All bodies  ›  State Controller's Office  ›  City of Fresno

SCO

City of Fresno

Identity Theft

State Controller's Office · 2023-08-cab-mcc-itp_cityoffresno · Mandated program · 2023-08-08 · City of Fresno

Read the report at City of Fresno ↗

CITY OF FRESNO Audit Report IDENTITY THEFT PROGRAM Chapter 956, Statutes of 2000 July 1, 2002, through June 30, 2013 M M. C ALIA OHEN California State Controller August 2023 MALIA M. COHEN CALIFORNIA STATE CONTROLLER August 8, 2023 CERTIFIED MAIL—RETURN RECEIPT REQUESTED Santino Danisi, Finance Director City of Fresno 2600 Fresno Street, Room 2156 Fresno, CA 93721 Dear Mr. Danisi: The State Controller’s Office audited the costs claimed by the City of Fresno for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. The city claimed $1,705,283 for costs of the mandated program. Our audit found that $833,480 is allowable; and $871,803 is unallowable, primarily because the city overstated the number of identity theft reports and overstated its indirect cost rates. The State made no payments to the city. The State will pay $833,480, contingent upon available appropriations. Following issuance of this audit report, the Local Government Programs and Services Division of the State Controller’s Office will notify the city of the adjustment to its claims via a system- generated letter for each fiscal year in the audit period. This final audit report contains an adjustment to costs claimed by the city. If you disagree with the audit finding, you may file an Incorrect Reduction Claim (IRC) with the Commission on State Mandates (Commission). Pursuant to the Commission’s regulations, outlined in Title 2, California Code of Regulations, section 1185.1, subdivision (c), an IRC challenging this adjustment must be filed with the Commission no later than three years following the date of this report, regardless of whether this report is subsequently supplemented, superseded, or otherwise amended. IRC information is available on the Commission’s website at www.csm.ca.gov/forms/IRCForm.pdf. If you have any questions, please contact Lisa Kurokawa, Chief, Compliance Audits Bureau, by telephone at (916) 327-3138. Sincerely, Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits 300 Capitol Mall, Suite 1850, Sacramento, CA 95814 | P.O. Box 942850, Sacramento, CA 94250 | Fax: 916.322.4404 sco.ca.gov Mr. Santino Danisi August 8, 2023 Page 2 of 2 KT/rs cc: The Honorable Jerry P. Dyer, Mayor City of Fresno Chris Hill, Principal Program Budget Analyst Local Government Unit California Department of Finance Ted Doan, Finance Budget Analyst Local Government Unit California Department of Finance Darryl Mar, Manager Local Reimbursements Section State Controller’s Office Everett Luc, Supervisor Local Reimbursements Section State Controller’s Office 300 Capitol Mall, Suite 1850, Sacramento, CA 95814 | P.O. Box 942850, Sacramento, CA 94250 | Fax: 916.322.4404 sco.ca.gov City of Fresno Identity Theft Program Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority .................................................................................................................. 2 Objective, Scope, and Methodology ................................................................................. 2 Conclusion .......................................................................................................................... 4 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Program Costs .............................................................................. 5 Finding and Recommendation .............................................................................................. 10 Attachment—City’s Response to Draft Audit Report City of Fresno Identity Theft Program Audit Report Summary The State Controller’s Office (SCO) audited the costs claimed by the City of Fresno for the legislatively mandated Identity Theft Program for the period of July 1, 2002, through June 30, 2013. The city claimed $1,705,283 for costs of the mandated program. Our audit found that $833,480 is allowable; and $871,803 is unallowable, primarily because the city overstated the number of identity theft reports and overstated its indirect cost rates. The State made no payments to the city. The State will pay $833,480, contingent upon available appropriations. Background Penal Code (PC) section 530.6(a), as added by the Statutes of 2000, Chapter 956, requires local law enforcement agencies to take a police report and begin an investigation when a complainant residing within their jurisdiction reports suspected identity theft. On March 27, 2009, the Commission of State Mandates (Commission) found that this legislation mandates a new program or higher level of service for local law enforcement agencies within the meaning of Article XIII B, section 6 of the California Constitution, and imposes costs mandated by the State pursuant to Government Code (GC) section 17514. The Commission determined that each claimant is allowed to claim and be reimbursed for the following ongoing activities identified in the parameters and guidelines (Section IV., “Reimbursable Activities”): 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5, which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed on-line by the identity theft victim. 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. The Commission also determined that providing a copy of the report to the complainant and referring the matter to the law enforcement agency in the jurisdiction where the suspected crime was committed for further investigation are not reimbursable activities. -1- City of Fresno Identity Theft Program The program’s parameters and guidelines establish the state mandate and define the reimbursement criteria. In compliance with GC section 17558, the SCO issues the Mandated Cost Manual for Local Agencies (Mandated Cost Manual) to assist local agencies in claiming mandated program reimbursable costs. Audit Authority We conducted this performance audit in accordance with GC sections 17558.5 and 17561, which authorize the SCO to audit the city’s records to verify the actual amount of the mandated costs. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. Objective, Scope, The objective of our audit was to determine whether claimed costs represent increased costs resulting from the legislatively mandated and Methodology Identity Theft Program. Specifically, we conducted this audit to determine whether costs claimed were supported by appropriate source documents, were not funded by another source, and were not unreasonable and/or excessive. Unreasonable and/or excessive costs include ineligible costs that are not identified in the parameters and guidelines as reimbursable costs. The audit period was July 1, 2002, through June 30, 2013. To achieve our objective, we performed the following procedures:  We analyzed the annual mandated cost claims filed by the city for the audit period and identified the significant cost components of each claim as salaries, benefits, and indirect costs. We determined whether there were any errors or unusual or unexpected variances from year to year. We also reviewed the activities claimed to determine whether they adhered to the SCO’s Mandated Cost Manual and the program’s parameters and guidelines.  We completed an internal control questionnaire by interviewing key city staff members. We discussed the claim preparation process with city staff members to determine what information was obtained, who obtained it, and how it was used.  We obtained system-generated lists of identity theft cases from the city’s records management system (RMS) to verify the existence, completeness, and accuracy of unduplicated case counts for each fiscal year in the audit period. We recalculated the costs based on the allowable number of cases for each of the reimbursable activities.  We calculated the time increments claimed for each year of the audit period by dividing the number of hours claimed per employee classification by the number of police reports claimed. Although the city did not provide any support for the time increments claimed, we accepted the claimed time increments as reasonable. -2- City of Fresno Identity Theft Program  We tested hourly rates for the Police Officer and Sergeant classifications using payroll information provided by the city for fiscal year (FY) 2010-11 through FY 2012-13. Using the information provided, we adjusted rates for two classifications, as described in the Finding and Recommendation section.  We designed a statistical sampling plan to test approximately 15-25% of claimed salary costs, based on a moderate level of detection (audit) risk. We judgmentally selected the city’s filed claims for FY 2010-11 through FY 2012-13, which included salary costs of $204,413, or 26.7% of the total $766,249 in salary costs claimed during the audit period. We describe the sampling plan in the Finding and Recommendation section.  We used a random number table to select 401 out of 3,766 identity theft reports from the three years sampled. We tested the identity theft reports as follows: o We determined whether a contemporaneously prepared and approved police report supported that a violation of PC section 530.5 had occurred. o We determined whether the initial police reports were courtesy reports that other law enforcement agencies had forwarded to the Fresno Police Department (FPD) for further investigation. o We determined whether the victim of identity theft had contacted the FPD to initiate the law enforcement investigation.  We projected the audit results of the three years tested, we multiplied the allowable case counts by the audited average time increments needed to perform the reimbursable activities, and multiplied the product by the weighted productive hourly rates (PHRs) of the city employees who performed them. Due to the homogeneity of the population, we applied the weighted three-year average error rate that we derived from testing our samples to the remaining eight years of the audit period.  We reviewed the city’s Single Audit Reports to identify any offsetting savings or reimbursements from federal or pass-through programs applicable to the Identity Theft Program. We did not identify any applicable offsetting revenues. The city also certified in its claims that it did not receive any offsetting revenues applicable to this mandated program. We did not audit the city’s financial statements. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. -3- City of Fresno Identity Theft Program Conclusion As a result of performing the audit procedures, we found instances of noncompliance with the requirements described in our audit objective. We did not find that the city claimed costs that were funded by other sources; however, we did find that it claimed unsupported and ineligible costs, as quantified in the Schedule and described in the Finding and Recommendation section of this audit report. For the audit period, the City of Fresno claimed $1,705,283 for costs of the legislatively mandated Identity Theft Program. Our audit found that $833,480 is allowable and $871,803 is unallowable. The State made no payments to the city. The State will pay $833,480, contingent upon available appropriations. Following issuance of this audit report, the SCO’s Local Government Programs and Services Division will notify the city of the adjustment to its claims via a system-generated letter for each fiscal year in the audit period. Follow-up on We have not previously conducted an audit of the City of Fresno’s legislatively mandated Identity Theft Program. Prior Audit Findings Views of We issued a draft audit report on May 10, 2023. The City of Fresno’s Responsible representative responded by letter dated May 18, 2023 disagreeing with the audit results. This final audit report includes the city’s response as an Officials attachment. Restricted Use This audit report is solely for the information and use of the City of Fresno, the California Department of Finance, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits August 8, 2023 -4- City of Fresno Identity Theft Program Schedule— Summary of Program Costs July 1, 2002, through June 30, 2013 Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2002, through June 30, 2003 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 23,541 $ 11,379 $ (12,162) Beginning an investigation of facts 24,102 1 1,596 ( 12,506) Total salaries 47,643 2 2,975 ( 24,668) Benefits 8,052 3,883 (4,169) Total direct costs 55,695 2 6,858 ( 28,837) Indirect costs 40,830 1 3,555 ( 27,275) Total program costs $ 96,525 4 0,413 $ (56,112) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 40,413 July 1, 2003, through June 30, 2004 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 24,450 $ 12,503 $ (11,947) Beginning an investigation of facts 25,505 1 3,016 ( 12,489) Total salaries 49,955 2 5,519 ( 24,436) Benefits 9,242 4,721 (4,521) Total direct costs 59,197 3 0,240 ( 28,957) Indirect costs 45,459 1 7,072 ( 28,387) Total program costs $ 1 04,656 4 7,312 $ (57,344) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 47,312 -5- City of Fresno Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2004, through June 30, 2005 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 29,911 $ 16,273 $ (13,638) Beginning an investigation of facts 31,299 1 6,878 ( 14,421) Total salaries 61,210 3 3,151 ( 28,059) Benefits 12,242 6,630 (5,612) Total direct costs 73,452 3 9,781 ( 33,671) Indirect costs 55,272 2 3,338 ( 31,934) Total program costs $ 1 28,724 6 3,119 $ (65,605) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 63,119 July 1, 2005, through June 30, 2006 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 34,931 $ 19,647 $ (15,284) Beginning an investigation of facts 36,366 2 0,460 ( 15,906) Total salaries 71,297 4 0,107 ( 31,190) Benefits 10,195 5,735 (4,460) Total direct costs 81,492 4 5,842 ( 35,650) Indirect costs 69,300 3 4,532 ( 34,768) Total program costs $ 1 50,792 8 0,374 $ (70,418) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 80,374 July 1, 2006, through June 30, 2007 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 37,933 $ 20,721 $ (17,212) Beginning an investigation of facts 39,335 2 1,482 ( 17,853) Total salaries 77,268 4 2,203 ( 35,065) Benefits 19,162 1 0 , 4 6 6 - (8,696) Total direct costs 96,430 5 2,669 ( 43,761) Indirect costs 71,627 2 6,968 ( 44,659) Total program costs $ 1 68,057 7 9,637 $ (88,420) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 79,637 -6- City of Fresno Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2007, through June 30, 2008 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 40,162 $ 24,442 $ (15,720) Beginning an investigation of facts 41,654 2 5,348 ( 16,306) Total salaries 81,816 4 9,790 ( 32,026) Benefits 21,272 1 2,945 (8,327) Total direct costs 103,088 6 2,735 ( 40,353) Indirect costs 76,825 3 4,206 ( 42,619) Total program costs $ 1 79,913 9 6,941 $ (82,972) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 96,941 July 1, 2008, through June 30, 2009 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 43,098 $ 25,891 $ (17,207) Beginning an investigation of facts 44,192 2 6,667 ( 17,525) Total salaries 87,290 5 2,558 ( 34,732) Benefits 21,124 1 2,719 (8,405) Total direct costs 108,414 6 5,277 ( 43,137) Indirect costs 76,640 3 7,448 ( 39,192) Total program costs $ 1 85,054 102,725 $ (82,329) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 102,725 July 1, 2009, through June 30, 2010 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 41,989 $ 21,697 $ (20,292) Beginning an investigation of facts 43,368 2 2,215 ( 21,153) Total salaries 85,357 4 3,912 ( 41,445) Benefits 24,753 1 2,734 ( 12,019) Total direct costs 110,110 5 6,646 ( 53,464) Indirect costs 68,968 3 2,319 ( 36,649) Total program costs $ 1 79,078 8 8,965 $ (90,113) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 88,965 -7- City of Fresno Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 July 1, 2010, through June 30, 2011 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 23,205 $ 12,203 $ (11,002) Reviewing online reports 7,333 4,667 (2,666) Beginning an investigation of facts 24,344 6,908 ( 17,436) Total salaries 54,882 2 3,778 ( 31,104) Benefits 21,404 9,273 ( 12,131) Total direct costs 76,286 3 3,051 ( 43,235) Indirect costs 66,187 2 4,729 ( 41,458) Total program costs $ 1 42,473 5 7,780 $ (84,693) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 57,780 July 1, 2011, through June 30, 2012 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 29,220 $ 15,783 $ (13,437) Reviewing online reports 7,280 4,421 (2,859) Beginning an investigation of facts 26,990 7,955 ( 19,035) Total salaries 63,490 2 8,159 ( 35,331) Benefits 29,269 1 2,981 ( 16,288) Total direct costs 92,759 4 1,140 ( 51,619) Indirect costs 65,077 2 5,118 ( 39,959) Total program costs $ 1 57,836 6 6,258 $ (91,578) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 66,258 July 1, 2012, through June 30, 2013 Direct costs: Salaries Taking a police report on a violation of PC § 530.5 $ 41,627 2 4,597 $ (17,030) Reviewing online reports 5,965 4,301 (1,664) Beginning an investigation of facts 38,449 1 5,691 ( 22,758) Total salaries 86,041 4 4,589 ( 41,452) Benefits 46,375 2 4,033 ( 22,342) Total direct costs 132,416 6 8,622 ( 63,794) Indirect costs 79,759 4 1,334 ( 38,425) Total program costs $ 2 12,175 109,956 $ (102,219) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 109,956 -8- City of Fresno Identity Theft Program Schedule (continued) Actual Costs Allowable Audit Cost Elements Claimed per Audit Adjustment1 Summary: July 1, 2002, through June 30, 2013 Direct costs: Salaries $ 7 66,249 $ 406,741 $ (359,508) Benefits 223,090 116,120 (106,970) Total direct costs 989,339 522,861 (466,478) Indirect costs 715,944 310,619 (405,325) Total program costs $ 1,705,283 833,480 $ (871,803) Less amount paid by the State2 - Allowable costs claimed in excess of amount paid $ 833,480 _________________________ 1 See the Finding and Recommendation section. 2 Payment amount current as of June 20, 2023. -9- City of Fresno Identity Theft Program Finding and Recommendation FINDING— The City of Fresno claimed $1,705,283 ($766,249 in salaries, $223,090 in related benefits, and $715,944 in related indirect costs) for the Identity Overstated Identity Theft Program. We found that $833,480 is allowable and $871,803 is Theft Program costs unallowable. The costs are unallowable because the city overstated the number of identity theft reports and overstated its indirect cost rates. The city used the correct methodology to calculate its salary costs. It multiplied the number of identity theft police reports by the time required to perform the reimbursable activities, and it multiplied the product by the weighted average PHRs of the city’s employee classifications that performed the reimbursable activities. The following table summarizes the claimed and allowable amounts, and the audit adjustments by fiscal year: Salaries Related Related Total Fiscal Amount Amount Audit Benefit Indirect Cost Audit Year Claimed Allowable Adjustment Adjustment Adjustment Adjustment 2002-03 $ 4 7,643 $ 22,975 $ ( 24,668) $ ( 4,169) $ (27,275) $ ( 56,112) 2003-04 4 9,955 25,519 ( 24,436) ( 4,521) (28,387) ( 57,344) 2004-05 6 1,210 33,151 ( 28,059) ( 5,612) (31,934) ( 65,605) 2005-06 7 1,297 40,107 ( 31,190) ( 4,460) (34,768) ( 70,418) 2006-07 7 7,268 42,203 ( 35,065) ( 8,696) (44,659) ( 88,420) 2007-08 8 1,816 49,790 ( 32,026) ( 8,327) (42,619) ( 82,972) 2008-09 8 7,290 52,558 ( 34,732) ( 8,405) (39,192) ( 82,329) 2009-10 8 5,357 43,912 ( 41,445) ( 12,019) (36,649) ( 90,113) 2010-11 5 4,882 23,778 ( 31,104) ( 12,131) (41,458) ( 84,693) 2011-12 6 3,490 28,159 ( 35,331) ( 16,288) (39,959) ( 91,578) 2012-13 8 6,041 44,589 ( 41,452) ( 22,342) (38,425) ( 102,219) Total $ 7 66,249 $ 406,741 $ ( 359,508) $ ( 106,970) $ (405,325) $ ( 871,803) Identity Theft Incident Reports The city stated in its claims that it took 20,309 identity theft incident reports—comprised of 2,283 online reports and 18,026 in-person reports—during the audit period. We found that the city overstated the number of reports taken by 8,888—8,079 of which were filed by FPD Officers, and 809 of which were filed online by citizens. -10- City of Fresno Identity Theft Program The following table summarizes the counts of claimed, supported, and allowable identity theft cases and the difference by fiscal year: Claimed Per RMS Allowable Audit Adjustment Fiscal Year In-person Online In-person Online In-person Online In-person Online 2002-03 1,380 n/a 788 n/a 664 n/a (716) n/a 2003-04 1,354 n/a 820 n/a 691 n/a (663) n/a 2004-05 1,647 n/a 1,063 n/a 896 n/a (751) n/a 2005-06 1,886 n/a 1,259 n/a 1,061 n/a (825) n/a 2006-07 2,040 n/a 1,321 n/a 1,114 n/a (926) n/a 2007-08 2,097 n/a 1,514 n/a 1,276 n/a (821) n/a 2008-09 2,181 n/a 1,561 n/a 1,316 n/a (865) n/a 2009-10 1,960 n/a 1,191 n/a 1,004 n/a (956) n/a 2010-11 959 821 606 5 19 505 519 (454) (302) 2011-12 1,024 794 615 4 77 536 477 (488) (317) 2012-13 1,498 668 1,071 4 78 884 478 (614) (190) Total 18,026 2,283 11,809 1 ,474 9,947 1,474 (8,079) (809) For each fiscal year, the city provided us with system-generated unduplicated lists from its RMS to support the claimed number of identity theft incident reports taken by the city. The RMS provides unduplicated counts of initial police reports filed for violations of PC section 530.5. The lists supported 13,286 identity theft police reports filed by the city during the audit period (11,812 in-person reports and 1,474 online reports). However, we found that three of the in-person reports were duplicates. Therefore, we determined that the city’s RMS supported 13,283 unduplicated police reports for violations of PC section 530.5 during the audit period (11,809 in-person and 1,474 online) We verified the accuracy of the unduplicated counts of initial in-person police reports by determining whether:  Each identity theft case is supported by a contemporaneously prepared and approved police report; and  The police report supported a violation of PC section 530.5. Our audit plan called for testing at least 25% of claimed costs. We selected FY 2010-11 through FY 2012-13 for testing purposes. Claimed salary costs for these three years totaled $204,413 ($54,882 in FY 2010-11, $63,490 in FY 2011-12, and $86,041 in FY 2012-13), which represents 26.7% of the $766,249 total claimed for salaries during the audit period. For the three years, we developed a statistical sampling plan and generated statistical samples of identity theft reports for the two procedures identified above so that we could project our sample results to the population of identity theft cases. We selected our statistical samples of identity theft cases based on a 95% confidence level, a sampling error of +/-8%, and an expected (true) error rate of 50%. We randomly selected 401 out of the 3,766 identity theft incident reports for review. Our review of the sampled incident reports disclosed the following:  For FY 2010-11, we found that 22 out of 132 identity theft incident reports were unallowable because: o Twelve in-person reports were courtesy reports originating from another police department; and -11- City of Fresno Identity Theft Program o Ten in-person reports did not meet the requirements of PC section 530.6(a), because the victim(s) of identity theft did not initiate the investigation by contacting the local law enforcement agency. Therefore, we calculated an error rate of 16.7% for FY 2010-11.  For FY 2011-12, we found that 17 out of 132 identity theft incident reports were unallowable because: o Fifteen in-person reports were courtesy reports originating from another police department; and o Two in-person reports did not meet the requirements of PC section 530.6(a), because the victim(s) of identity theft did not initiate the investigation by contacting the local law enforcement agency. Therefore, we calculated an error rate of 12.9% for FY 2011-12.  For FY 2012-13, we found that 24 out of 137 identity theft incident reports were unallowable because: o Eighteen in-person reports were courtesy reports originating from another police department; and o Six in-person reports did not meet the requirements of PC section 530.6(a), because the victim(s) of identity theft did not initiate the investigation by contacting the local law enforcement agency. Therefore, we calculated an error rate of 17.5% for FY 2012-13. Using these testing results for FY 2010-11 through FY 2012-13, we calculated an average error rate of 15.7% applicable to in-person reports. We applied the average error rate to the untested years of FY 2002-03 through FY 2009-10, and applied the actual audited error rate to the other fiscal years to determine the allowable and unallowable number of incident reports taken. The following table shows the average error rates for FY 2010-11 through FY 2012-13: (A) (B) (C)=(A)÷(B) Number of Unallowable Fiscal Cases Sample Year Sampled Size Error Rate 2010-11 22 1 32 16.70% 2011-12 17 1 32 12.90% 2012-13 24 1 37 17.50% Total 47.10% Number of fiscal years sampled ÷ 3 Average error rate 15.70% We extrapolated the average error rate to the audited population of in- person reports for FY 2002-03 through FY 2009-10, and applied the actual -12- City of Fresno Identity Theft Program audited error rate for each of the other fiscal years to determine the allowable and unallowable number of incident reports taken. The following table shows the number of allowable and unallowable incident reports by fiscal year: (A) (B) (C) (D)=(A)×(C) (E)=(A)+(B)-(C) Audited Audited Average Total Fiscal Population In- Population Error Error Unallowable Total Allowable Year Person Online Rate Rate Reports Reports 2002-03 788 N/A N/A 15.70% 124 664 2003-04 820 N/A N/A 15.70% 129 691 2004-05 1,063 N/A N/A 15.70% 167 896 2005-06 1,259 N/A N/A 15.70% 198 1,061 2006-07 1,321 N/A N/A 15.70% 207 1,114 2007-08 1,514 N/A N/A 15.70% 238 1,276 2008-09 1,561 N/A N/A 15.70% 245 1,316 2009-10 1,191 N/A N/A 15.70% 187 1,004 2010-11 606 519 16.70% N/A 101 1,024 2011-12 615 477 12.90% N/A 79 1,013 2012-13 1,071 478 17.50% N/A 187 1,362 Total 11,809 1,474 1,862 1 1,421 Time increments The parameters and guidelines identify the following reimbursable activities:  Activity 1a – Taking a police report on a violation of PC section 530.5;  Activity 1b – Reviewing an online identity theft report completed by a victim; and  Activity 2 – Beginning an investigation. The parameters and guidelines specify that Activity 1a includes “drafting, reviewing, and editing the identity theft police report.” For convenience, we divided Activity 1a into Activity 1a.1, taking a police report; and Activity 1a.2, reviewing, editing, and approving a police report. The city claimed hours spent by FPD sworn officers who performed the following reimbursable activities during the audit period:  Taking a police report (Activity 1a.1);  Reviewing, editing, and approving a police report (Activity 1a.2);  Reviewing an online identity theft report completed by a victim (Activity 1b); and  Beginning an investigation (Activity 2). To calculate the claimed time increments for each year of the audit period, we divided the number of hours claimed per employee classification by the number of police reports claimed. Although the city did not provide any support for the time increments claimed, we determined that the claimed time increments were reasonable. -13- City of Fresno Identity Theft Program The following table summarizes the total time increments claimed and allowable for the reimbursable activities by fiscal year: Claimed and Allowable Minutes 1a.1 1a.2 1b 2 Taking a Reviewing Reviewing Beginning Police a Police an Online an Fiscal Year Report Report Report Investigation 2002-03 3 1.39 2.88 - 3 2.31 2003-04 3 1.39 2.88 - 3 2.31 2004-05 3 1.39 2.88 - 3 2.31 2005-06 3 1.37 2.88 - 3 2.31 2006-07 3 1.39 2.88 - 3 2.31 2007-08 3 1.38 2.88 - 3 2.31 2008-09 3 1.39 2.88 - 3 2.31 2009-10 3 1.39 2.88 - 3 2.31 2010-11 3 1.39 2.88 10.00 1 7.41 2011-12 3 2.44 2.88 10.00 1 8.20 2012-13 3 1.39 2.88 10.00 2 2.50 Productive Hourly Rates The city stated in its claims that Police Officers performed Activity 1a – taking a police report on a violation of PC section 530.5 for all years of the audit period, and that Community Service Officers assisted during FY 2002-03 through FY 2010-11. The city stated in its claims that Sergeants performed Activity 1a.2 – reviewing, editing, and approving a police report for all years of the audit period. The city also stated in its claims that Police Officers performed Activity 2 – beginning an investigation for FY 2002-03 through FY 2012-13. Based on discussions with FPD representatives during the audit, we confirmed that Police Officers and Community Service Officers took police reports and that Sergeants reviewed the reports, while Police Officers began investigations. The city provided the requested salary information for all FPD employee classifications by fiscal year. We used this information to determine allowable PHRs for all years of the audit period. We recalculated the PHRs using the base salary data provided by the city. We used these recalculated rates as the allowable PHRs. We found the following discrepancies in claimed PHRs:  FY 2002-03 – $17.93 claimed for Community Service Officers versus a calculated PHR of $18.51;  FY 2003-04 – $41.50 claimed for Sergeants versus a calculated PHR of $42.17;  FY 2004-05 – $41.11 claimed for Sergeants versus a calculated PHR of $43.59;  FY 2004-05 – $35.29 claimed for Police Officers versus a calculated PHR of $34.98;  FY 2008-09 – $21.60 claimed for Community Service Officers versus a calculated PHR of $20.89; -14- City of Fresno Identity Theft Program  FY 2009-10 – $51.70 claimed for Sergeants versus a calculated PHR of $49.40;  FY 2009-10 – $21.60 claimed for Community Service Officers versus a calculated PHR of $23.84;  FY 2010-11 – $21.60 claimed for Community Service Officers versus a calculated PHR of $21.04;  FY 2010-11 – $60.04 claimed for Sergeants versus a calculated PHR of $60.78;  FY 2011-12 – $61.15 claimed for Sergeants versus a calculated PHR of $62.30; and  FY 2012-13 – $59.57 claimed for Sergeants versus a calculated PHR of $60.32. The following table summarizes the PHRs claimed and allowable for the audit period: PHRs Claimed PHRs Allowable Community Community Fiscal Police Service Police Service Year Officer Officer Sergeant Officer Officer Sergeant 2002-03 $ 32.43 $ 17.93 $ 41.50 $ 32.43 $ 1 8.51 $ 41.50 2003-04 3 4.98 1 7.93 4 1.50 3 4.98 17.93 4 2.17 2004-05 3 5.29 17.93 4 1.11 34.98 17.93 4 3.59 2005-06 3 5.81 19.14 4 1.11 35.81 19.14 41.11 2006-07 3 5.81 19.70 4 1.11 35.81 19.70 41.11 2007-08 3 6.89 20.27 4 2.35 36.89 20.27 42.35 2008-09 3 7.63 21.60 4 5.37 37.63 20.89 45.37 2009-10 4 1.09 21.60 5 1.70 41.09 23.84 49.40 2010-11 4 7.14 21.60 6 0.04 47.14 21.04 60.78 2011-12 4 8.93 - 6 1.15 48.93 - 62.30 2012-13 4 7.65 - 5 9.57 47.65 - 60.32 We used the allowable PHRs, the corrected number of case counts, and the claimed time increments to calculate allowable salaries for each fiscal year of the audit period. For example, the following table shows the calculation of allowable salary costs for FY 2009-10: [2] [3] [4] [5] [6] [7] Allowable Costs Time ($) Employee Number Increment Total Minutes Total Hours PHR (cols. Classification of Cases (Minutes) (cols. [2] * [3]) (col. [4] ÷ 60) ($) [5]*[6] Community Service Officer 1,004 7 .85 7,881 131.36 $ 23.84 $ 3 ,131 Police Officer 1,004 2 3.54 23,634 393.90 41.09 1 6,185 Sergeant 1,004 2 .88 2,892 48.19 49.40 2 ,381 Police Officer 1,004 3 2.31 32,439 540.65 41.09 2 2,215 $ 4 3,912 -15- City of Fresno Identity Theft Program Unallowable related employee benefits The city claimed a total of $223,090 in employee benefit costs during the audit period. We determined that $116,120 is allowable and $106,970 is unallowable. The costs are unallowable because the city claimed unallowable salaries. Benefit costs are determined by multiplying each year’s allowable salary costs by each year’s benefit rate. Employee benefits related to the allowable salaries identified above are also allowable. The city provided benefit rate information from its payroll system for sworn and non-sworn personnel for each fiscal year of the audit period. We determined that the claimed employee benefit rates were calculated correctly and used this information to recalculate allowable employee benefit costs. The following table summarizes the claimed, allowable, and audit adjustment amounts for employee benefit costs by fiscal year: Allowable Fiscal Allowable Claimed Benefit Claimed Allowable Audit Year Salaries B enefit Rate Rates Benefit Costs Benefit Costs Adjustment 2002-03 $ 2 2,975 16.90% 16.90% $ 8,052 $ 3,883 $ ( 4,169) 2003-04 25,519 18.50% 18.50% 9,241 $ 4,721 (4,520) 2004-05 33,151 20.00% 20.00% 12,242 $ 6,630 (5,612) 2005-06 40,107 14.30% 14.30% 10,195 $ 5,735 (4,460) 2006-07 42,203 24.80% 24.80% 19,162 $ 10,466 (8,696) 2007-08 49,790 26.00% 26.00% 21,272 $ 12,945 (8,327) 2008-09 52,558 24.20% 24.20% 21,124 $ 12,719 (8,405) 2009-10 43,912 29.00% 29.00% 24,754 $ 12,734 ( 12,020) 2010-11 23,778 39.00% 39.00% 21,404 $ 9,273 ( 12,131) 2011-12 28,159 46.10% 46.10% 29,269 $ 12,981 ( 16,288) 2012-13 44,589 53.90% 53.90% 46,375 $ 24,033 ( 22,342) Total $ 406,741 $ 2 23,090 $ 1 16,120 $ (106,970) Unallowable related indirect costs The city claimed a total of $715,944 in indirect costs based on direct salaries claimed during the audit period. We found that $310,619 is allowable and $405,325 is unallowable. The costs are unallowable because the city claimed unallowable salaries and overstated indirect cost rates. To recalculate indirect costs, we applied the allowable indirect cost rates to the corresponding eligible direct costs. We previously audited the city’s FY 2002-03 through FY 2011-12 indirect cost rate proposals for the FPD in our audit of the city’s claims filed under the Crime Statistics Reports for the Department of Justice Program. We issued that report on December 30, 2016. We did not adjust the claimed rate for FY 2012-13; we recalculated indirect costs for this audit using the previously audited indirect cost rates. -16- City of Fresno Identity Theft Program The following table summarizes the claimed, allowable and audit adjustments for indirect costs by fiscal year: Fiscal Claimed Allowable Related indirect costs Year Rate Rate Claimed Allowable Adjustment 2002-03 85.70% 59.00% $ 4 0,830 $ 13,555 $ ( 27,275) 2003-04 91.00% 66.90% 45,459 1 7,072 (28,387) 2004-05 90.30% 70.40% 55,272 2 3,338 (31,934) 2005-06 97.20% 86.10% 69,300 3 4,532 (34,768) 2006-07 92.70% 63.90% 71,627 2 6,968 (44,659) 2007-08 93.90% 68.70% 76,825 3 4,206 (42,619) 2008-09 87.80% 71.25% 76,640 3 7,448 (39,192) 2009-10 80.80% 73.60% 68,968 3 2,319 (36,649) 2010-11 120.60% 104.00% 66,187 2 4,729 (41,458) 2011-12 102.50% 89.20% 65,077 2 5,118 (39,959) 2012-13 92.70% 92.70% 79,759 4 1,334 (38,425) $ 715,944 $ 310,619 $ (405,325) Criteria Item 1 of Section III., “Period of Reimbursement,” of the parameters and guidelines states, “Actual costs for one fiscal year shall be included in each claim.” Section IV., “Reimbursable Activities,” of the parameters and guidelines begins: To be eligible for mandated cost reimbursement for any given fiscal year, only actual costs may be claimed. Actual costs are those costs actually incurred to implement the mandated activities. Actual costs must be traceable to and supported by source documents that show the validity of such costs, when they were incurred, and their relationship to the reimbursable activities. A source document is a document created at or near the same time the actual cost was incurred for the event or activity in question. Source documents may include, but are not limited to, employee time records or time logs, sign-in sheet, invoices, and receipts. Section IV. of the parameters and guidelines continues: . . . For each eligible claimant, the following ongoing activities are eligible for reimbursement: 1. Either a) or b) below: a) Take a police report supporting a violation of Penal Code section 530.5, which includes information regarding the personal identifying information involved and any uses of that personal information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information. This activity includes drafting, reviewing, and editing the identity theft police report; or b) Reviewing the identity theft report completed on-line by the identity theft victim. -17- City of Fresno Identity Theft Program 2. Begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. The purpose of the investigation is to assist the victims in clearing their names. Reimbursement is not required to complete the investigation for purposes of criminal prosecution. Providing a copy of the report to the complainant is not reimbursable under this program. . . . Section V.A.1, “Salaries and Benefits,” of the parameters and guidelines states: Report each employee implementing the reimbursable activities by name, job classification, and productive hourly rate (total wages and related benefits divided by productive hours). Describe the specific reimbursable activities performed and the hours devoted to these activities. Section V.B., “Indirect Cost Rates,” of the parameters and guidelines begins: Indirect costs are costs that are incurred for a common or joint purpose, benefiting more than one program, and are not directly assignable to a particular department or program without efforts disproportionate to the result achieved. Indirect costs may include: (1) the overhead costs of the unit performing the mandate; and (2) the costs of the central government services distributed to the other departments based on a systematic and rational basis through a cost allocation plan. Recommendation The State Legislature suspended the Identity Theft Program in the FY 2013-14 through FY 2022-23 Budget Acts. If the program becomes active again, we recommend that the city:  Adhere to the program’s parameters and guidelines and the SCO’s Mandated Cost Manual when claiming reimbursement for mandated costs; and  Ensure that claimed costs include only eligible costs, are based on actual costs, and are properly supported. City’s Response One aspect of the audit that we would like to contest is the exclusion of valid Identity Theft cases. Fresno Police Department Policy states that an officer can only use one crime code when they document a crime, even though multiple charges apply. Identity Theft is one of those crimes in which the report can be titled with multiple crime codes. Staff must use the crime code that has the highest Bureau of Crime Statistics (BCS) level. There can be over a dozen possible charges that could be Identity Theft cases. Examples of these charges include cases involving PC sections 484e (Using Account Information), 484f (Forgery), 484g (Theft by Fraud), 470 (Forging a signature), 470d (false check), 476 (fictitious check), and 528 (false representation) etc. -18- City of Fresno Identity Theft Program BCS was the Bureau of Criminal Statistics, or old Uniform Crime Reporting format. California Incident Based Reporting System (CIBRS) is now being used which is the California version of National Incident Based Reporting System (NIBRS). The difference between them is that BCS used a hierarchical system for crime reporting and CIBRS counts all of them. When we sent Mr. Venneman a sampling of these case reports where Penal Code 530.5 was not the primary violation code, he acknowledged that, “I went through every one of those reports and read through what the Officers wrote. And, yes, I agree with you that some of the cases comply with the first criteria of the Identity Theft Program, which is that a victim of Identity Theft contacted their local Police Department to initiate an investigation in order to clear their name.” His agreement that there are indeed valid Identity Theft cases that did not use PC 530.5 as the primary arrest code should be enough evidence to justify further review of our cases to determine which of those did indeed comply with the parameters. Our record tracking system has the ability to query reports based on crime code (PC Section) as well as on key words in the narrative descriptions. In order to determine the number of eligible ID Theft cases from the cases that were tagged with other related crime codes, our Financial Crimes Sergeant at the time (Sgt. Flores) physically pulled and read over 800 or over 24% of all potential cases in 2011. The same labor- intensive process was repeated in the following years. From this review we determined which cases and the percentage of cases complied with the Parameters and Guideline eligible activity to: “take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places where the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information.” The cases claimed were verified to ensure the report generated by the officer also fully established the elements of identity theft (PC §530.5) were met. For instance, the suspect(s) goes on a shopping spree with the victim’s credit/debit cards (PC §484g), writes unauthorized checks using the victim’s personal identifying information (PC §470), and attempts to open credit cards using the victim’s personal information (PC §530.5). The original offense selected may be a PC §459, despite several other violations occurring. It is up to the individual officer to select the primary charge at the time they are writing the original report. This process is explained in the attached document entitled Claiming Methodology. The contemporaneously prepared report narratives should be adequate evidence to prove that the cases in question did indeed comply with the parameters of this Identity Theft program, as Mr. Venneman ascertained when he reviewed a sampling of reports provided. While it would be ideal if cases were coded in the manner that Mr. Venneman desires and contends in his Tuesday, April 11, 2023 12:39 PM email as a necessary “criterion” in order to obtain reimbursement; unfortunately, that is not how law enforcement cases are recorded when multiple violation codes are involved. -19- City of Fresno Identity Theft Program This “criteria” (that for a case to be eligible, it must have been coded with a 530.5 as the primary violation code) is not a reasonable requirement nor is it supported by the Parameters and Guidelines. If it was necessary for local agencies to code their cases with a primary crime code of 530.5, despite other higher BSC violations being identified in the same case, then this should have been explicitly stated in the claiming instructions. Requiring specific documentation after the fact violates the principles of Due Process. We would be happy to work with you to provide additional documentation to prove that the cases we claimed did in fact meet the criteria of this mandate. SCO Comment Our finding and recommendation remain unchanged. Page 11 of the Statement of Decision for the mandated Identity Theft Program states: . . . the Commission finds that when a victim of identity theft initiates a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over his or her actual residence, [Penal Code] section 530.6, subdivision (a), as added by Statutes 2000, chapter 956 requires local law enforcement agencies to undertake the following state- mandated activities:  take a police report supporting a violation of Penal Code section 530.5 which includes information regarding the personal identifying information involved and any uses of that personal identifying information that were non-consensual and for an unlawful purpose, including, if available, information surrounding the suspected identity theft, places were the crime(s) occurred, and how and where the suspect obtained and used the personal identifying information;  provide the complainant with an actual copy of that report; and,  begin an investigation of the facts, including the gathering of facts sufficient to determine where the crime(s) occurred and what pieces of personal identifying information were used for an unlawful purpose. We reviewed the requirements of the parameters and guidelines during the audit. Accordingly, we requested that the city provide us with unduplicated lists of law enforcement cases supporting violations of PC section 530.5 that occurred during the audit period. The city provided system-generated Excel spreadsheets documenting police reports listed by incident (case) numbers for PC section 530.5 violations that originated within the city during the audit period. Although the city claimed that it took 20,309 police reports for PC section 530.5 violations, the lists that it provided supported only 13,286 PC section 530.5 violations. The city did not explain what Penal Code section violations it cited in the other 7,023 police reports; nor did it provide a reconciliation of how it arrived at 20,309 reimbursable police reports. As described in the audit report, our further testing showed that 11,421 of the 13,286 reports were allowable and 1,862 were unallowable. We first notified the city of these results on January 19, 2023. -20- City of Fresno Identity Theft Program Over the next several months, we corresponded with the city’s Finance Director. During that time and in the city’s response, the Finance Director requested that we consider police reports for violations of Penal Code sections that are not cited in the parameters and guidelines. In these cases, victims first contacted the FPD to report crimes that, although they were not reported as violations of PC section 530.5, involved the unlawful use of personal identifying information. The reports described crimes including forgery and counterfeiting (PC sections 470, 470[d], and 476), larceny (PC sections 484e, 484f, 484g), and false representation (PC section 528). The city provided, and we subsequently reviewed, 12 reports taken by FPD Officers for these crimes. Eleven of the reports appear to satisfy the first element of the Identity Theft Program, in that a victim of identity theft initiated a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over his or her actual residence. The crime described in the other report did not satisfy the first element of the Identity Theft Program. Although the 11 reports appear to describe violations of PC section 530.5, none of the reports were filed under that section. The parameters and guidelines clearly state that the reimbursable activities include taking a police report “supporting a violation of Penal Code section 530.5”; to support that such a violation occurred, a police report must be filed under PC section 530.5. The city’s response states that it is not reasonable to require that a police report use “530.5” as the primary crime code in order to be allowable under the mandated program. However, we explained to the Finance Director that we are not law enforcement professionals, and do not have the expertise to second-guess the crime codes used in police reports. Furthermore, the city’s suggestion that the existence of identity theft cases in reports without crime code 530.5 justifies further review of the FPD’s cases represents a request that we review thousands of police reports filed during the audit period under various Penal Code violations to determine whether these reports could have been filed under PC section 530.5. The mandated program does not require us to verify that crime codes are correct, to interpret crime codes, or to re-classify reports that do not use crime code 530.5 as “supporting a violation of Penal Code 530.5” and therefore allowable. The city’s response states that FPD policy limits a Police Officer to use only one crime code per report, even if a report documents multiple charges. FPD staff are required to use the crime code that is assigned the highest priority by the BCS. The city did not provide any documentation supporting guidance provided to FPD Officers to assist them in determining the proper hierarchy of law violations when preparing a police report. Therefore, the determination of which violation has the highest priority appears to be discretionary on the part of the FPD. Our audit showed that 13,826 police reports filed during the audit period identified PC section 530.5 as the highest-level violation, and we used that number of police reports to determine the allowable costs. -21- City of Fresno Identity Theft Program The test claimant for this mandated program argued that PC section 530.6(a), which requires further activities pursuant to PC section 530.5, was a state-mandated activity. The Commission agreed and adopted its Statement of Decision on March 27, 2009. We do not find any evidence in the Statement of Decision that violations of other Penal Code sections require state-mandated activities, nor does the Statement of Decision indicate that the Commission considered other Penal Code sections for the possibility of requiring state-mandated activities. Neither the test claimant nor any other interested party suggested that violations of PC section 530.5 might go unreported because the coding used in law enforcement reporting systems assigns higher priority to other sections of the State’s Penal Code. If the city believes that it has a valid case, it can file an Incorrect Reduction Claim with the Commission and have the matter adjudicated. -22- City of Fresno Identity Theft Program Attachment— City’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S22-MCC-0002