termination of employment. Even though the City is not required to keep records of the actual hours worked by employees who are exempt from overtime requirements, the City should have a system for recording sick days, floating holidays, vacation time, jury duty, bereavement leave, and other absences. City’s Response Regarding Corrective Action Taken or Planned … in an effort to institute best practices, and compliance with City policies, the City will implement its time sheet requirement, and will create all necessary forms to ensure proper implementation. Status of Corrective Action The city implemented our recommendation by developing and establishing a timesheet system. City’s Response As noted in the Report, the City has implemented the California State Controller’s recommendation and, therefore, this finding has been resolved. PRIOR SCO Recommendation FINDING 7— The City should assess its current processes and implement policies and Lack of segregation procedures to segregate incompatible functions. Separating of duties responsibilities will help to reduce the risk of errors and fraud. Also, having a second person involved in the review and approval process will enhance the compensating control activity. -A7- City of Industry Internal Control System City’s Response Regarding Corrective Action Taken or Planned The City will review our current procedures and processes, and will implement changes or procedures that will mitigate the lack of segregation of duties. With respect to the electric revenue, the City will study options for an outside vendor to complete utility billing, and will also look into random audits of meter reads. Status of Corrective Action Payroll – The city implemented our recommendation. Cash receipts (Electric Revenue) – The city implemented our recommendation. Cash Receipts from Third Party Vendor – The city implemented our recommendation. City’s Response As noted in the Report, the City has implemented the California State Controller’s recommendations and, therefore, this finding has been resolved. PRIOR SCO Recommendation FINDING 8— The City Council should perform a meaningful and detailed annual City manager and performance evaluation of the City Manager to comply with the City other city Manager Evaluation Policy. Likewise, the City Manager and other City employees were not Management should conduct evaluations on all employees on a regular given annual basis. Evaluations should be discussed to provide feedback, recognize quality performance, and establish performance expectations. performance appraisals City’s Response Regarding Corrective Action Taken or Planned To ensure compliance with best practices, the City will begin conducting written performance evaluations of its employees, and will conduct an annual evaluation of the City Manager, consistent with the City’s City Manager Evaluation Policy. Status of Corrective Action We could not verify whether the city fully implemented our recommendation. It appears that the City Council conducted performance evaluations for the former City Manager, but we could not verify whether city management conducted performance evaluations for other city employees. City’s Response The City Manager received his annual review by the City Council on October 11, 2018. Further, the City Manager’s contract states that the City Council shall give him a review on an annual basis on or before October 1st each year. Also, the new City Manager has instituted a policy and procedure that all City employees receive annual reviews, effective from the anniversary of their hire date. Staff have been receiving their annual reviews since institution of this policy and procedure. -A8- City of Industry Internal Control System SCO Comment The city partially implemented our recommendation by performing an annual evaluation of the City Manager. The city should finalize a written policy and procedures for employees’ annual performance appraisals and have it approved by the city council. The prior finding and recommendations remain unchanged. -A9- City of Industry Internal Control System Appendix B— Evaluation of Internal Control System Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions CONTROL ENVIRONMENT 1. Demonstrates Commitment to Integrity and Ethical Values a. Sets the tone at the top X X The city failed to support an effective internal control system by not establishing policies and procedures for critical functions, implementing auditor and consultant’s recommendations to remediate findings, and providing oversight of accounting and financial operations. Refer to Findings 1 and 2. b. Establishes standards of conduct X X The city’s management failed to establish standards of conduct by neglecting to develop policies and procedures for the Expo Center and the city’s rental properties. Refer to Findings 1 and 2. c. Evaluates adherence to standards of conduct X X Refer to 1.b 2. Exercises Oversight Responsibility a. Establishes oversight structure and responsibilities X X The city failed to develop policies and procedures for the Expo Center and the city’s rental properties. Refer to Findings 1 and 2. b. Provides oversight for the system of internal control X X The city does not have an audit committee or anything performing the functions of an audit committee. Refer to Finding 5. c. Provides input for remediation of deficiencies in the internal X X control system -B1- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions 3. Establishes Structure, Authority, and Responsibility a. Considers organizational structures X X b. Defines, assigns, and limits authorities and responsibilities X X c. Develops and maintains documentation of the internal X X Lack of policies and procedures for: use of city equipment and vehicles by contractors, control system remodeling projects, loan repayment processes, the Expo Center, and the city’s rental properties. Refer to Findings 1 through 4. 4. Demonstrates Commitment to Competence a. Establishes expectations of competence for key roles X X b. Attracts, develops, and retains competent personnel X X c. Plans and prepares for succession X X 5. Enforces Accountability a. Enforces accountability of personnel through mechanisms X X It appears that the City Council conducted performance evaluations for the former City such as performance appraisals and disciplinary actions Manager, but we could not verify whether city management conducted performance evaluations for other city employees. b. Considers excessive pressures X X -B2- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions RISK ASSESSMENT 6. Defines Objectives and Risk Tolerances a. Defines objectives in specific and measurable terms X X Lack of an objective for the city’s rental operations. Refer to Finding 2. b. Considers risk tolerances for the defined objectives X X Refer to 6.a 7. Identifies, Analyzes, and Responds to Risks a. Identifies risks throughout the entity to provide a basis for X X The city did not properly perform a risk analysis assessment of the Expo Center and analyzing risks the city’s rental properties. Refer to Findings 1 and 2. b. Analyzes the identified risks to estimate their significance X X Refer to 7.a c. Determines how to respond to risks X X Refer to 7.a 8. Assesses Fraud Risk a. Considers various types of frauds X X The city, as a member of the CRIA, outsourced the operations, accounting, and financial reporting processes to contractors without establishing sufficient safeguards to deter fraud. Refer to Finding 1. b. Assesses fraud risk factors - incentives and pressures, X X Refer to 8.a opportunities, and attitudes and rationalizations c. Analyzes and responds to identified fraud risks X X Refer to 8.a -B3- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions 9. Identifies, Analyzes, and Responds to Change a. Identifies and assesses changes that could significantly X X impact the entity’s internal control system b. Analyzes and responds to identified changes and related X X risks in order to maintain an effective internal control system CONTROL ACTIVITIES 10. Designs Control Activities a. Designs control activities in response to the entity’s X X The city’s rental operations lack an objective or policies and procedures; these objectives and risks weaknesses are interrelated. Refer to Finding 2. b. Designs appropriate types of control activities for the X X Refer to 7.a entity’s internal control system c. Considers at what level activities are applied X X Refer to 7.a d. Addresses segregation of duties X X -B4- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions 11. Designs General Control over Information System a. Designs the entity’s information system to respond to the X X The city’s Finance Department does not receive sufficient information regarding the entity’s objectives and risks purchasing processes for the CRIA, and the city does not have copies of supporting documentation for CRIA expenses. Refer to Finding 1. b. Designs appropriate types of control activities – general and X X Refer to 11.a application control activities, in the entity’s information system c. Designs control activities over the information technology X X Refer to 11.a infrastructure to support the completeness, accuracy, and validity of information processing d. Establishes relevant security management process control X X Refer to 11.a activities e. Establishes relevant technology acquisition, development, X X and maintenance process control activities 12. Implements Control Activities a. Documents in policies and procedures the internal control X X Lack of policies and procedures for: use of city equipment and vehicles by contractors, responsibilities of the organization remodeling projects, loan repayment processes, the Expo Center, and the city’s rental properties. Refer to Findings 1 through 4. b. Reassesses policies and procedures through periodic review X X Refer to 12.a of control activities -B5- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions INFORMATION AND COMMUNICATION 13. Uses Quality Information a. Identifies information requirements X X The city’s Finance Department is not sufficiently involved in the Expo Center’s expense processing and does not retain supporting documentation for Expo Center expenses. Refer to Finding 1. b. Obtains relevant data from reliable internal and external X X Refer to 13.a sources in a timely manner c. Processes the obtained data into quality information within X X Refer to 13.a the entity’s information system 14. Communicates Internally a. Communicates internal control information throughout the X X Refer to 13.a entity using established reporting lines b. Selects appropriate methods of communication and X X Refer to 13.a considers factors such as audience, nature of information, availability, cost, and legal or regulatory requirements 15. Communicates Externally a. Communicates to external parties, and obtains quality X X The city did not retain supporting documentation for Expo Center expenses. Refer to information from external parties using established Finding 1. reporting lines b. Selects appropriate methods of communication and X X Refer to 15.a considers factors such as audience, nature of information, availability, cost, and legal or regulatory requirements -B6- City of Industry Internal Control System Appendix B (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanations/Conclusions MONITORING 16. Conducts Ongoing Monitoring Activities a. Establishes a baseline to monitor the internal control system X X The city, as a member of IPHMA, did not establish a baseline to monitor the IPHMA’s internal control system. Refer to Finding 1. b. Considers a mix of ongoing and separate evaluations X X The city’s Finance Department is not involved in the evaluation of the Expo Center’s expenses. Refer to Finding 1. c. Objectively evaluates and documents the results of ongoing X X Refer to 16.b monitoring and separate evaluations to identify internal control issues 17. Evaluates Issues and Communicates and Remediates Deficiencies a. Reports internal control issues through established reporting X X Internal control issues regarding Expo Center activities are not reported in a timely lines to the appropriate internal and external parties in a manner because the city’s Finance Department is not directly involved in expense timely manner processing for the Expo Center. Refer to Finding 1. b. Evaluates and documents internal control issues and X X The city did not develop formal policies and procedures, and did not provide sufficient determines appropriate corrective actions for internal oversight of CRIA and IPHMA operations. Refer to Findings 1 and 2. control deficiencies c. Monitors, completes, and documents corrective actions X X Refer to 17.b ____________________________ The evaluation tool is based on the guidelines established by the GAO’s Green Book. It serves as a guideline to aid local agencies in identifying internal control deficiencies. The SCO uses the same evaluation tool on all of its administrative and internal control system reviews of local government agencies, regardless of size. -B7- City of Industry Internal Control System Attachment— City of Industry’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-LGO-9001