Siskiyou County - Internal Control System

SISKIYOU COUNTY Review Report INTERNAL CONTROL SYSTEM July 1, 2014, through June 30, 2016 BETTY T. YEE California State Controller January 2019 BETTY T. YEE California State Controller January 31, 2019 The Honorable Jennie Ebejer, Auditor-Controller Siskiyou County 311 Fourth Street, Room 101 Yreka, CA 96097 Dear Ms. Ebejer: The State Controller’s Office conducted a review of Siskiyou County’s internal control system to determine the adequacy of the county’s controls for conducting its operations, preparing financial reports, safeguarding assets, and ensuring proper use of public funds. Our review found the county’s internal control system to be mostly adequate, except for six findings described in the Findings and Recommendations section of this review report. We used Standards for Internal Control in the Federal Government (Green Book), established by the Government Accountability Office, to assess various aspects of the county’s internal control system. The Green Book outlines the fundamental components, principles, and attributes of effective internal control systems. Of the 48 control attributes evaluated, we found that one, or 2%, was not present; and 10, or 21%, were present but not functioning. The results of our review and evaluation of the county’s internal control system are included in this report as an Appendix. Our evaluation was based on the conditions that existed during the review period of July 1, 2014, through June 30, 2016. In its response to the draft report, the county stated that it is in the process of developing corrective actions and implementing our recommendations. The county should be commended for taking these matters seriously and being proactive in resolving the noted deficiencies. We would like to express our thanks to the county staff and management, who were helpful throughout the review process. As always, my staff and I are available to address your questions. You may contact Efren Loste, Chief, Local Government Audits Bureau, by telephone at (916) 324-7226, or by email at eloste@sco.ca.gov. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/ls The Honorable Jennie Ebejer, -2- January 31, 2019 Auditor-Controller cc: Terry Barber, County Administrator Siskiyou County Ray A. Haupt, Chair Board of Supervisors Siskiyou County Brandon Criss, Vice-Chair Board of Supervisors Siskiyou County Ed Valenzuela, District 2 Supervisor Board of Supervisors Siskiyou County Michael N. Kobseff, District 3 Supervisor Board of Supervisors Siskiyou County Lisa L. Nixon, District 4 Supervisor Board of Supervisors Siskiyou County Siskiyou County Internal Control System Contents Review Report Introduction ....................................................................................................................... 1 Background ........................................................................................................................ 1 Objective, Scope, and Methodology ................................................................................. 1 Conclusion .......................................................................................................................... 2 Views of Responsible Officials .......................................................................................... 2 Restricted Use .................................................................................................................... 3 Findings and Recommendations ........................................................................................... 4 Appendix—Evaluation of Internal Control System ........................................................... A1 Attachment—Siskiyou County’s Response to Draft Review Report Siskiyou County Internal Control System Review Report Introduction The State Controller’s Office (SCO) reviewed Siskiyou County’s internal control system for the period of July 1, 2014, through June 30, 2016 (fiscal year [FY] 2014-15 and FY 2015-16). We expanded our testing as necessary to include prior-year and current-year transactions to follow up on issues identified through our interviews with county officials, and through our review of other audit reports and work done by independent auditors. We conducted this review pursuant to Government Code section 12410, which requires the Controller to “superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” We used Standards for Internal Control in the Federal Government (Green Book), established by the Government Accountability Office, to assess various aspects of the county’s internal control system. The Green Book outlines the fundamental components, principles, and attributes of effective internal control systems. This assessment is intended to help management evaluate how well the county’s internal control is designed and implemented, and determine where improvements can be made. This report presents the findings and conclusions that we reached in our review of the county’s internal control system. Background Siskiyou County is located in inland northern California, adjacent to the Oregon border. It is the fifth-largest county in the state, with a total area of 6,347 square miles. The population estimate as of 2010 was 44,962, an increase of approximately 11,000 residents since 1970. More than 60% of the land within the County is currently managed by the Federal and State governments. Siskiyou County is governed by a five-member Board of Supervisors (Board) elected from five supervisorial districts. Supervisors are elected for four-year terms, with a Chairman elected by the members each year. The Board’s responsibilities include reviewing and approving department budgets, purchasing capital assets, and providing budgetary authority for county departments. The Board also studies State and Federal regulations that affect Siskiyou County. Objective, Scope, The objective of our review was to evaluate Siskiyou County’s internal control system for FY 2014-15 and FY 2015-16 to ensure: and Methodology  Effectiveness and efficiency of operations;  Reliability of financial reporting;  Compliance with applicable laws and regulations; and  Adequate safeguarding of public resources. -1- Siskiyou County Internal Control System To achieve our objective, we:  Evaluated the county’s formal internal policies and procedures;  Conducted interviews with county employees and observed the county’s business operations for the purpose of evaluating county- wide administrative and internal accounting controls;  Reviewed the county’s documentation and supporting financial records;  Performed tests of transactions on a non-statistical sample basis to ensure adherence with prescribed policies and procedures and to validate and test the effectiveness of controls; and  Evaluated various aspects of the county’s internal control system in accordance with the Green Book. Conclusion Our review found that the county’s internal control system appears to be mostly adequate, except for deficiencies noted in the Findings and Recommendations section. These deficiencies include:  Lack of supporting documentation for sole source contracts (Finding 1);  Improper usage of a restricted asset (Finding 2);  Lack of controls over vehicle usage (Finding 3);  Insurance requirements waived for contractors (Finding 4);  Performance evaluations not performed in a timely manner (Finding 5); and  Lack of an audit committee (Finding 6). Of the 48 control attributes evaluated pertaining to internal control components and principles, we found that one, or 2%, was not present; and 10, or 21%, were present but not functioning. The results of our review and evaluation of the county’s internal control system are included in this report as an Appendix. Views of We issued a draft review report on December 6, 2018. Jennie Ebejer, Auditor-Controller, responded by letter dated December 12, 2018, Responsible agreeing with the review results. The county’s response is included in this Officials final review report as an attachment. -2- Siskiyou County Internal Control System Restricted Use This review report is solely for the information and use of Siskiyou County and the SCO; it is not intended to be and should not be used by anyone other than these parties. This restriction is not intended to limit distribution of this review report, which is a matter of public record. Original signed by JIM L. SPANO, CPA Chief, Division of Audits January 31, 2019 -3- Siskiyou County Internal Control System Findings and Recommendations FINDING 1— The county did not properly document its sole source contracts. Lack of supporting We reviewed 28 contract agreements ranging from FY 2014-15 to documentation for FY 2015-16. Our objective was to ensure that the county properly sole source contracts followed its procurement processes when awarding contracts to vendors. We noted that one contract, awarded to Heal Therapy, Inc., did not undergo a competitive bidding process. We expanded our testing for Heal Therapy, Inc. and reviewed all contracts awarded to this vendor between FY 2014-15 and FY 2017-18. The county awarded nine contracts, totaling $1,581,126, to the vendor without using a competitive bidding process. The following table summarizes the contract dates and amounts: Contract Date Contract Amount June 17, 2014 $ 117,000 July 14, 2015 246,561 September 15, 2015 175,607 September 15, 2015 224,796 June 7, 2016 296,484 June 7, 2016 122,450 July 11, 2017 235,228 July 11, 2017 50,000 July 11, 2017 113,000 Total $ 1,581,126 The Sole Source Purchasing section of the county’s Contracting and Procurement Policies and Procedures states: Sole Source purchasing is a disfavored County process. Sole Source purchasing may be utilized where authorized by State or Federal law. Sole Source purchases over Assistant Purchasing Agent authority must be approved by the Purchasing Agent. Sole Source purchases over Purchasing Agent authority must be approved by the Board of Supervisors. A Sole Source purchase will not be authorized unless it is demonstrated there is no other available source, the purchased item or service is not otherwise available or compatible with the needs of the County and it is demonstrated to the satisfaction of the approving authority every reasonable effort was undertaken to follow the normal purchasing process. Sole Source, which is a noncompetitive negotiated agreement, may be used in special conditions, such as:  Only one firm or individual is qualified to do the work.  An emergency exists of such magnitude that cannot permit delay.  Competition is determined to be inadequate after solicitation of a number of sources. If this method is used it should be fully documented. -4- Siskiyou County Internal Control System The county stated that it did not use the competitive bidding process for Heal Therapy, Inc. because the county determined that the vendor was the sole source for services in the area. The county’s policies require documenting the justification for classifying a contractor as a sole source. The county claimed that Heal Therapy, Inc. is the sole source for the services provided in the area, but was unable to provide documentation to support that assertion. Recommendation We recommend that the county adhere to its own policies and procedures, properly document its sole source contracts, and ensure that public funds are spent responsibly. County’s Response The County has initiated a review of its Contract Procurement Policy and will work to develop a process to ensure compliance with the sole source policy provisions. The county improperly used a restricted asset. FINDING 2— Improper usage of a We reviewed the county’s fixed-assets listing, and noted that the county’s restricted asset Sheriff’s Department occupied a building that was considered a restricted asset under the county’s Road Fund. We found that the county did not have any written lease agreements, nor did the Sheriff’s Department compensate the Road Fund for using the asset. According to the county’s Budget Unit Expenditure Detail record for FY 1963-64, the county purchased the building with Road Fund money. The Road Fund contributed $106,271 and the General Fund contributed $30,000 to purchase the building. We were unable to determine when the Sheriff’s Department began occupying the building. Road Fund money can be expended only for county road or road-related purposes as outlined in the California Streets and Highways Code, sections 2101 and 2150. Therefore, the county should only allow use of the building for road-related activities. Recommendation We recommend that the county establish policies and procedures to ensure that restricted assets are properly accounted for and used only for their intended purposes. However, if the county uses restricted assets for non- intended purposes, it should compensate the assets’ fund. County’s Response The County of Siskiyou will work with counsel to obtain a lease agreement between the Siskiyou County Sheriff’s department and the Public Works department that outlines a reasonable lease agreement for occupying the current office space that both are utilizing. -5- Siskiyou County Internal Control System FINDING 3— The county lacked internal controls, such as formal policies and Lack of controls over procedures, and active oversight over vehicle usage. vehicle usage We assessed the county’s policies and procedures regarding vehicle usage to ensure that these control procedures were complete and sufficient to protect public resources from misuse. We noted that the county’s Public Works Department did not have any written policies and procedures for vehicle usage. The department assigned 12 vehicles to employees, allowing these employees to drive the vehicles home and commute to various job sites in the county. The county claimed that these employees used the vehicles to respond to road maintenance emergencies after normal business hours and to conduct early morning road inspections during winter. However, the county failed to implement any written policies and procedures for the vehicles’ usage. By lacking policies and procedures for the use of authorized vehicles, and not tracking vehicle usage, the county failed to deter employees from using authorized vehicles for non-work-related purposes. Recommendation We recommend that the county establish policies and procedures for the use of authorized vehicles, and tracking methods for Public Works Department vehicle usage, to ensure that authorized vehicles are used only for work-related purposes. County’s Response The County agrees with the recommendation. An Overnight Vehicle Retention Policy has been developed and has been presented to the Board of Supervisors for approval. Final approval is expected in January 2019. FINDING 4— The county did not follow its Contracting and Procurement Policies and Insurance Procedures when it waived the insurance requirements for several requirements contractors. waived for We reviewed contract agreements between FY 2014-15 and FY 2016-17, contractors and found that the county waived the insurance requirements for several contractors. Specifically, the county did not require three contractors to have general liability and automobile insurance policies. The county could not provide any documentation to justify its decisions. The Contract Review and Approval Process – County Risk Management section of the county’s Contracting and Procurement Policies and Procedures states: Approval of a contract by Risk Management means the necessary certificates are attached to the contract and all insurance requirements have been met. Risk Management approval should be completed in 3 days or less if appropriate certificates are attached. By waiving these insurance requirements, the county made itself vulnerable to possible liabilities and losses. -6- Siskiyou County Internal Control System Recommendation We recommend that the county adhere to its Contracting and Procurement Policies and Procedures, and consistently require its contractors to have the proper insurance policies. County’s Response The Risk Manager occasionally waives insurance for low risk and low cost contracts, where the County Administrator and Risk Manager deem appropriate based on risk, scope of work or applicability of requirements. For example, the Risk Manager may waive the requirement for automobile insurance when the service provided does not include use of an automobile. While the current policy authorizes County Counsel to approve changes to the contract template, Counsel defers requests to amend insurance requirements to the County’s Risk Manager. The Risk Manager is working with County Counsel to amend the policy to reflect the current practice and provide authority for the CAO and Risk Manager to waive General Liability, Automobile and Workers Comp insurance when necessary and appropriate. The Risk [Manager] consults, as necessary, with the Alliant Insurance representative about these type of contracts. FINDING 5— The county did not conduct performance evaluations consistently. Performance We reviewed the county’s employee roster and requested to review evaluations not performance evaluations for 27 of 614 employees to ensure that the county performed in a followed its Personnel Policies. We noted that 10 of 27 selected employees timely manner had either past-due or missing records for performance evaluations as of October 18, 2017. It is crucial for organizations to commit to attracting, developing, and retaining competent individuals in alignment with the organizations’ objectives. Performance evaluations are a key tool by which organizations evaluate and develop their employees. The Performance Evaluations section of the county’s Personnel Policies states, in part: All personnel shall be evaluated at least once a year. Department heads may choose to evaluate employees more often and employees also may request evaluations more often. Employee Anniversary Date List. It shall be the responsibility of each department head to maintain a list of employee anniversary dates and to evaluate his or her employees within the time frame given. By not evaluating employees in a timely manner, the county failed to demonstrate its commitment to competence. Recommendation We recommend that the county complete all past-due employee performance evaluations, and establish policies and procedures to ensure that evaluations are properly documented and completed in a timely manner. -7- Siskiyou County Internal Control System County’s Response Personnel tracks performance evaluations and [sends] monthly overdue notifications to Departments. The County has created and implemented a new evaluation form for managers to use; this should reduce the number of evaluations that are outstanding. The County will continue to work with departments to ensure evaluations are done annually. FINDING 6— The county does not have an audit committee to advise and provide recommendations to the Board. Lack of an audit committee The county formed a Finance Review Committee on November 28, 2008, for the purpose of analyzing and exploring options regarding reorganization of certain financial management responsibilities. However, the committee met only as needed and did not meet with the Auditor- Controller, County Administrator, or other department heads to discuss audit findings, internal controls, and management performance. The Government Finance Officers Association (GFOA) recommends that every state and local government should establish an audit committee as a best practice. As stated on the GFOA website: An audit committee is a practical means for a governing body to provide much needed independent review and oversight of the government’s financial reporting processes, its internal controls, and its independent auditors. An audit committee also provides a forum separate from management in which auditors and other interested parties can candidly discuss concerns. By effectively carrying out its functions and responsibilities, an audit committee helps to ensure that management properly develops and adheres to a sound system of internal controls, that procedures are in place to objectively assess management’s practices, and that the independent auditors, through their own review, objectively assess the government’s financial reporting practices. The county’s Finance Review Committee did not perform the above- mentioned functions, and is therefore not considered an audit committee. Recommendation We recommend that the county establish an audit committee to ensure that proper internal controls are in place to help the county operate efficiently and effectively. The purpose of an audit committee is to advise and provide recommendations regarding financial reporting, internal control functions, risk management systems, and audit findings. To maintain its independence, the audit committee should not include county management. County’s Response The County will consider establishing an audit committee as recommended. -8- Siskiyou County Internal Control System Appendix— Evaluation of Internal Control System1 Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion CONTROL ENVIRONMENT 1. Demonstrates Commitment to Integrity and Ethical Values a. Sets the tone at the top X X b. Establishes standards of conduct X X c. Evaluates adherence to standards of conduct X X 2. Exercises Oversight Responsibility a. Establishes oversight structure and responsibilities X X The county has the Board as a governing body. However, the county did not establish an audit committee as an oversight body to oversee the county’s operations and provide constructive feedback to the Board and department managers. See Finding 6. b. Provides oversight for the system of internal control X X c. Provides input for remediation of deficiencies in the internal control X X system 3. Establishes Structure, Authority, and Responsibility a. Considers organizational structures X X b. Defines, assigns, and limits authorities and responsibilities X X c. Develops and maintains documentation of the internal control system X X -A1- Siskiyou County Internal Control System Appendix (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion 4. Demonstrates Commitment to Competence a. Establishes expectations of competence for key roles X X The county’s performance evaluations were not completed in a timely manner to ensure that management and staff were able to carry out assigned responsibilities. See Finding 5. b. Attracts, develops, and retains competent personnel X X See 4.a c. Plans and prepares for succession X X 5. Enforces Accountability a. Enforces accountability of personnel through mechanisms such as X X The county’s performance evaluations were not completed in a timely performance appraisals and disciplinary actions manner. See Finding 5. b. Considers excessive pressures X X RISK ASSESSMENT 6. Defines Objectives and Risk Tolerances a. Defines objectives in specific and measurable terms X X b. Considers risk tolerances for the defined objectives X X The county accepted unnecessary risks by working with contractors without requiring them to carry normal general insurance policies. See Finding 4. 7. Identifies, Analyzes, and Responds to Risks a. Identifies risks throughout the entity to provide a basis for analyzing X X risks b. Analyzes the identified risks to estimate their significance X X c. Determines how to respond to risks X X -A2- Siskiyou County Internal Control System Appendix (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion 8. Assesses Fraud Risk a. Considers various types of frauds X X b. Assesses fraud risk factors - incentives and pressures, opportunities, X X and attitudes and rationalizations c. Analyzes and responds to identified fraud risks X X 9. Identifies, Analyzes, and Responds to Change a. Identifies and assesses changes that could significantly impact the X X entity’s internal control system b. Analyzes and responds to identified changes and related risks in X X order to maintain an effective internal control system CONTROL ACTIVITIES 10. Designs Control Activities a. Designs control activities in response to the entity’s objectives and X X risks b. Designs appropriate types of control activities for the entity’s internal X X The county did not properly manage one of its restricted assets. See control system Finding 2. c. Considers at what level activities are applied X X The county lacked written policies and procedures for the Public Works Department’s vehicle usage. See Finding 3. d. Addresses segregation of duties X X -A3- Siskiyou County Internal Control System Appendix (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion 11. Designs General Control over Information System a. Designs the entity’s information system to respond to the entity’s X X objectives and risks b. Designs appropriate types of control activities – general and X X application control activities, in the entity’s information system c. Designs control activities over the information technology X X infrastructure to support the completeness, accuracy, and validity of information processing d. Establishes relevant security management process control activities X X e. Establishes relevant technology acquisition, development, and X X maintenance process control activities 12. Implements Control Activities a. Documents in policies and procedures the internal control X X We found that the county did not follow its Contracting and responsibilities of the organization Procurement Policies and Procedures to retain supporting documentation of sole source contracts. See Finding 1. b. Reassesses policies and procedures through periodic review of X X See 12.a control activities INFORMATION AND COMMUNICATION 13. Uses Quality Information a. Identifies information requirements X X b. Obtains relevant data from reliable internal and external sources in a X X timely manner c. Processes the obtained data into quality information within the X X entity’s information system -A4- Siskiyou County Internal Control System Appendix (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion 14. Communicates Internally a. Communicates internal control information throughout the entity X X using established reporting lines b. Selects appropriate methods of communication and considers factors X X such as audience, nature of information, availability, cost, and legal or regulatory requirements 15. Communicates Externally a. Communicates to external parties, and obtains quality information X X from external parties using established reporting lines b. Selects appropriate methods of communication and considers factors X X such as audience, nature of information, availability, cost, and legal or regulatory requirements MONITORING ACTIVITIES 16. Conducts Ongoing Monitoring Activities a. Establishes a baseline to monitor the internal control system X X b. Considers a mix of ongoing and separate evaluations X X The county did not evaluate employees’ performance in a timely manner. See Finding 5. c. Objectively evaluates and documents the results of ongoing X X See 16.b monitoring and separate evaluations to identify internal control issues -A5- Siskiyou County Internal Control System Appendix (continued) Present? Functioning? Internal Control Attributes Y / N Y / N Explanation/Conclusion 17. Evaluates Issues and Communicates and Remediates Deficiencies a. Reports internal control issues through established reporting lines to X X the appropriate internal and external parties in a timely manner b. Evaluates and documents internal control issues and determines X X appropriate corrective actions for internal control deficiencies c. Monitors, completes, and documents corrective actions X X _____________________ 1 This evaluation tool is based on guidelines established by the GAO’s Standards for Internal Control in the Federal Government. The evaluation tool helps local agencies to identify internal control weaknesses. The SCO uses this evaluation tool on all of its internal control system reviews of local government agencies, regardless of size. -A6- Siskiyou County Attachment— Siskiyou County’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-LGO-9000