City of Fullerton

CITY OF FULLERTON Audit Report IDENTITY THEFT PROGRAM Chapter 956, Statutes of 2000 July 1, 2002, through June 30, 2013 BETTY T. YEE California State Controller March 2021 BETTY T. YEE California State Controller March 17, 2021 CERTIFIED MAIL—RETURN RECEIPT REQUESTED Ellis Chang, Director of Administrative Services City of Fullerton 303 West Commonwealth Avenue Fullerton, CA 92832 Dear Ms. Chang: The State Controller’s Office audited the costs claimed by the City of Fullerton for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. The city claimed $1,175,737 for costs of the mandated program. Our audit found that $294,650 is allowable and $881,087 is unallowable, primarily because the city overstated the number of identity theft reports and the time increments required to perform the reimbursable activities. The State made no payments to the city. The State will pay $294,650, contingent upon available appropriations. Following issuance of this audit report, the Local Government Programs and Services Division of the State Controller’s Office will notify the city of the adjustment to its claims via a system- generated letter for each fiscal year in the audit period. If you have any questions, please contact Lisa Kurokawa, Chief, Compliance Audits Bureau, by telephone at (916) 327-3138. Sincerely, Original signed by MICHAEL REEVES, CPA Acting Chief, Division of Audits MR/ac Ellis Chang, Director of Administrative -2- March 17, 2021 Services cc: The Honorable Bruce Whitaker, Mayor City of Fullerton Robert Dunn, Chief of Police Fullerton Police Department Ramona Castañeda, Revenue Manager City of Fullerton Chris Hill, Principal Program Budget Analyst Local Government Unit California Department of Finance Steven Pavlov, Finance Budget Analyst Local Government Unit California Department of Finance Debra Morton, Manager Local Reimbursement Section State Controller’s Office City of Fullerton Identity Theft Program Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 2 Objective, Scope, and Methodology ................................................................................. 2 Conclusion .......................................................................................................................... 4 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Program Costs .............................................................................. 5 Finding and Recommendation .............................................................................................. 9 Attachment—City’s Response to Draft Audit Report City of Fullerton Identity Theft Program Audit Report Summary The State Controller’s Office (SCO) audited the costs claimed by the City of Fullerton for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. The city claimed $1,175,737 for costs of the mandated program. Our audit found that $294,650 is allowable and $881,087 is unallowable, primarily because the city overstated the number of identity theft reports and the time increments required to perform the reimbursable activities. The State made no payments to the city. The State will pay $294,650, contingent upon available appropriations. Background Penal Code (PC) section 530.6, subdivision (a), as added by the Statutes of 2000, Chapter 956, requires local law enforcement agencies to take a police report and begin an investigation when a complainant residing within their jurisdiction reports suspected identity theft. On March 27, 2009, the Commission of State Mandates (Commission) found that this legislation mandates a new program or higher level of service for local law enforcement agencies within the meaning of Article XIII B, section 6 of the California Constitution, and imposes costs mandated by the State pursuant to Government Code (GC) section 17514. The Commission determined that each claimant is allowed to claim and be reimbursed for the following ongoing activities identified in parameters and guidelines (Section IV., Reimbursable Activities): 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed online by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. The Commission also determined that providing a copy of the report to the complainant and referring the matter to the law enforcement agency in the jurisdiction where the suspected crime was committed for further investigation of the facts are not reimbursable activities. -1- City of Fullerton Identity Theft Program The program’s parameters and guidelines establish the state mandate and define the reimbursement criteria. In compliance with GC section 17558, the SCO issues claiming instructions to assist local agencies in claiming mandated program reimbursable costs. Audit Authority We conducted this performance audit in accordance with GC sections 17558.5 and 17561, which authorize the SCO to audit the city’s records to verify the actual amount of the mandated costs. In addition, GC section 12410 provides the SCO with general audit authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law. Objective, Scope, The objective of our audit was to determine whether costs claimed represent increased costs resulting from the legislatively mandated and Methodology Identity Theft Program. Specifically, we conducted this audit to determine whether costs claimed were supported by appropriate source documents, were not funded by another source, and were not unreasonable and/or excessive.1 The audit period was July 1, 2002, through June 30, 2013. To achieve our objective, we:  Analyzed the annual mandated cost claims filed by the city for the audit period and identified the significant cost components of each claim as salaries, benefits, and indirect costs. Determined whether there were any errors or unusual or unexpected variances from year to year. Reviewed the activities claimed to determine whether they adhered to the SCO’s claiming instructions and the program’s parameters and guidelines;  Completed an internal control questionnaire by interviewing key city staff members. Discussed the claim preparation process with city staff members to determine what information was obtained, who obtained it, and how it was used;  Obtained system-generated lists of identity theft cases from the city’s Records Management System to verify the existence, completeness, and accuracy of unduplicated case counts for each fiscal year in the audit period;  Designed a statistical sampling plan to test 15-25% of claimed salary costs, based on a moderate level of detection (audit) risk. Judgmentally selected three of the city’s filed claims during the audit period (fiscal year [FY] 2006-07, FY 2009-10, and FY 2010-11), which comprised salary costs totaling $191,388 of the $1,175,737 claimed (16%). The sampling plan is described in the Finding and Recommendation section; 1 Unreasonable and/or excessive costs include ineligible costs that are not identified in the programs parameters and guidelines as a reimbursable cost. -2- City of Fullerton Identity Theft Program  Used a random number table to select 256 identity theft cases out of 2,264 officer-reported cases. Tested the identity theft cases as follows: o Determined whether a contemporaneously prepared and approved police report supported that a violation of PC section 530.5 had occurred; o Obtained the employee numbers, names, and classifications from the sampled officer-reported cases documenting who performed the reimbursable activities; o Compared the employee classifications obtained from the police reports to those claimed by the city; o Interviewed sworn officers at the Fullerton Police Department, which revealed the average number of minutes spent drafting, reviewing, editing, and approving a police report supporting a violation of PC section 530.5. We determined allowable time increments for these reimbursable activities based on the results of these interviews;  Projected the audit results of the three years tested by multiplying the actual case counts by the actual average time increments to perform the activities, and multiplying the product by the weighted average PHRs of the employees who performed them. We applied the weighted three-year average of the sampling results to the remaining eight years of the audit period due to the homogeneity of the population;  Traced the city’s claimed benefit and indirect cost rates to supporting documentation for each fiscal year in the audit period and verified that the rates claimed were not unreasonable or excessive; and  Reviewed the city’s Single Audit Reports to identify any offsetting savings or reimbursements from federal or pass-through programs applicable to the Identity Theft Program. The city also certified in its claims that it did not receive any offsetting revenues applicable to this mandated program. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We limited our review of the city’s internal controls to gaining an understanding of the transaction flow and claim preparation process as necessary to develop appropriate auditing procedures. Our audit scope did not assess the efficiency or effectiveness of program operations. We did not audit the city’s financial statements. -3- City of Fullerton Identity Theft Program Conclusion As a result of performing the audit procedures, we found instances of noncompliance with the requirements described in our audit objective. We found that the city did not claim costs funded by another source; however, the unallowable costs are ineligible and unsupported, as quantified in the Schedule and described in the Finding and Recommendation section of this audit report. For the audit period, the City of Fullerton claimed $1,175,737 for costs of the legislatively mandated Identity Theft Program. Our audit found that $294,650 is allowable and $881,087 is unallowable. The State made no payments to the city. The State will pay $294,650, contingent upon available appropriations. Following issuance of this report, the SCO’s Local Government Programs and Services Division will notify the city of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. Follow-up on We have not previously conducted an audit of the city’s legislatively mandated Identity Theft Program. Prior Audit Findings Views of We issued a draft report on February 17, 2021. Ellis Chang, Director of Responsible Administrative Services, responded by letter dated February 26, 2021 (Attachment), agreeing with the audit results. This final audit report Officials includes the city’s response. Restricted Use This audit report is solely for the information and use of the City of Fullerton, the California Department of Finance, and SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by MICHAEL REEVES, CPA Acting Chief, Division of Audits March 17, 2021 -4- City of Fullerton Identity Theft Program Schedule— Summary of Program Costs July 1, 2002, through June 30, 2013 Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2002, through June 30, 2003 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 5,713 $ 5,238 $ (475) Begin an investigation of facts 45,664 6,862 (38,802) Total salaries 51,377 12,100 (39,277) Benefits 15,670 3,691 (11,979) Total direct costs 67,047 15,791 (51,256) Indirect costs 10,660 2,511 (8,149) Total program costs $ 77,707 18,302 $ (59,405) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 18,302 July 1, 2003, through June 30, 2004 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 5,105 $ 4,690 $ (415) Begin an investigation of facts 42,272 6,494 (35,778) Total salaries 47,377 11,184 (36,193) Benefits 17,766 4,194 (13,572) Total direct costs 65,143 15,378 (49,765) Indirect costs 10,748 2,537 (8,211) Total program costs $ 75,891 17,915 $ (57,976) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 17,915 July 1, 2004, through June 30, 2005 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 4,803 $ 4,409 $ (394) Begin an investigation of facts 37,459 5,837 (31,622) Total salaries 42,262 10,246 (32,016) Benefits 20,540 4,980 (15,560) Total direct costs 62,802 15,226 (47,576) Indirect costs 9,420 2,284 (7,136) Total program costs $ 72,222 17,510 $ (54,712) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 17,510 -5- City of Fullerton Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2005, through June 30, 2006 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 5,503 $ 5,041 $ (462) Begin an investigation of facts 45,838 6,896 (38,942) Total salaries 51,341 11,937 (39,404) Benefits 28,340 6,589 (21,751) Total direct costs 79,681 18,526 (61,155) Indirect costs 13,144 3,056 (10,088) Total program costs $ 92,825 21,582 $ (71,243) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 21,582 July 1, 2006, through June 30, 2007 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 7,217 $ 6,949 $ (268) Begin an investigation of facts 61,270 9,688 (51,582) Total salaries 68,487 16,637 (51,850) Benefits 39,586 9 , 6 1 6- (29,970) Total direct costs 108,073 26,253 (81,820) Indirect costs 17,807 4,326 (13,481) Total program costs $ 125,880 30,579 $ (95,301) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 30,579 July 1, 2007, through June 30, 2008 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 8,834 $ 8,083 $ (751) Begin an investigation of facts 75,654 11,369 (64,285) Total salaries 84,488 19,452 (65,036) Benefits 48,327 11,127 (37,200) Total direct costs 132,815 30,579 (102,236) Indirect costs 25,347 5,836 (19,511) Total program costs $ 158,162 36,415 $ (121,747) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 36,415 -6- City of Fullerton Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2008, through June 30, 2009 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 10,900 $ 10,010 $ (890) Begin an investigation of facts 92,168 13,901 (78,267) Total salaries 103,068 23,911 (79,157) Benefits 60,088 13,940 (46,148) Total direct costs 163,156 37,851 (125,305) Indirect costs 29,993 6,958 (23,035) Total program costs $ 193,149 44,809 $ (148,340) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 44,809 July 1, 2009, through June 30, 2010 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 7,118 $ 6,556 $ (562) Begin an investigation of facts 60,185 9,104 (51,081) Total salaries 67,303 15,660 (51,643) Benefits 39,238 9,130 (30,108) Total direct costs 106,541 24,790 (81,751) Indirect costs 19,585 4,557 (15,028) Total program costs $ 126,126 29,347 $ (96,779) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 29,347 July 1, 2010, through June 30, 2011 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 5,880 $ 5,103 $ (777) Begin an investigation of facts 49,718 7,087 (42,631) Total salaries 55,598 12,190 (43,408) Benefits 31,524 6,912 (24,612) Total direct costs 87,122 19,102 (68,020) Indirect costs 17,180 3,767 (13,413) Total program costs $ 104,302 22,869 $ (81,433) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 22,869 -7- City of Fullerton Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustments1 July 1, 2011, through June 30, 2012 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 5,246 $ 6,397 $ 1,151 Begin an investigation of facts 34,854 8,724 (26,130) Total salaries 40,100 15,121 (24,979) Benefits 25,543 9,632 (15,911) Total direct costs 65,643 24,753 (40,890) Indirect costs 13,153 4,960 (8,193) Total program costs $ 78,796 29,713 $ (49,083) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 29,713 July 1, 2012, through June 30, 2013 Direct costs: Salaries Taking police report in violation of Penal Code § 530.5 $ 7,533 $ 6,051 $ (1,482) Begin an investigation of facts 28,918 7,156 (21,762) Total salaries 36,451 13,207 (23,244) Benefits 21,615 7,832 (13,783) Total direct costs 58,066 21,039 (37,027) Indirect costs 12,611 4,570 (8,041) Total program costs $ 70,677 25,609 $ (45,068) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 25,609 Summary: July 1, 2002, through June 30, 2013 Salaries $ 647,852 $ 161,645 $ (486,207) Benefits 348,237 87,643 (260,594) Indirect costs 179,648 45,362 (134,286) Total program costs $ 1,175,737 294,650 $ (881,087) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 294,650 _________________________ 1 See the Finding and Recommendation section. 2 Payment amounts current as of March 8, 2021. -8- City of Fullerton Identity Theft Program Finding and Recommendation FINDING — The city claimed $1,175,737 ($647,852 in salaries, $348,237 in related benefits, and $179,648 in related indirect costs) for the Identity Theft Overstated Identity Program. We found that $294,650 is allowable and $881,087 is Theft Program costs unallowable. Salary costs are determined by multiplying the number of identity theft police reports by the time required to perform the reimbursable activities by the weighted average productive hourly rates (PHRs) of the city’s employee classifications that performed the reimbursable activities. The costs are unallowable because the city misinterpreted the program’s parameters and guidelines, which resulted in an overstated number of identity theft reports and overstated time increments required to perform the reimbursable activities. We accepted the job classifications as claimed and the percentage of each classification’s involvement in the reimbursable activities. The following table summarizes the claimed and allowable amounts, and the audit adjustments by fiscal year: Salaries Related Related Total Fiscal Amount Amount Audit Benefit Indirect Cost Audit Year Claimed Allowable Adjustment Adjustment Adjustment Adjustment 2002-03 $ 51,377 $ 12,100 $ ( 39,277) $ (11,979) $ (8,149) $ ( 59,405) 2003-04 47,377 11,184 ( 36,193) (13,572) (8,211) ( 57,976) 2004-05 42,262 10,246 ( 32,016) (15,560) (7,136) ( 54,712) 2005-06 51,341 11,937 ( 39,404) (21,751) (10,088) ( 71,243) 2006-07 68,487 16,637 ( 51,850) (29,970) (13,481) ( 95,301) 2007-08 84,488 19,452 ( 65,036) (37,200) (19,511) ( 121,747) 2008-09 103,068 23,911 ( 79,157) (46,148) (23,035) ( 148,340) 2009-10 67,303 15,660 ( 51,643) (30,108) (15,028) ( 96,779) 2010-11 55,598 12,190 ( 43,408) (24,612) (13,413) ( 81,433) 2011-12 40,100 15,121 ( 24,979) (15,911) (8,193) ( 49,083) 2012-13 36,451 13,207 ( 23,244) (13,783) (8,041) ( 45,068) Total $ 647,852 $ 161,645 $ ( 486,207) $ (260,594) $ (134,286) $ ( 881,087) Overstated counts of identity theft police reports The city claimed costs incurred for taking police reports related to 2,264 identity theft cases during the audit period. The city provided us with system-generated unduplicated lists of identity theft case numbers of police reports filed for violations of PC section 530.5. We determined the accuracy of the unduplicated counts of initial police reports by determining whether:  Each identity theft case was supported by a contemporaneously prepared and approved police report; and  The police report supported a violation of PC section 530.5. -9- City of Fullerton Identity Theft Program We developed a statistical sampling plan and generated statistical samples of identity theft cases for these two procedures so that we could project our sample results to the population of identity theft cases. We selected our statistical samples of identity theft cases originating from the city based on a 95% confidence level, a sampling error of +/-8%, and an expected (true) error rate of 50%. We judgmentally selected FY 2006-07, FY 2009-10, and FY 2010-11 for testing. Our testing disclosed the following:  For FY 2006-07, we selected 89 cases from the population of 217 reported cases for testing. We found that 14 cases were unallowable (12 reports taken by another police department, and two reports involving a secondary offense) (15.7% error rate).  For FY 2009-10, we selected 87 cases from the population of 207 reported cases for testing. We found that 17 cases were unallowable (15 reports taken by another police department and two reports involving a secondary offense) (19.5% error rate).  For FY 2010-11, we selected 80 cases from the population of 171 reported cases for testing. We found that 19 cases were unallowable (17 reports taken by another police department and two reports involving a secondary offense) (23.8% error rate) . We extrapolated and projected the results of our substantive tests of statistical samples to determine the number of allowable and unallowable identity theft incident reports for the entire 11-year audit period. As shown in the table below, as a result of our extrapolated testing results over the audit period, we found that 1,818 incident reports are allowable and 446 are unallowable. We calculated a 19.7% average error rate for the three years that we tested (FY 2006-07, FY 2009-10, and FY 2010-11). We applied this average error rate to the other eight years of the audit period (FY 2002-03 through FY 2005-06, FY 2007-08 through FY 2008-09, and FY 2011-12 through FY 2012-13). The following table summarizes the counts of claimed, supported, and allowable identity theft cases, and the difference by fiscal year: Fiscal Year Claimed Allowable Difference 2002-03 193 155 (38) 2003-04 169 136 (33) 2004-05 153 123 (30) 2005-06 172 138 (34) 2006-07 217 183 (34) 2007-08 267 214 (53) 2008-09 317 255 (62) 2009-10 207 167 (40) 2010-11 171 130 (41) 2011-12 201 161 (40) 2012-13 197 156 (41) Total 2,264 1,818 (446) -10- City of Fullerton Identity Theft Program Overstated time increments Claimed Time Increments The city claimed time increments spent by Fullerton Police Department sworn officers who performed the following reimbursable activities:  Drafting, editing, reviewing, and approving the identity theft police report (Taking a police report supporting a violation of PC section 530.5 - Activity 1a); and  Determining where the crime occurred and what pieces of personal identifying information were used for unlawful purposes (Investigation of the facts of the ID Theft cases - Activity 2). The city claimed that Police Officers and Community Service Officers equally performed the reimbursable activity of taking a police report in violation of PC section 530.5 for all years of the audit period. The city claimed that Sergeants performed the reimbursable activity of beginning an investigation of the facts for all years of the audit period except FY 2012-13, during which the city claimed that Detectives performed this activity. We accepted the employee classifications as claimed. However, the city did not provide any support for the time increments claimed. The parameters and guidelines for the mandated program require that “costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the mandated activities.” As the city did not provide support that complies with this requirement, we determined that the time increments claimed are estimated and unsupported. Allowable Time Increments In order to determine a reasonable average amount of time spent by Police Department staff on the reimbursable activities, we conducted interviews with four officers who routinely perform the duties of report-taking. We requested that each officer to determine the average amount of time they spent in writing and editing initial PC section 530.5 police reports. The following result is based on our interviews:  Activity 1a - Taking a police report in violation of PC section 530.5 (average time): 68.5 minutes. We also interviewed officers four who routinely performed the duties of reviewing and approving police reports and conducting initial investigations for identity theft violations. The following result is based on our interviews:  Activity 2 - Investigation of facts (average time): 56.25 minutes. -11- City of Fullerton Identity Theft Program The following table summarizes the time claimed and allowable for the reimbursable activities by fiscal year: Claimed Minutes Allowable Minutes 1a 2 1a 2 Taking a Beginning T a k i n g a Beginning Police an Police an Fiscal Year Report Investigation Report Investigation 2002-03 60 300 68.5 56.25 2003-04 60 295 68.5 56.25 2004-05 60 290 68.5 56.25 2005-06 60 300 68.5 56.25 2006-07 60 300 68.5 56.25 2007-08 60 300 68.5 56.25 2008-09 60 300 68.5 56.25 2009-10 60 300 68.5 56.25 2010-11 60 300 68.5 56.25 2011-12 45 180 68.5 56.25 2012-13 60 180 68.5 56.25 Allowable related employee benefits Benefit costs are determined by multiplying each year’s allowable salary costs by each year’s benefit rate. Employee benefits related to the allowable salaries identified above are also allowable. The city provided and we accepted the benefit rates for each job classification that performed the reimbursable activities for each fiscal year in the audit period. We calculated allowable benefit costs using the benefit rates the city provided for each job classification for each fiscal year in the audit period. The following table summarizes the claimed, allowable and audit adjustment related employee benefit costs by fiscal year: Related Benefits Fiscal Audit Year Claimed Allowable Adjustment 2002-03 $ 15,670 $ 3,691 $ (11,979) 2003-04 17,766 4 ,194 (13,572) 2004-05 20,540 4 ,980 (15,560) 2005-06 28,340 6 ,589 (21,751) 2006-07 39,586 9 ,616 (29,970) 2007-08 48,327 11,127 (37,200) 2008-09 60,088 13,940 (46,148) 2009-10 39,238 9 ,130 (30,108) 2010-11 31,524 6 ,912 (24,612) 2011-12 25,543 9 ,632 (15,911) 2012-13 21,615 7 ,832 (13,783) Total $ 348,237 $ 87,643 $ (260,594) Allowable related indirect costs The city claimed indirect costs based on salaries and benefits for FY 2002-03 through FY 2004-05 and on direct labor for the remaining -12- City of Fullerton Identity Theft Program fiscal years of the audit period. Indirect costs are determined by multiplying each year’s indirect cost base by each year’s indirect cost rates. The city provided and we accepted the indirect cost rates claimed during the audit period. Unallowable indirect costs are related to the unallowable salaries and benefits previously identified. The following table summarizes the claimed, allowable and audit adjustment related to indirect costs by fiscal year: Related Indirect Costs Fiscal Amount Amount Audit Year Claimed Allowable Adjustment 2002-03 $ 10,660 $ 2,511 $ (8,149) 2003-04 10,748 2 ,537 ( 8,211) 2004-05 9 ,420 2 ,284 ( 7,136) 2005-06 13,144 3 ,056 (10,088) 2006-07 17,807 4 ,326 (13,481) 2007-08 25,347 5 ,836 (19,511) 2008-09 29,993 6 ,958 (23,035) 2009-10 19,585 4 ,557 (15,028) 2010-11 17,180 3 ,767 (13,413) 2011-12 13,153 4 ,960 ( 8,193) 2012-13 12,611 4 ,570 ( 8,041) Total $ 179,648 $ 45,362 $ (134,286) Criteria Section III. (Period of Reimbursement) of the parameters and guidelines states, in part, “Actual costs for one fiscal year shall be included in each claim.” Section IV. (Reimbursable Activities) of the parameters and guidelines states: To be eligible for mandated cost reimbursement for any given fiscal year, only actual costs may be claimed. Actual costs are those costs actually incurred to implement the mandated activities. Actual costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the reimbursable activities. A source document is a document created at or near the same time the actual cost was incurred for the event or activity in question. Source documents may include, but are not limited to, employee time records or time logs, sign-in sheet, invoices, and receipts. Section IV. (Reimbursable Activities) of the parameters and guidelines also states: For each eligible claimant, the following ongoing activities are eligible for reimbursement: 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that -13- City of Fullerton Identity Theft Program personal information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed on-line by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. Section V. (Claim Preparation and Submission) of the parameters and guidelines states: 1. Salaries and benefits Report each employee implementing the reimbursable activities by name, job classification, and productive hourly rate (total wages and related benefits divided by productive hours). Describe the specific reimbursable activities performed and the hours devoted to these activities. Recommendation The State Legislature suspended the Identity Theft Program in the FY 2013-14 through FY 2020-21 Budget Acts. If the program becomes active again, we recommend that the city:  Adhere to the program’s parameters and guidelines and claiming instructions when claiming reimbursement for mandated costs; and  Ensure that claimed costs include only eligible costs, are based on actual costs, and are properly supported. City’s Response The City of Fullerton is in receipt of the State’s Audit Report concerning the legislatively mandated Identify Theft Program for the period of July 1, 2002 through June 30, 2013. We have reviewed the report and agree with the findings. The City appreciates your examination of the costs claimed for this program. -14- City of Fullerton Identity Theft Program Attachment— City’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-MCC-0026