City of San Bernardino

SAN BERNARDINO COUNTY Reissued Audit Report IDENTITY THEFT PROGRAM Chapter 956, Statutes of 2000 July 1, 2002, through June 30, 2013 BETTY T. YEE California State Controller June 2022 BETTY T. YEE California State Controller June 22, 2022 CERTIFIED MAIL—RETURN RECEIPT REQUESTED Ensen Mason, CPA, CFA, Auditor-Controller/Treasurer/Tax Collector San Bernardino County 268 West Hospitality Lane, 4th Floor San Bernardino, CA 92415 Dear Mr. Mason: The State Controller’s Office (SCO) audited the costs claimed by San Bernardino County for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. This report is a reissue of the April 20, 2022 final audit report. Subsequent to issuance of that report, we discovered that the “Allowable per Audit” amounts identified in the Schedule were incorrect for FY 2002-03 through FY 2010-11. We are re-issuing the final audit report to correct those amounts. Total allowable and unallowable amounts for the audit period were not affected, nor were the amounts identified within the Finding. The county claimed $4,615,429 for costs of the mandated program. Our audit found that $606,540 is allowable ($662,432 less a $55,892 penalty for filing late claims) and $4,008,889 is unallowable, primarily because the county overstated the number of identity theft reports and the time increments required to perform the reimbursable activities, and misstated the job classifications for the county employees who performed the reimbursable activities. The State made no payments to the county. The State will pay $606,540, contingent upon available appropriations. Following issuance of this audit report, the SCO’s Local Government Programs and Services Division will notify the county of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. If you have any questions, please contact Lisa Kurokawa, Chief, Compliance Audits Bureau, by telephone at (916) 327-3138. Sincerely, Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits KT/ls Ensen Mason, CPA, CFA, Auditor-Controller/ -2- June 22, 2022 Treasurer/Tax Collector cc: Sakura Younger, Manager Management Services Section San Bernardino County Auditor-Controller/Treasurer/Tax Collector’s Office Jai Prasad, CPA, SB 90 Coordinator Management Services Section San Bernardino County Auditor-Controller/Treasurer/Tax Collector’s Office Sarkis Ohannessian, Deputy Chief Information Services Division San Bernardino County Sheriff’s Department Vicki Dela Cruz, Financial Manager Bureau of Administration San Bernardino County Sheriff’s Department Chris Hill, Principal Program Budget Analyst Local Government Unit California Department of Finance Steven Pavlov, Finance Budget Analyst Local Government Unit California Department of Finance Darryl Mar, Manager Local Government Programs and Services Division State Controller’s Office Everett Luc, Supervisor Local Government Programs and Services Division State Controller’s Office San Bernardino County Identity Theft Program Contents Reissued Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 2 Objective, Scope, and Methodology ................................................................................. 2 Conclusion .......................................................................................................................... 4 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Reason for Reissuance ....................................................................................................... 4 Restricted Use .................................................................................................................... 5 Revised Schedule—Summary of Program Costs ................................................................ 6 Finding and Recommendation .............................................................................................. 13 Attachment—County’s Response to Draft Audit Report San Bernardino County Identity Theft Program Reissued Audit Report Summary The State Controller’s Office (SCO) audited the costs claimed by San Bernardino County for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. The county claimed $4,615,429 for costs of the mandated program. Our audit found that $606,540 is allowable ($662,432 less a $55,892 penalty for filing late claims) and $4,008,889 is unallowable, primarily because the county overstated the number of identity theft reports and the time increments required to perform the reimbursable activities, and misstated the job classifications for the county employees who performed the reimbursable activities. The State made no payments to the county. The State will pay $606,540, contingent upon available appropriations. Background Penal Code (PC) section 530.6, subdivision (a), as added by the Statutes of 2000, Chapter 956, requires local law enforcement agencies to take a police report and begin an investigation when a complainant residing within their jurisdiction reports suspected identity theft. On March 27, 2009, the Commission on State Mandates (Commission) found that this legislation mandates a new program or higher level of service for local law enforcement agencies within the meaning of Article XIII B, section 6 of the California Constitution, and imposes costs mandated by the State pursuant to Government Code (GC) section 17514. The Commission determined that each claimant is allowed to claim and be reimbursed for the following ongoing activities identified in the parameters and guidelines (Section IV., “Reimbursable Activities”): 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed online by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. The Commission also determined that providing a copy of the report to the complainant and referring the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts are not reimbursable activities. -1- San Bernardino County Identity Theft Program The program’s parameters and guidelines establish the state mandate and define the reimbursement criteria. In compliance with GC section 17558, the SCO issues claiming instructions to assist local agencies in claiming mandated program reimbursable costs. We conducted this performance audit in accordance with Audit Authority GC sections 17558.5 and 17561, which authorize the SCO to audit the county’s records to verify the actual amount of the mandated costs. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law. Objective, Scope, The objective of our audit was to determine whether costs claimed represent increased costs resulting from the legislatively mandated and Methodology Identity Theft Program. Specifically, we conducted this audit to determine whether costs claimed were supported by appropriate source documents, were not funded by another source, and were not unreasonable and/or excessive.1 The audit period was July 1, 2002, through June 30, 2013. To achieve our objective, we performed the following procedures:  We reviewed the annual mandated cost claims filed by the county for the audit period and identified the significant cost components of each claim as salaries, benefits, and indirect costs. We determined whether there were any errors or unusual or unexpected variances from year to year. We reviewed the activities claimed to determine whether they adhered to the SCO’s claiming instructions and the program’s parameters and guidelines.  We completed an internal control questionnaire by interviewing key county staff. We discussed the claim preparation process with county staff members to determine what information was obtained, who obtained it, and how it was used.  We obtained system-generated lists of identity theft cases from the county’s Tiburon computer-aided dispatch (CAD) system to verify the existence, completeness, and accuracy of unduplicated case counts for each fiscal year in the audit period. We found that the county claimed cases for both contract cities and unincorporated areas of the county. The county did not report on its mandated cost claims offsetting reimbursements for the contract city cases. We determined that the contract city cases are ineligible for reimbursement; each of the contract cities must file its own mandated cost claim in order to receive reimbursement for its contract costs related to the Identity Theft Program. We recalculated the costs based on the allowable number of cases for each of the reimbursable activities and found that the county overstated the claimed costs that were funded by other sources (see the Finding). 1 Unreasonable and/or excessive costs include ineligible costs that are not identified in the programs parameters and guidelines as reimbursable costs. -2- San Bernardino County Identity Theft Program  To determine the number of allowable identity theft cases, we obtained copies of the county’s contracts for law enforcement services. We excluded cases originating within contract jurisdictions (cities, towns, and a casino, as indicated by jurisdiction codes), as the county was reimbursed a set fee for providing these services.  We designed a statistical sampling plan to test approximately 25–50% of claimed costs, based on a moderate level of detection (audit) risk. We judgmentally selected the county’s filed claims for fiscal year (FY) 2010-11 through FY 2012-13 for testing; these fiscal years comprised claimed costs totaling $1,174,700 (or 25.5%) of the total costs claimed ($4,615,249). The sampling plan is described in the Finding and Recommendation section.  We used a random number table to select 436 out of 946 identity theft reports from the three fiscal years sampled. We tested the identity theft reports as follows: o We determined whether a contemporaneously prepared and approved police report supported that a violation of PC section 530.5 occurred; o We obtained employee numbers, names, and classifications from sampled police reports documenting who performed the reimbursable activities. Compared the employee classifications obtained from the police reports to those claimed by the county; o We obtained system-generated time stamps from the county’s CAD system for the “Time On Scene” and “Time Close” associated with each report to determine the time spent to begin an investigation. For reports with unreasonable and excessive time spent, we reviewed the detailed history of time stamps from the CAD system for the incident number related to the sampled police report, and adjusted for ineligible time spent on arrests and other incident numbers.  We interviewed sworn and non-sworn county employees who performed the mandated activities documented in the sampled police reports about their time spent performing reimbursable activities not captured by the CAD system.  We projected the audit results of the three fiscal years tested by multiplying the allowable case counts by the audited average time increments needed to perform the reimbursable activities, and multiplying the product by the productive hourly rates (PHRs) of employees who performed them. We applied the weighted three-year average error rate of identity theft cases from the results of testing our samples to the remaining eight years of the audit period due to the homogeneity of the population.  We reviewed the county’s Single Audit Reports to identify potential sources of offsetting savings or reimbursements from federal or pass- through programs applicable to the Identity Theft Program. The county certified in its claims that it did not receive such offsetting revenues applicable to this mandated program. -3- San Bernardino County Identity Theft Program We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We did not audit the county’s financial statements. Conclusion As a result of performing the audit procedures, we found instances of noncompliance with the requirements described in our audit objective. We found that the county claimed overstated and ineligible costs and overstated the claimed costs that were funded by other sources; as quantified in the Schedule and described in the Finding and Recommendation section of this audit report. For the audit period, San Bernardino County claimed $4,615,429 for costs of the legislatively mandated Identity Theft Program. Our audit found that $606,540 is allowable ($662,432 less a $55,892 penalty for filing late claims) and $4,008,889 is unallowable. The State made no payments to the county. The State will pay $606,540, contingent upon available appropriations. Following issuance of this audit report, the SCO’s Local Government Programs and Services Division will notify the county of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. Follow-up on We have not previously conducted an audit of the county’s legislatively mandated Identity Theft Program. Prior Audit Findings Views of This report is a reissue of the April 20, 2022 final audit report. We Responsible informed Jai Prasad, SB 90 Coordinator, of the revisions to this audit report via email on April 22, 2022. Mr. Prasad responded by email on Officials April 22, 2022, acknowledging the changes to the audit report. Reason for Subsequent to issuance of the final audit report on April 20, 2022, we Reissuance discovered errors in the calculation of “Allowable per Audit” amounts for FY 2002-03 through FY 2010-11 in the Schedule. We are re-issuing the final audit report to correct those amounts. Total allowable and unallowable amounts for the audit period were not affected, nor were the amounts identified within the Finding. -4- San Bernardino County Identity Theft Program Restricted Use This audit report is solely for the information and use of San Bernardino County, the California Department of Finance, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits June 22, 2022 -5- San Bernardino County Identity Theft Program Revised Schedule— Summary of Program Costs July 1, 2002, through June 30, 2013 Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2002, through June 30, 2003 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 115,450 $ 19,345 $ (96,105) Beginning an investigation of the facts 101,539 14,985 (86,554) Total direct costs 216,989 34,330 (182,659) Indirect costs 155,125 24,543 (130,582) Total direct and indirect costs 372,114 58,873 (313,241) Less offsetting revenues and reimbursements3 - - - Subtotal 372,114 58,873 (313,241) Less late filing penalty4 - (5,887) (5,887) Total program costs $ 372,114 52,986 $ (319,128) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 52,986 July 1, 2003, through June 30, 2004 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 121,132 $ 19,170 $ (101,962) Beginning an investigation of the facts 105,932 14,953 (90,979) Total direct costs 227,064 34,123 (192,941) Indirect costs 139,508 20,965 (118,543) Total direct and indirect costs 366,572 55,088 (311,484) Less offsetting revenues and reimbursements3 - - - Subtotal 366,572 55,088 (311,484) Less late filing penalty4 - (5,509) (5,509) Total program costs $ 366,572 49,579 $ (316,993) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 49,579 -6- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2004, through June 30, 2005 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 156,111 $ 24,671 $ (131,440) Beginning an investigation of the facts 136,874 19,506 (117,368) Total direct costs 292,985 44,177 (248,808) Indirect costs 180,010 27,142 (152,868) Total direct and indirect costs 472,995 71,319 (401,676) Less offsetting revenues and reimbursements3 - - - Subtotal 472,995 71,319 (401,676) Less late filing penalty4 - (7,132) (7,132) Total program costs $ 472,995 64,187 $ (408,808) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 64,187 July 1, 2005, through June 30, 2006 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 166,499 $ 24,878 $ (141,621) Beginning an investigation of the facts 147,192 19,310 (127,882) Total direct costs 313,691 44,188 (269,503) Indirect costs 148,187 20,874 (127,313) Total direct and indirect costs 461,878 65,062 (396,816) Less offsetting revenues and reimbursements3 - - - Subtotal 461,878 65,062 (396,816) L ess late filing penalty4 - (6,506) (6,506) Total program costs $ 461,878 58,556 $ (403,322) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 58,556 -7- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2006, through June 30, 2007 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 180,759 $ 27,697 $ (153,062) Beginning an investigation of the facts 162,080 21,314 (140,766) Total direct costs 342,839 49,011 (293,828) Indirect costs 151,980 21,727 (130,253) Total direct and indirect costs 494,819 70,738 (424,081) Less offsetting revenues and reimbursements3 - - - Subtotal 494,819 70,738 (424,081) L ess late filing penalty4 - (7,074) (7,074) Total program costs $ 494,819 63,664 $ (431,155) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 63,664 July 1, 2007, through June 30, 2008 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 162,871 $ 28,740 $ (134,131) Beginning an investigation of the facts 147,781 22,136 (125,645) Total direct costs 310,652 50,876 (259,776) Indirect costs 169,398 27,743 (141,655) Total direct and indirect costs 480,050 78,619 (401,431) Less offsetting revenues and reimbursements3 - - - Subtotal 480,050 78,619 (401,431) L ess late filing penalty4 - (7,862) (7,862) Total program costs $ 480,050 70,757 $ (409,293) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 70,757 -8- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2008, through June 30, 2009 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 152,340 $ 24,470 $ (127,870) Beginning an investigation of the facts 137,563 18,818 (118,745) Total direct costs 289,903 43,288 (246,615) Indirect costs 137,936 20,596 (117,340) Total direct and indirect costs 427,839 63,884 (363,955) Less offsetting revenues and reimbursements3 - - - Subtotal 427,839 63,884 (363,955) L ess late filing penalty4 - (6,388) (6,388) Total program costs $ 427,839 57,496 $ (370,343) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 57,496 July 1, 2009, through June 30, 2010 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 132,442 $ 19,475 $ (112,967) Beginning an investigation of the facts 117,967 15,041 (102,926) Total direct costs 250,409 34,516 (215,893) Indirect costs 114,412 15,770 (98,642) Total direct and indirect costs 364,821 50,286 (314,535) Less offsetting revenues and reimbursements3 - - - Subtotal 364,821 50,286 (314,535) L ess late filing penalty4 - (5,029) (5,029) Total program costs $ 364,821 45,257 $ (319,564) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 45,257 -9- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2008, through June 30, 2009 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 152,340 $ 24,470 $ (127,870) Beginning an investigation of the facts 137,563 18,818 (118,745) Total direct costs 289,903 43,288 (246,615) Indirect costs 137,936 20,596 (117,340) Total direct and indirect costs 427,839 63,884 (363,955) Less offsetting revenues and reimbursements3 - - - Subtotal 427,839 63,884 (363,955) L ess late filing penalty4 - (6,388) (6,388) Total program costs $ 427,839 57,496 $ (370,343) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 57,496 July 1, 2009, through June 30, 2010 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 132,442 $ 19,475 $ (112,967) Beginning an investigation of the facts 117,967 15,041 (102,926) Total direct costs 250,409 34,516 (215,893) Indirect costs 114,412 15,770 (98,642) Total direct and indirect costs 364,821 50,286 (314,535) Less offsetting revenues and reimbursements3 - - - Subtotal 364,821 50,286 (314,535) L ess late filing penalty4 - (5,029) (5,029) Total program costs $ 364,821 45,257 $ (319,564) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 45,257 -10- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2010, through June 30, 2011 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 126,907 $ 17,379 $ (109,528) Beginning an investigation of the facts 110,246 13,457 (96,789) Total direct costs 237,153 30,836 (206,317) Indirect costs 109,328 14,215 (95,113) Total direct and indirect costs 346,481 45,051 (301,430) Less offsetting revenues and reimbursements3 - - - Subtotal 346,481 45,051 (301,430) L ess late filing penalty4 - (4,505) (4,505) Total program costs $ 346,481 40,546 $ (305,935) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 40,546 July 1, 2011, through June 30, 2012 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 153,413 $ 21,590 $ (131,823) Beginning an investigation of the facts 132,182 17,004 (115,178) Total direct costs 285,595 38,594 (247,001) Indirect costs 121,863 16,468 (105,395) Total direct and indirect costs 407,458 55,062 (352,396) Less offsetting revenues and reimbursements3 - - - Total program costs $ 407,458 55,062 $ (352,396) Less amount paid by the State4 - Allowable costs claimed in excess of amount paid $ 55,062 -11- San Bernardino County Identity Theft Program Revised Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2012, through June 30, 2013 Direct costs: Salaries and benefits2 Taking a police report on a violation of PC §530.5 $ 159,499 $ 19,070 $ (140,429) Beginning an investigation of the facts 136,516 15,045 (121,471) Total direct costs 296,015 34,115 (261,900) Indirect costs 124,386 14,335 (110,051) Total direct and indirect costs 420,401 48,450 (371,951) Less offsetting revenues and reimbursements3 - - - Total program costs $ 420,401 48,450 $ (371,951) Less amount paid by the State4 4 8 , 4 5 0- Allowable costs claimed in excess of amount paid $ 48,450 Summary: July 1, 2002, through June 30, 2013 Direct costs $ 3,063,295 $ 438,054 $ (2,625,241) Indirect costs 1,552,134 224,378 (1,327,756) Total direct and indirect costs 4,615,429 662,432 (3,952,997) Less offsetting revenues and reimbursements3 - - - Subtotal 4,615,429 662,432 (3,952,997) Less late filing penalty4 - (55,892) (55,892) Total program costs $ 4,615,429 606,540 $ (4,008,889) Less amount paid by the State5 - Allowable costs claimed in excess of amount paid $ 606,540 _________________________ 1 See the Finding and Recommendation section. 2 The county claimed salaries based on PHRs that included salaries and benefits. 3 The offsets relating to the contract city cases have been accounted for in the direct and indirect cost audit adjustments. 4 The SCO assesses late penalties on allowable costs for claims filed after the filing deadline specified in GC section 17568, equal to 10% of claimed costs, not to exceed $10,000. 5 Payment amount current as of June 9, 2022. -12- San Bernardino County Identity Theft Program Finding and Recommendation FINDING — The county claimed $4,615,429 ($3,063,295 in salaries and benefits and $1,552,134 in related indirect costs) for the Identity Theft Program. We Overstated Identity found that $662,432 in direct and indirect costs is allowable and Theft Program costs $3,952,997 is unallowable.2 Salary and benefit costs are determined by multiplying the number of identity theft police reports by the time increments required to perform the reimbursable activities, and then multiplying the product by the weighted average PHRs for the employee classifications that performed the reimbursable activities. The costs are unallowable because the county misinterpreted the program’s parameters and guidelines. As a result, the county overstated the number of identity theft reports, overstated the time increments required to perform the reimbursable activities, and misstated the job classifications and PHRs for the county employees who performed the reimbursable activities. The following table summarizes the claimed and allowable amounts, and the audit adjustments by fiscal year: Salaries and Benefits Related Total Fiscal Amount Amount Audit Indirect Cost Audit Year Claimed Allowable Adjustment Adjustment Adjustment 2002-03 $ 2 16,989 $ 34,330 $ (182,659) $ ( 130,582) $ (313,241) 2003-04 2 27,064 34,123 (192,941) ( 118,543) (311,484) 2004-05 2 92,985 44,177 (248,808) ( 152,868) (401,676) 2005-06 3 13,691 44,188 (269,503) ( 127,313) (396,816) 2006-07 3 42,839 49,011 (293,828) ( 130,253) (424,081) 2007-08 3 10,652 50,876 (259,776) ( 141,655) (401,431) 2008-09 2 89,903 43,288 (246,615) ( 117,340) (363,955) 2009-10 2 50,409 34,516 (215,893) ( 98,642) (314,535) 2010-11 2 37,153 30,836 (206,317) ( 95,113) (301,430) 2011-12 2 85,595 38,594 (247,001) ( 105,395) (352,396) 2012-13 2 96,015 34,115 (261,900) ( 110,051) (371,951) Total $ 3 ,063,295 $ 438,054 $ (2,625,241) $ ( 1,327,756) $ (3,952,997) Overstated counts of identity theft police reports Claimed and Allowable Case Counts The county claimed costs incurred for taking police reports related to 18,572 identity theft cases during the audit period. During fieldwork, the county provided us with an internally generated summary report of claimed counts, actual counts, and estimated time increments by 2 Our audit found that $662,432 in direct and indirect cots is allowable and $3,952,997 is unallowable. However, the county filed its FY 2002-03 through FY 2010-11 claims after the filing deadline specified in the SCO’s claiming instructions and those late claims are subject to late filing penalties pursuant to GC section 17568, which is equal to 10% of allowable costs, not to exceed $10,000 per fiscal year. Therefore, allowable costs for the audit period totals $606,540 ($662,432 less $55,892 in late filing penalties). -13- San Bernardino County Identity Theft Program reimbursable activity per case for each fiscal year of the audit period. County representatives stated that this report was the county’s basis for the costs claimed. However, the county did not have support from its CAD system for this report. The report disclosed that the county claimed 19,444 total cases and understated its case count by 872 cases for the audit period. A Crime Analysis Supervisor within the Sheriff’s Department provided us with an unduplicated list from the county’s CAD system of initial police reports that supported violations of PC section 530.5. The county’s CAD system showed that the county completed 18,968 police reports during the audit period. This list of police reports identified the county jurisdiction code, the year of the report, and the report number. The county also provided a Jurisdiction Reference Chart, which disclosed county jurisdiction codes and jurisdiction codes for the cities that contracted with the county for law enforcement services. After examining the county’s list of police reports, we found that 14,104 reports (74%) were from contract city jurisdictions and 4,864 reports (26%) were from county jurisdictions. The county provided copies of its contracts for law enforcement services; during our analysis of the contracts, we noted that the county provided such services for a set fee to the following 13 cities, two towns, and one casino located in San Bernardino County:  City of Adelanto;  City of Big Bear Lake;  City of Chino Hills;  City of Colton;  City of Grand Terrace;  City of Hesperia;  City of Highland;  City of Loma Linda;  City of Needles;  City of Rancho Cucamonga;  City of Twenty-Nine Palms;  City of Victorville;  City of Yucaipa;  Town of Apple Valley;  Town of Yucca Valley; and  Yaamava’ Resort and Casino at San Manuel (formerly San Manuel Casino). As the county received reimbursement from its contract cities for preparing their police reports, the 14,104 reports originating from these locations are unallowable for reimbursement. For this audit, the relevant population is the 4,864 reports with county jurisdiction codes completed during the audit period. -14- San Bernardino County Identity Theft Program Testing Police Reports We determined the accuracy of the unduplicated counts of police reports by determining whether:  Each identity theft case was supported by a contemporaneously prepared and approved police report; and  The police report supported a violation of PC section 530.5. We developed a statistical sampling plan to test at least 25% of total claimed costs. We generated statistical samples of identity theft cases for these two procedures so that we could project our sample results to the population of identity theft cases. We selected our statistical samples of identity theft cases originating from the county based on a 95% confidence level, a sampling error of ±8%, and an expected (true) error rate of 50%. We judgmentally selected FY 2010-11, FY 2011-12, and FY 2012-13 for testing because the county claimed costs totaling $1,174,340—which constitutes 25.5% of the total claimed during the audit period ($4,615,429)—for these three fiscal years. We discovered that San Bernardino County Sheriff’s Department (SBCSD) staff took police reports from citizens at the front counter of the department’s patrol stations as well as in the field. Therefore, we stratified our testing to differentiate between non-counter (field) reports and those taken at patrol stations (counter reports). Our testing disclosed the following: Counter Reports  For FY 2010-11, we selected for testing 52 reports from the population of 80 counter reports. We found that two cases were unallowable (a 3.85% exception rate) because they did not support a violation of PC section 530.5.  For FY 2011-12, we selected for testing 63 reports from the population of 108 counter reports. We found that five cases were unallowable (a 7.94% exception rate). Two cases did not support a violation of PC section 530.5, two cases were supplemental reports, and the complainant in the other case was a resident of Henderson, Nevada.  For FY 2012-13, we selected for testing 49 reports from the population of 72 counter reports. We found that three cases were unallowable (a 6.12% exception rate) because the cases did not support a violation of PC section 530.5. Field Reports  For FY 2010-11, we selected for testing 90 reports from the population of 228 field reports. We found that 14 cases were unallowable (a 15.56% exception rate). Six cases did not support a violation of PC section 530.5, and eight cases were follow-up reports written by Detectives (of which six were based on courtesy reports received from other police or sheriff departments, and two were follow-up requests from SBCSD patrol stations). -15- San Bernardino County Identity Theft Program  For FY 2011-12, we selected for testing 92 reports from the population of 236 field reports. We found that 10 cases were unallowable (a 10.87% exception rate). Five cases did not support a violation of PC section 530.5, one case was a courtesy report, and four cases were follow-up reports written by Detectives.  For FY 2012-13, we selected for testing 90 reports from the population of 222 field reports. We found that four cases were unallowable (a 4.44% exception rate) because one case did not support a violation of PC section 530.5 and three cases were follow-up reports written by Detectives based on courtesy reports received from other police or sheriff departments. We extrapolated and projected the results of our substantive tests of statistical samples to determine the number of allowable and unallowable identity theft reports for the entire 11-year audit period. We found that 4,413 police reports are allowable. For the three years that we tested (FY 2010-11, FY 2011-12, and FY 2012-13), we calculated a 5.97% average error rate for the counter reports and a 10.29% average error rate for the field reports. We applied these average error rates to the other eight years of the audit period (FY 2002-03 through FY 2009-10). The following table summarizes the counts of claimed, supported, and allowable identity theft cases, and the difference by fiscal year: Allowable Fiscal Contracting County Counter Field Year Claimed Supported Entities Reports Reports Reports Total Difference 2002-03 1,694 1,822 (1,332) 4 90 97 3 47 4 44 (1,250) 2003-04 1,702 1,830 (1,363) 4 67 91 3 32 4 23 (1,279) 2004-05 1,939 2,042 (1,509) 5 33 1 07 3 76 4 83 (1,456) 2005-06 2,010 2,010 (1,497) 5 13 86 3 79 4 65 (1,545) 2006-07 2,090 2,090 (1,545) 5 45 1 20 3 74 4 94 (1,596) 2007-08 1,824 1,824 (1,278) 5 46 1 30 3 66 4 96 (1,328) 2008-09 1,678 1,676 (1,219) 4 57 1 15 3 01 4 16 (1,262) 2009-10 1,458 1,456 (1,090) 3 66 99 2 34 3 33 (1,125) 2010-11 1,271 1,325 (1,016) 3 09 77 1 93 2 70 (1,001) 2011-12 1,405 1,397 (1,053) 3 44 99 2 10 3 09 (1,096) 2012-13 1,501 1,496 (1,202) 2 94 68 2 12 2 80 (1,221) Total 18,572 18,968 (14,104) 4,864 1,089 3,324 4,413 (14,159) Overstated time increments Claimed Time Increments The county claimed time increments spent by various employee classifications within SBCSD to perform the following reimbursable activities:  Drafting, reviewing, and editing identity theft police reports taken by Officers, and reviewing identity theft police reports taken at the police station counter (Activity 1a – Take a police report supporting a violation of PC section 530.5); and  Determining where the crime occurred and what pieces of personal identifying information were used for unlawful purposes (Activity 2 – Begin an investigation of the facts). -16- San Bernardino County Identity Theft Program For Activity 1a, the county tracked the time spent by Sergeants to review police reports separately from the time spent by other staff members to draft, review, and edit police reports. This time spent by Sergeants on the reimbursable activity is identified as “Activity 1a.1 – Sergeant review.” The county claimed the following time increments to perform the reimbursable activities:  60 minutes for Deputy Sheriffs to perform Activity 1a;  15 minutes for employees in the Station Clerk and Office Assistant III classifications to assist with Activity 1a;  10 minutes for Sergeants to perform Activity 1a.1 – Sergeant review; and  60 minutes for Sheriff Detectives to perform Activity 2. The county did not provide support for the claimed time increments. Section IV., “Reimbursable Activities,” of the program’s parameters and guidelines state that “Actual costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the reimbursable activities.” As the county did not provide support that complies with this requirement, we determined that the claimed time increments are estimated and unsupported. Allowable Time Increments Taking a police report The county’s CAD system did not record time spent drafting, reviewing, and editing identity theft police reports (Activities 1a and 1a.1 – Sergeant review). We interviewed various SBCSD employees, who provided testimonial evidence of the approximate time spent on reimbursable activities not recorded by the CAD system. We found that this information provided a reasonable representation of the time needed to perform these reimbursable activities. For Activity 1a, we interviewed three Deputy Sheriffs, three Service Specialists, and one Sergeant about drafting, reviewing, and editing identity theft police reports taken by Officers. Based on these interviews, we determined that SBCSD staff spent an average of 35 minutes drafting, reviewing, and editing identity theft police reports taken by Officers. For Activity 1a.1 – Sergeant review, we interviewed four Detectives and three Sergeants about reviewing identity theft police reports taken at the police station counter. Based on these interviews, we determined that SBCSD staff spent an average of 13 minutes reviewing police reports taken at the police station counter. The county did not have an online system during the audit period and did not claim any costs for reviewing identity theft reports that were completed online (Activity 1b). -17- San Bernardino County Identity Theft Program Beginning an investigation During audit fieldwork, the SBCSD provided system-generated contemporaneous records from its CAD system. These records showed the time, in minutes, from when SBCSD staff arrived at a victim’s residence or business located in the county, or began taking information from a resident at the counter of a patrol station (Time On Scene) to the time that the initial call for service was completed (Time Complete). The time elapsed represents the time that county employees spent on determining where the crime occurred and what pieces of personal information were used for unlawful purposes (Activity 2). We tested the time increments reported for the 154 allowable counter cases and the 244 allowable field cases from our sample selection. We reviewed the CAD system reports to determine the average time spent performing Activity 2. During testing, we noted that certain cases showed unreasonable time increments, as follows:  14 counter cases and 11 field cases with reported time increments of 0 to 9 minutes, and  19 counter cases and 52 field cases with reported time increments of greater than 60 minutes. For these reports, the county provided detailed CAD history information. We found that time increments were understated because SBCSD staff members failed to record the time that the employee began preparing the counter report or when the officer arrived on scene for field reports. We found that time increments were overstated because SBCSD staff members recorded time spent on other incident numbers for other major crimes and arrests. We excluded all time recorded for follow-up investigation, search, pursuit, arrest, and changing location or transporting the suspect to jail for booking until the suspect is in custody and incarcerated. Based on our testing, we found that SBCSD staff members spent an average of 41 minutes performing Activity 2. The following table summarizes the time claimed and allowable for the reimbursable activities by fiscal year: Claimed Minutes Allowable Minutes 1a – Take a 1a.1 – Review 2 – Begin an Police Report* Reports† Investigation ‡ Fiscal Clerks/ 1a – Take a 1a.1 – Review 2 – Begin an Year Deputies Assistants Sergeants Detectives Police Report Reports Investigation 2002-03 60 15 10 60 35 13 41 2003-04 60 15 10 60 35 13 41 2004-05 60 15 10 60 35 13 41 2005-06 60 15 10 60 35 13 41 2006-07 60 15 10 60 35 13 41 2007-08 60 15 10 60 35 13 41 2008-09 60 15 10 60 35 13 41 2009-10 60 15 10 60 35 13 41 2010-11 60 15 10 60 35 13 41 2011-12 60 15 10 60 35 13 41 2012-13 60 15 10 60 35 13 41 *The county claimed that the Deputy Sheriff classification took police reports, and the Station Clerk and Office Assistant III classifications assisted with taking police reports. † The county claimed that Sergeants reviewed police reports taken at the station counter. ‡ The county claimed that Detectives began investigations. -18- San Bernardino County Identity Theft Program Misstated job classifications and PHRs Claimed Job Classifications As noted previously, the county claimed that Deputy Sheriffs and Office Assistant IIIs prepared police reports (Activity 1a), and that Sergeants reviewed the reports taken at the police station counter (Activity 1a.1 – Sergeant review). The county also claimed that Sheriff Detectives began investigations (Activity 2). Staff Allowable In order to clarify which SBCSD staff members performed the mandated activities, we: 1. Prepared a schedule of employee numbers and names from the sampled police reports; 2. Requested information from the county supporting the actual job classifications for the employees identified; 3. Calculated the extent (percentage of involvement) that various employees performed the mandated activities for the county’s sampled identity theft cases; and 4. Verified with the county the results of the above steps to confirm the actual job classifications that performed the reimbursable activities of drafting and editing a police report, reviewing police reports, and beginning an investigation. The following table summarizes the actual job classifications of the employees who performed the reimbursable activities during FY 2010-11, FY 2011-12, and FY 2012-13, and the average percentage of their involvement in the reimbursable activities for the three fiscal years. Average Involvement Classification Percentage Prepare a report/Begin an investigation1 Deputy Sheriffs 91.0% Sheriff Sergeants 0.5% Sheriff Detectives 0.5% Captains 1.0% Service Specialists 7.0% 100% Review a police report Sheriff Sergeants 92.0% Sheriff Detectives 7.0% Captains 1.0% 100% 1 The same staff members performed the activities of Prepare a Report (Activity 1a) and Begin an Investigation (Activity 2). -19- San Bernardino County Identity Theft Program The county provided schedules of the actual hourly rates for the employee classifications that performed the reimbursable activities during the audit period. To calculate allowable costs, we used claimed PHRs for Deputy Sheriffs, Sheriff Detectives, and Sergeants. We used rates provided by the county for the employee classifications not claimed (Captains and Service Specialists). The following table summarizes the auditor-recalculated weighted PHRs for each fiscal year in the audit period by reimbursable activities performed: Fiscal Prepare Review Begin an Year a Report a Report Investigation 2002-03 $ 49.39 $ 68.12 $ 49.39 2003-04 5 1.73 69.90 51.73 2004-05 5 9.10 76.64 59.10 2005-06 6 0.77 83.32 60.77 2006-07 6 3.14 88.78 63.14 2007-08 6 5.31 91.60 65.31 2008-09 6 6.20 93.25 66.20 2009-10 6 6.10 91.96 66.10 2010-11 7 2.94 100.70 72.94 2011-12 8 0.53 105.66 80.53 2012-13 7 8.63 102.65 78.63 Using this salary rate information, the corrected number of case counts, the corrected time increments, and the employee classifications that performed the reimbursable activities during the audit period, we determined allowable salaries for each fiscal year. For example, the following table shows the calculation of allowable salary and benefit costs for FY 2011-12: Number Activity Allowable Employee PHR of cases Minutes Hours % costs Classification [a] [b] [c] [d=(b*g)/60] [e] [f=a*i*k] Prepare a report: Deputy Sheriff $ 82.81 309 35 1 80.25 91.0% 13,583 Sergeant 106.12 309 35 1 80.25 0.5% 96 Detective 94.08 309 35 1 80.25 0.5% 85 Captain 144.32 309 35 1 80.25 1.0% 260 Service Specialist 38.96 309 35 1 80.25 7.0% 492 Total, prepare a report $ 14,516 Review a report: Sergeant 106.12 309 13 66.95 92.0% 6 ,536 Detective 94.08 309 13 66.95 7.0% 441 Captain 144.32 309 13 66.95 1.0% 97 Total, review a report $ 7,074 Begin an investigation: Deputy Sheriff $ 82.81 309 41 2 11.15 91.0% 15,912 Sergeant 106.12 309 41 2 11.15 0.5% 112 Detective 94.08 309 41 2 11.15 0.5% 99 Captain 144.32 309 41 2 11.15 1.0% 305 Service Specialist 38.96 309 41 2 11.15 7.0% 576 Total, begin an investigation $ 17,004 Total allowable salary and benefit costs $ 38,594 We performed similar calculations for each fiscal year of the audit period. -20- San Bernardino County Identity Theft Program Allowable related indirect costs The county claimed $1,552,134 in related indirect costs. We found that $224,378 is allowable and $1,327,756 is unallowable. The county used the indirect cost rates from the Indirect Cost Rate Proposals it prepared for each year of the audit period to claim indirect costs. Unallowable indirect costs are directly related to the previously identified unallowable salaries and benefits for each year of the audit period. The following table summarizes the claimed and allowable amounts of indirect costs, and the audit adjustment by fiscal year: Fiscal Related indirect costs Year Claimed Allowable Adjustment 2002-03 $ 155,125 $ 24,543 $ ( 130,582) 2003-04 139,508 20,965 (118,543) 2004-05 180,010 27,142 (152,868) 2005-06 148,187 20,874 (127,313) 2006-07 151,980 21,727 (130,253) 2007-08 169,398 27,743 (141,655) 2008-09 137,936 20,596 (117,340) 2009-10 114,412 15,770 (98,642) 2010-11 109,328 14,215 (95,113) 2011-12 121,863 16,468 (105,395) 2012-13 124,386 14,335 (110,051) $ 1,552,134 $ 2 24,378 $ (1,327,756) Criteria Item 1 of Section III., “Period of Reimbursement,” of the parameters and guidelines states, “Actual costs for one fiscal year shall be included in each claim.” Section IV., “Reimbursable Activities,” of the parameters and guidelines begins: To be eligible for mandated cost reimbursement for any given fiscal year, only actual costs may be claimed. Actual costs are those costs actually incurred to implement the mandated activities. Actual costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the reimbursable activities. A source document is a document created at or near the same time the actual cost was incurred for the event or activity in question. Source documents may include, but are not limited to, employee time records or time logs, sign-in sheets, invoices, and receipts. Section IV., “Reimbursable Activities,” of the parameters and guidelines also states: For each eligible claimant, the following ongoing activities are eligible for reimbursement: 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and -21- San Bernardino County Identity Theft Program for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed online by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. Section V.A.1, “Salaries and Benefits,” of the parameters and guidelines states: Report each employee implementing the reimbursable activities by name, job classification, and productive hourly rate (total wages and related benefits divided by productive hours). Describe the specific reimbursable activities performed and the hours devoted to each reimbursable activity performed. Section V.II., “Offsetting Revenues and Reimbursements,” of the parameters and guidelines states: Any offsets the claimant experiences in the same program as a result of the same statutes or executive orders found to contain the mandate shall be deducted from the costs claimed. In addition, reimbursement for this mandate received from any federal, state, or non-local source shall be identified and deducted from this claim. Recommendation The California State Legislature suspended the Identity Theft Program in the FY 2013-14 through FY 2021-22 Budget Acts. If the program becomes active again, we recommend that the county:  Adhere to the program’s parameters and guidelines and claiming instructions when claiming reimbursement for mandated costs; and  Ensure that claimed costs include only eligible costs, are based on actual costs, and are properly supported. County’s Response We have reviewed the State Controller’s Office draft audit report for the above-mandated program dated March 2, 2022. The County review has been completed and we concur with the findings and recommendations proposed in the Identity Theft Program draft audit for the period of July 1, 2002 through June 30, 2013. Due to the amount of time that has elapsed between occurrence of the claimed reimbursable activities and the audit period (spanning up to 19 years), the County is unable to provide any additional supporting documentation. Had the field audit been performed closer to the actual -22- San Bernardino County Identity Theft Program cost incurrence period, responsible claim preparation staff (who are retired or no longer employed) could have provided a much better response to audit inquiries, which would have resulted in favorable results for San Bernardino County. SCO’s Comment The county states that it could have provided additional supporting documentation, had the audit been performed closer to the time period in which the reimbursable activities were performed. We would first point out that the county filed its claims for the first 11 years of the 12-year audit period on January 30, 2013. Except for documentation supporting the time increments claimed to perform the reimbursable activities, lack of supporting documentation was not the primary cause of the unallowable costs. Instead, the initial 74% reduction in Identity Theft cases claimed (from 18,572 cases claimed to 4,864 cases) was the primary cause of the unallowable costs. As explained in the finding, we reduced the number of allowable cases because the county had claimed costs for taking police reports and beginning investigations for identity theft cases originating within its contract cities. As the county’s contracting partners had already reimbursed the county for these costs, the costs were not reimbursable for the purposes of a State-mandated cost claim. -23- San Bernardino County Identity Theft Program Attachment— County’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S21-MCC-0004R