Huntington Beach City

CITY OF HUNTINGTON BEACH Audit Report IDENTITY THEFT PROGRAM Chapter 956, Statutes of 2000 July 1, 2006, through June 30, 2013 BETTY T. YEE California State Controller September 2019 BETTY T. YEE California State Controller September 25, 2019 CERTIFIED MAIL—RETURN RECEIPT REQUESTED Chuck Adams, Interim Chief Financial Officer City of Huntington Beach 2000 Main Street Huntington Beach, CA 92648 Dear Mr. Adams: The State Controller’s Office (SCO) audited the costs claimed by the City of Huntington Beach for the legislatively mandated Identity Theft Program for the period of July 1, 2006, through June 30, 2013. The city claimed $684,557 for the mandated program. Our audit found that $351,133 is allowable and $333,424 is unallowable because the city understated the number of identity theft cases, overstated the time increments required to perform the reimbursable activities, misclassified the employees who performed the reimbursable activities, and misstated employee productive hourly rates. The State made no payments to the city. The State will pay $351,133, contingent upon available appropriations. Following issuance of this audit report, the SCO’s Local Government Programs and Services Division will notify the city of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. If you have any questions, please contact Lisa Kurokawa, Chief, Compliance Audits Bureau, by telephone at (916) 327-3138. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/hf Chuck Adams, Interim Chief Financial -2- September 25, 2019 Officer cc: Sunny Rief, Assistant Controller Finance Department City of Huntington Beach Dahle Bulosan, Finance Manager Finance Department City of Huntington Beach The Honorable Erik Peterson, Mayor City of Huntington Beach Robert Handy, Chief of Police City of Huntington Beach Chris Hill, Principal Program Budget Analyst Local Government Unit California Department of Finance Steven Pavlov, Finance Budget Analyst Local Government Unit California Department of Finance Debra Morton, Manager Local Government Programs and Services Division State Controller’s Office City of Huntington Beach Identity Theft Program Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objective, Scope, and Methodology ................................................................................. 2 Conclusion .......................................................................................................................... 4 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Program Costs .............................................................................. 5 Finding and Recommendation .............................................................................................. 8 Attachment—City’s Response to Draft Audit Report City of Huntington Beach Identity Theft Program Audit Report Summary The State Controller’s Office (SCO) audited the costs claimed by the City of Huntington Beach for the legislatively mandated Identity Theft Program for the period of July 1, 2006, through June 30, 2013. The city claimed $684,557 for the mandated program. Our audit found that $351,133 is allowable and $333,424 is unallowable because the city understated the number of identity theft cases, overstated the time increments required to perform the reimbursable activities, misclassified the employees who performed the reimbursable activities, and misstated employee productive hourly rates (PHRs). The State made no payments to the city. The State will pay $351,133, contingent upon available appropriations. Background Penal Code (PC) section 530.6, subdivision (a), as added by Statutes 2000, Chapter 956, requires local law enforcement agencies to take a police report and begin an investigation when a complainant residing within their jurisdiction reports suspected identity theft. On March 27, 2009, the Commission of State Mandates (Commission) found that this legislation mandates a new program or higher level of service for local law enforcement agencies within the meaning of Article XIII B, section 6 of the California Constitution, and imposes costs mandated by the State pursuant to Government Code (GC) section 17514. The Commission determined that each claimant is only allowed to claim and be reimbursed for the following ongoing activities identified in the program’s parameters and guidelines (Section IV. Reimbursable Activities): 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed online by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. -1- City of Huntington Beach Identity Theft Program The Commission also determined that providing a copy of the report to the complainant and referring the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts are not reimbursable activities. The program’s parameters and guidelines establish the state mandate and define the reimbursement criteria. In compliance with GC section 17558, the SCO issues claiming instructions to assist local agencies in claiming mandated program reimbursable costs. Objective, Scope, The objective of our audit was to determine whether costs claimed represent increased costs resulting from the legislatively mandated and Methodology Identity Theft Program. Specifically, we conducted this audit to determine whether costs claimed were supported by appropriate source documents, were not funded by another source, and were not unreasonable and/or excessive. The audit period was July 1, 2006, through June 30, 2013. To achieve our objective, we:  Reviewed the annual mandated cost claims filed by the city for the audit period and identified the material cost components of each claim as salaries, benefits, and indirect costs. Determined whether there were any errors or unusual or unexpected variances from year to year. Reviewed the activities claimed to determine whether they adhered to the SCO’s claiming instructions and the program’s parameters and guidelines;  Completed an internal control questionnaire by interviewing key city staff. Discussed the claim preparation process with city staff to determine what information was obtained, who obtained it, and how it was used;  Obtained system-generated lists of identity theft cases from the city to verify the existence, completeness, and accuracy of unduplicated case counts for each fiscal year in the audit period;  Designed a statistical sampling plan to test approximately 25% of claimed salary costs. Judgmentally selected two of the city’s filed claims during the audit period (fiscal year [FY] 2011-12 and FY 2012-13), which comprised salary costs totaling $107,281 of the $371,755 claimed (28.9%). The specifics of the sampling plan are outlined in the Finding and Recommendation section;  Used a random number table to select 212 identity theft cases out of 730 from the two years sampled. Tested the identity theft cases as follows: o Determined whether an approved police report supported that a violation of PC section 530.5 had occurred; o Calculated the average time required to gather the facts sufficient to determine where the identity theft occurred and what pieces of personal information were used for an unlawful purpose (begin an investigation) using data obtained from the city’s Computer Aided Dispatch Records Management System (RMS) and compared the -2- City of Huntington Beach Identity Theft Program results to the time increments claimed by the city. Compared the results to the average time increments claimed by the city and projected the errors found to the population of identity theft cases; and o Compared job classifications of the employees who performed the mandated activities, as identified in the city’s RMS, to the classifications claimed by the city. Calculated weighted average PHRs for the employee classifications that actually performed the activities.  Interviewed Police Officers and Sergeants to obtain average time increments spent drafting, editing, reviewing, and approving a police report (taking a police report supporting a violation of PC section 530.5), which are not recorded in the city’s RMS, and concluded that the city’s claimed time increments for these reimbursable activities are reasonable;  Projected the audit results of the two years tested by multiplying the actual case counts by the actual average time increments to perform the activities and the weighted PHRs. We applied a weighted two-year average of the sampling results to the remaining five years of the audit period because the populations for all years of the audit period were homogeneous;  Traced the benefit and indirect cost rates claimed for each employee classification that performed the mandated activities to supporting documentation for each fiscal year in the audit period. Determined that the benefit and indirect cost rates claimed were not unreasonable or excessive; and  Reviewed the city’s Single Audit Reports and did not identify any Federal or pass-through programs that might result in offsetting savings or reimbursements applicable to the Identity Theft Program. Obtained verbal confirmation from city representatives at the entrance conference that the city received no offsetting revenues applicable to this mandated program. GC sections 12410, 17558.5, and 17561 provide the legal authority to conduct this audit. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We limited our review of the city’s internal controls to gaining an understanding of the transaction flow and claim preparation process as necessary to develop appropriate auditing procedures. Our audit scope did not assess the efficiency or effectiveness of program operations. We did not audit the city’s financial statements. -3- City of Huntington Beach Identity Theft Program Conclusion As a result of performing the audit procedures, we found instances of noncompliance with the requirements described in our audit objective. We found that the city did not claim costs that were funded by other sources; however, it did claim unsupported costs, as quantified in the Schedule and described in the Finding and Recommendation section of this audit report. For the audit period, the City of Huntington Beach claimed $684,557 for costs of the legislatively mandated Identity Theft Program. Our audit found that $351,133 is allowable and $333,424 is unallowable. The State made no payments to the city. The State will pay $351,133, contingent upon available appropriations. Following issuance of this audit report, the SCO’s Local Government Programs and Services Division will notify the city of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. Follow-up on We have not previously conducted an audit of the city’s legislatively mandated Identity Theft Program. Prior Audit Findings Views of We issued a draft audit report on August 16, 2019. Chuck Adams, Interim Responsible Chief Financial Officer, responded by letter dated August 19, 2019 (Attachment), accepting the audit results. This final audit report includes the Officials city’s response. Restricted Use This audit report is solely for the information and use of the City of Huntington Beach, the California Department of Finance, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits September 25, 2019 -4- City of Huntington Beach Identity Theft Program Schedule— Summary of Program Costs July 1, 2006, through June 30, 2013 Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2006, through June 30, 2007 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 14,062 $ 15,230 $ 1 ,168 Begin an investigation of facts 37,498 13,438 (24,060) Total salaries 51,560 28,668 (22,892) Benefits 36,597 17,476 (19,121) Total direct costs 88,157 46,144 (42,013) Indirect costs 10,209 5,676 (4,533) Total program costs $ 98,366 51,820 $ (46,546) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 51,820 July 1, 2007, through June 30, 2008 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 12,690 $ 13,761 $ 1 ,071 Begin an investigation of facts 33,840 11,970 (21,870) Total salaries 46,530 25,731 (20,799) Benefits 32,595 15,437 (17,158) Total direct costs 79,125 41,168 (37,957) Indirect costs 16,472 9,109 (7,363) Total program costs $ 95,597 50,277 $ (45,320) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 50,277 July 1, 2008, through June 30, 2009 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 16,080 $ 16,414 $ 3 34 Begin an investigation of facts 42,882 14,574 (28,308) Total salaries 58,962 30,988 (27,974) Benefits 29,157 13,631 (15,526) Total direct costs 88,119 44,619 (43,500) Indirect costs 19,281 10,133 (9,148) Total program costs $ 107,400 54,752 $ (52,648) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 54,752 -5- City of Huntington Beach Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2009, through June 30, 2010 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 13,610 $ 13,644 $ 3 4 Begin an investigation of facts 36,293 11,740 (24,553) Total salaries 49,903 25,384 (24,519) Benefits 34,966 14,977 (19,989) Total direct costs 84,869 40,361 (44,508) Indirect costs 14,022 7,133 (6,889) Total program costs $ 98,891 47,494 $ (51,397) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 47,494 July 1, 2010, through June 30, 2011 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 15,687 $ 14,698 $ (989) Begin an investigation of facts 41,832 13,479 (28,353) Total salaries 57,519 28,177 (29,342) Benefits 23,249 10,171 (13,078) Total direct costs 80,768 38,348 (42,420) Indirect costs 16,853 8,256 (8,597) Total program costs $ 97,621 46,604 $ (51,017) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 46,604 July 1, 2011, through June 30, 2012 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 15,772 $ 14,007 $ (1,765) Begin an investigation of facts 42,060 13,316 (28,744) Total salaries 57,832 27,323 (30,509) Benefits 25,648 10,916 (14,732) Total direct costs 83,480 38,239 (45,241) Indirect costs 16,887 7,978 (8,909) Total program costs $ 100,367 46,217 $ (54,150) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 46,217 -6- City of Huntington Beach Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2012, through June 30, 2013 Direct costs: Salaries: Taking police report in violation of PC §530.5 $ 13,486 $ 17,841 $ 4 ,355 Begin an investigation of facts 35,963 14,309 (21,654) Total salaries 49,449 32,150 (17,299) Benefits 27,272 15,582 (11,690) Total direct costs 76,721 47,732 (28,989) Indirect costs 9,594 6,237 (3,357) Total program costs $ 86,315 53,969 $ (32,346) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 53,969 Summary: July 1, 2006, through June 30, 2013 Salaries $ 371,755 $ 198,421 $ (173,334) Benefits 209,484 98,190 (111,294) Indirect costs 103,318 54,522 (48,796) Total program costs $ 684,557 351,133 $ (333,424) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 351,133 _________________________ 1 See the Finding and Recommendation section. 2 Payment amount current as of June 20, 2019. -7- City of Huntington Beach Identity Theft Program Finding and Recommendation FINDING— The city claimed $684,557 ($371,755 in salaries, $209,484 in related benefits, and $103,318 in related indirect costs) for the Identity Theft Overstated Identity Program. We found that $351,133 is allowable and $333,424 is Theft Program costs unallowable. Salary costs are determined by multiplying the number of identity theft police reports by the time required to perform the reimbursable activities, and multiplying the result by the weighted average PHR of the employee classifications that performed the reimbursable activities. The costs are unallowable because the city misinterpreted the program’s parameters and guidelines, which resulted in an understated number of identity theft reports, overstated time increments required to perform the reimbursable activities, misclassification of employees who performed the reimbursable activities, and misstated employee PHRs. Unallowable related benefit costs total $111,294 and unallowable related indirect costs total $48,796. The following table summarizes the audit adjustments by fiscal year: Salaries Related Related Total Fiscal Amount Amount Audit Benefits Indirect Cost Audit Year Claimed Allowable Adjustment Adjustment Adjustment Adjustment 2006-07 $ 5 1,560 $ 2 8,668 $ (22,892) $ (19,121) $ (4,533) $ (46,546) 2007-08 4 6,530 2 5,731 (20,799) (17,158) (7,363) (45,320) 2008-09 5 8,962 3 0,988 (27,974) (15,526) (9,148) (52,648) 2009-10 4 9,903 2 5,384 (24,519) (19,989) (6,889) (51,397) 2010-11 5 7,519 2 8,177 (29,342) (13,078) (8,597) (51,017) 2011-12 5 7,832 2 7,323 (30,509) (14,732) (8,909) (54,150) 2012-13 4 9,449 3 2,150 (17,299) (11,690) (3,357) (32,346) Total $ 3 71,755 $ 1 98,421 $ (173,334) $ (111,294) $ (48,796) $ (333,424) Understated counts of identity theft police reports The city reported costs incurred for performing mandated activities related to 2,478 identity theft cases for violations of PC section 530.5 (identity theft). We found that 2,599 cases are allowable and that the city understated its counts of police reports by 121 during the audit period. During audit fieldwork, the city provided system-generated lists from the Huntington Beach Police Department’s (HBPD) Computer Aided Dispatch Records Management System (RMS) of unduplicated police reports with primary offense under PC section 530.5 filed during the audit period. The list of unduplicated case numbers provided by fiscal year validated the existence and occurrence of 2,797 identity theft cases during the audit period. This detailed case count constitutes 319 police reports (or 13%) more than what the city claimed, a material difference. -8- City of Huntington Beach Identity Theft Program The following table summarizes the counts of identity theft cases claimed, supported by RMS data, allowable, and the difference by fiscal year: Fiscal Per Year Claimed RMS Allowable Difference 2006-07 416 485 451 35 2007-08 366 422 392 26 2008-09 388 431 401 13 2009-10 375 395 367 ( 8) 2010-11 315 334 310 ( 5) 2011-12 317 353 329 12 2012-13 301 377 349 48 Total 2,478 2,797 2,599 121 Once we determined the actual counts of identity theft cases for the audit period, we developed further audit tests to determine whether:  A contemporaneously prepared and approved police report supported each identity theft case; and  Each police report supported that a violation of PC section 530.5 had occurred. In order to test claimed salary costs, we began by judgmentally selecting two of the city’s filed claims during the audit period (FY 2011-12 and FY 2012-13). Claimed salary costs for those years comprised $107,281 (or 28.9%) of the $371,755 salary costs claimed during the audit period. Due to the homogeneousness of the population of identity theft reports for all years of the audit period, we determined that the two years selected would be reasonably representative of any other year of the audit period. We designed a statistical sampling plan to test the attributes identified above so that we could project our sample results to the population of identity theft reports. We selected our statistical samples of identity theft reports based on a 95% confidence level, a sampling error of +/−8%, and an expected (true) error rate of 50%. Our sampling plan required that we test 105 reports out of 353 for FY 2011-12, and 107 reports out of 377 for FY 2012-13. We then selected the identity theft reports for each of the two years by using random number tables. To test whether police reports supported identity theft cases, we reviewed each selected report to verify the existence of actual cost documentation (case reports) that also supported violations of PC section 530.5. Our testing disclosed the following:  For FY 2011-12, we found that 6.67% of the cases are unallowable either because the HBPD did not perform the mandated identity theft activities (three instances) or because the case number was directly related to an earlier identity theft case (i.e. a duplicate case – four instances); and -9- City of Huntington Beach Identity Theft Program  For FY 2012-13, we found that 7.48% of the cases are unallowable either because the HBPD did not perform the mandated identity theft activities (four instances) or because the case number was directly related to an earlier identity theft case (i.e. a duplicate case – four instances). We extrapolated and projected the results of our substantive tests of statistical samples of identity theft cases to determine the number of allowable and unallowable identity theft incident reports for the entire seven-year audit period. As shown in the table on the previous page, we found that 2,599 incident reports are allowable (2,797 less a 7.08% average error rate), which results in 121 understated police reports (2,599 allowable less 2,478 claimed). Overstated time increments The city claimed salary costs during the audit period based on estimated time increments for performing the reimbursable activities of:  Taking a police report (drafting, reviewing, and editing) (Activity 1a); and  Beginning an investigation (determining where the crime occurred and what pieces of personal identifying information were used for an unlawful purpose (Activity 2). We noted that the city’s claims did not include time spent by Sergeants reviewing and approving identity theft police reports (Activity 1b). The city provided a declaration of time increments for FY 2012-13, prepared and approved by an HBPD Captain during FY 2013-14. This declaration of time increments documented the time spent by city staff performing each identity theft reimbursable activity. The declaration indicated the following time increments: Reimbursable Employee Minutes Activity Classification Description Required 1a – Take a police report Police Officers Draft, review, and edit the supporting a violation of Penal identity theft police report Code section 530.5 45 Total – Activity 1a 45 2 – Begin an investigation of Police Officers Determine where the crime the facts occurred and what pieces of personal identifying information were used for an unlawful purpose 120 Total – Activity 2 120 -10- City of Huntington Beach Identity Theft Program During fieldwork, a HBPD Crime Analyst advised us that the city’s RMS system keeps a contemporaneous record of time stamps related to each case. The city provided RMS time reports for the years that we tested, which included the following information:  Case Number (inci_id);  Incident Date (date-rept);  Penal Code section (arr-chrg);  Case Description (offense);  Employee No. (offcr_id);  Time Dispatch (timedisp);  Time Arrive (timearrive);  Time Clear (timeclear); and  Time Increment (TimeDiff). “Timearrive” is the time that the Police Officer arrives at the victim’s residence or business and “timeclear” is the time that the Police Officer leaves the victim’s residence or business. We concluded that “TimeDiff” is the time that the Police Officer determined where the crime occurred and what pieces of personal identifying information were used for an unlawful purpose (Activity 2). The Police Officer could not draft and write a police report supporting a violation of PC section 530.5 without also performing the activity of beginning an investigation. We calculated an average time increment per case for each fiscal year tested. Based on our review and calculations of time from “timearrive” to “timeclear”, we determined the following average time increments:  41 minutes for 98 sampled identity theft cases for FY 2011-12; and  46 minutes for 100 sampled identity theft cases for FY 2012-13. Based on these results, we calculated an average time increment of 44 minutes for reimbursable Activity 2. We applied this average to the other years of the audit period (FY 2006-07 through FY 2010-11). In order to understand what reimbursable activities HBPD’s RMS did not capture in the contemporaneous time increments recorded, we interviewed HBPD Police Officers and Sergeants. We noted that the city claimed 45 minutes for time spent by Police Officers taking a police report, which includes drafting, reviewing, and editing each identity theft police report. We found that time spent by Police Officers writing a police report as well as time spent by Sergeants reviewing and approving police reports are reimbursable activities not captured by the RMS. Based on our interviews, we determined the following average time increments:  For FY 2011-12, Police Officers spent an average of 34 minutes writing and editing a PC section 530.5 report, and Sergeants spent an average of seven minutes reviewing and approving those reports; and  For FY 2012-13, Police Officers spent an average of 46 minutes writing and editing a PC section 530.5 report, and Sergeants spent an average of eight minutes reviewing and approving those reports. -11- City of Huntington Beach Identity Theft Program Based on these results, we calculated an average time increment of 39 minutes for Police Officers to write and edit a PC section 530.5 report (reimbursable activity 1a) and seven minutes for Sergeants to review and approve the reports (reimbursable activity 1b). We applied these average time increments to the other years of the audit period (FY 2006-07 through FY 2010-11). The following table summarizes the time claimed and allowable for reimbursable identity theft activities by fiscal year: Claimed Minutes Allowable Minutes Activity 1a Activity 2 Activity 1a Activity 1b Activity 2 Taking a Beginning Taking a Review and Beginning Fiscal Police an Police Approve a an Year Report Investigation Report Police Report Investigation 2006-07 45 120 39 7 44 2007-08 45 120 39 7 44 2008-09 45 120 39 7 44 2009-10 45 120 39 7 44 2010-11 45 120 39 7 44 2011-12 45 120 34 7 41 2012-13 45 120 46 8 46 Misclassified employee classifications The city claimed salaries and benefits based on PHRs for Police Officers for all fiscal years of the audit period. To validate the city’s assertion of who performed the reimbursable activities, we:  Prepared a schedule of the employee names and numbers associated with the sample selections from the RMS reports;  Requested information from the HBPD supporting the actual job classifications for the employees identified in the RMS reports; and  Verified that employee names and numbers were specifically for the initial call related to the sample selections. Based on these procedures, we found that Police Officers and Cadets performed 87% and 13%, respectively, of the reimbursable activities, as captured by the RMS time records for reimbursable activities 1a and 2. We also noted, from viewing copies of the filed police reports, that Sergeants approved all of the reports (reimbursable activity 1b). Misstated productive hourly rates The city provided a schedule of the actual salary rates for the employee classifications that performed the reimbursable activities. Based on this information, we found that the city claimed the correct salary rates for Police Officers. However, the city’s claims did not take the actual participation percentages into account (Police Officer Cadets performed 13% of reimbursable activities 1a and 2, and Sergeants performed 100% of reimbursable activity 1b). Therefore, we calculated weighted average -12- City of Huntington Beach Identity Theft Program PHRs for the employees who performed the reimbursable activities using the hourly rate information provided by the city. The following table summarizes the PHRs claimed and allowable for the audit period: PHRs Claimed PHRs Allowable Fiscal Police Police Year Officer Officer Cadet Sergeant 2006-07 45.07 4 5.07 10.95 63.08 2007-08 46.23 4 6.23 10.95 68.91 2008-09 55.26 5 5.26 11.44 74.74 2009-10 48.39 4 8.39 11.68 75.64 2010-11 66.40 6 6.40 11.74 76.07 2011-12 66.34 6 6.34 11.66 77.23 2012-13 59.74 5 9.74 11.57 75.89 Using this salary rate information, the corrected number of case counts, the corrected time increments, and the participation percentages of Police Officers, Cadets, and Sergeants during the audit period, we determined allowable salaries for each fiscal year. For example, the following table shows the calculation of allowable salary costs for FY 2011-12: Number of Time Percentage Allowable Reimbursable Cases Increment Minutes Hours PHR Involvement Costs Activity (a) (b) c = (a) * (b) d = c/60 (e) (f) = d × e × f 1a – Officers 329 34 11,186 186.43 $ 66.34 87% $ 1 0,760 1a – Cadets 329 34 11,186 186.43 $ 11.66 13% 2 83 1b – Sergeants 329 7 2,303 38.38 $ 77.23 100% 2 ,964 2 – Officers 329 41 13,489 224.82 $ 66.34 87% 1 2,975 2 – Cadets 329 41 13,489 224.82 $ 11.66 13% 3 41 Total $ 2 7,323 Unallowable related employee benefits Benefits costs are determined by multiplying allowable salary costs by each year’s benefit rate. Employee benefits related to the unallowable salaries are also unallowable. We traced the claimed benefit rates for each job classification that performed the mandated activities to supporting documentation for each fiscal year in the audit period, and verified that the benefit rates claimed were not unreasonable or excessive. We also noted that cadets are part- time employees, and therefore do not have associated benefit costs for the audit period. -13- City of Huntington Beach Identity Theft Program The following table summarizes the unallowable related employee benefit costs by fiscal year: Police Officers Sergeants Total Salaries Allowable Unallowable Allowable Allowable Unallowable Fiscal Audit Benefit Benefit Allowable Benefit Benefit Benefit Year Adjustment Rates Costs Salaries Rates Costs Costs 2006-07 $ (29,505) 70.98% $ (20,943) $ 3 ,319 54.90% $ 1 ,822 $ (19,121) 2007-08 (26,887) 70.05% (18,834) 3,151 53.20% 1,676 (17,158) 2008-09 (35,046) 49.45% (17,330) 3,497 51.60% 1,804 (15,526) 2009-10 (30,635) 70.07% (21,466) 3,239 45.60% 1,477 (19,989) 2010-11 (35,398) 40.42% (14,308) 2,751 44.70% 1,230 (13,078) 2011-12 (36,640) 44.35% (16,250) 2,964 51.20% 1,518 (14,732) 2012-13 (24,551) 55.15% (13,540) 3,531 52.40% 1,850 (11,690) $ (218,662) $( 122,671) $ 22,452 $ 11,377 $ (111,294) Unallowable related indirect costs Indirect costs are determined by multiplying allowable salary costs by each year’s indirect cost rate. Indirect costs related to the unallowable salaries previously identified are also unallowable. The following table summarizes the related indirect cost audit adjustment by fiscal year: Salaries Claimed Indirect Fiscal Audit Indirect Costs Year Adjustment Cost Rates Adjustment 2006-07 $ (22,892) 19.80% $ ( 4,533) 2007-08 (20,799) 35.40% (7,363) 2008-09 (27,974) 32.70% (9,148) 2009-10 (24,519) 28.10% (6,890) 2010-11 (29,342) 29.30% (8,597) 2011-12 (30,509) 29.20% (8,909) 2012-13 (17,299) 19.40% (3,356) Total $ (173,334) $ (48,796) Criteria Section III. (Period of Reimbursement) of the parameters and guidelines states, in part, “Actual costs for one fiscal year shall be included in each claim.” Section IV. (Reimbursable Activities) of the parameters and guidelines states: To be eligible for mandated cost reimbursement for any given fiscal year, only actual costs may be claimed. Actual costs are those costs actually incurred to implement the mandated activities. Actual costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the reimbursable activities. A source document is a document created at or -14- City of Huntington Beach Identity Theft Program near the same time the actual cost was incurred for the event or activity in question. Source documents may include, but are not limited to, employee time records or time logs, sign-in sheet, invoices, and receipts. Section IV. (Reimbursable Activities) of the parameters and guidelines also states: For each eligible claimant, the following ongoing activities are eligible for reimbursement: 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed on-line by the identity theft victim Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. Section V. (Claim Preparation and Submission) of the parameters and guidelines states: 1. Salaries and benefits Report each employee implementing the reimbursable activities by name, job classification, and productive hourly rate (total wages and related benefits divided by productive hours). Describe the specific reimbursable activities performed and the hours devoted to these activities. Recommendation The California State Legislature suspended the Identity Theft Program in the FY 2013-14 through FY 2018-19 Budget Acts. If the program becomes active again, we recommend that the city:  Follow the mandated program’s parameters and guidelines and the SCO’s claiming instructions when preparing its reimbursement claims; and  Ensure that claimed costs include only eligible costs, are based on actual costs, and are properly supported. -15- City of Huntington Beach Identity Theft Program City’s Response The city has reviewed the draft report and accepts the SCO’s findings pertaining to time increments and job classifications that performed the reimbursable activities for the period July 1, 2006 through June 30, 2013. Additionally, the City accepts the SCO’s finding pertaining to the number of cases claimed for the audit period. The City will implement a more detailed process for future claimed case counts, representation of time increments required to perform the reimbursable activities, and identification of employee classifications performing the reimbursable activities going forward. -16- City of Huntington Beach Identity Theft Program Attachment— City’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-MCC-0016