Internal Controls in the County of Santa Barbara

Conclusions 15

• CL1
  Knowledge of financial management and risks by managers in some departments in the County of Santa Barbara is insufficient.
• CL2
  The Internal Audit Division of the Santa Barbara County Auditor-Controller’s Office had a funded and filled staff of 10 FTE prior to the 2008 recession. Just prior to the discovery of the 2017 fraud, the funded staff had fallen to 5 FTE, and only 2.5 of those were filled.
• CL3
  The financial management guidelines issued by the County of Santa Barbara Auditor-Controller are not applied consistently in operational departments, nor is compliance with those guidelines routinely audited by the Auditor-Controller.
• CL4
  Knowledge of potential conflicts of interest among some senior County of Santa Barbara employees is inadequate.
• CL5
  There is no consistent policy of requiring program heads, division heads, or department heads within Santa Barbara County departments to account for spending under their control to their superiors and/or to the CEO through an annual formal and written statement.
• CL6
  The Jury found that the importance of the work of the Internal Audit Division within the Office of the Auditor-Controller and of internal controls generally has a low priority across County government.
• CL7
  It was stated by senior staff that a comprehensive investigation into the strengths and weaknesses of the internal controls in the County would be conducted by an outside consultant after the fraud; no such investigation took place.
• CL8
  The Jury found that the actions taken by Santa Barbara County management in response to the 2017 fraud in the Department of Public Works were slow and inadequate.
• CL9
  The Financial Information Network is an insufficient and inefficient system with many weaknesses that have caused most departments to create, or to have created, complementary financial software. Some of the weaknesses in FIN may have contributed to the 2017 Department of Public Works fraud.
• CL10
  The Jury found that minimum professional and academic qualifications for financial staff positions are not standardized nor consistent throughout departments in Santa Barbara County.
• CL11
  Some Santa Barbara County staff commented that there might be significant other potential financial risks in Santa Barbara County, including management of property tax reimbursements and warrant payments through the Sheriff’s Civil Bureau.
• CL12
  be procured competitively and should exclude any firm or individual that has previously worked with the County to avoid conflicts of interest;
• CL13
  compare major software options, analyze where such options have been used in governments of comparable size to the County; 2017-18 Santa Barbara County Grand Jury 9 INTERNAL CONTROLS IN THE COUNTY OF SANTA BARBARA
• CL14
  present a full analysis of the costs of and benefits of current financial management software used in the Auditor-Controller’s Office and throughout the County Government; and
• CL15
  give a proper comparison to the costs and benefits of Enterprise Resource Planning software.

Observations 28

• OB1
  There is no requirement for users to change their password. Many staff interviewed have never changed their password, despite working at the County for many years. As of the writing of this report, the Auditor-Controller’s Office has not updated FIN to require periodic changes of passwords, even after investigation of the 2017 DPW fraud suggested this may have been a key element that allowed the fraud.
• OB2
  Password requirements in FIN user accounts do not comply with the County’s IT policies. Passwords are weak, are not required to change often enough, and are easily stolen.
• OB3
  A key element that contributed to the fraud was the fact that there was no second approval (signature) required to create a temporary vendor number. A temporary vendor number is always 999999, which is assigned to a vendor, such as a consultant, supplying services to the County and is intended to be used for a single transaction; as such, there is no accumulation of payments by vendor.
• OB4
  There is no “Encumbrance” feature in FIN that allows tracking of amounts committed against available amounts for a given fund.
• OB5
  Almost every staff person interviewed listed as FIN’s biggest failing the lack of accounts payable and accounts receivable features. Departments have usually had to create and maintain their own accounts payable and/or accounts receivable software outside the FIN system.
• OB6
  A FIN session will never “time out.”
• OB7
  FIN does not allow for “fixed asset management.”
• OB8
  FIN lacks sufficient ability to run reports in real time.
• OB9
  FIN lacks “full payroll integration” (ability to run payroll timesheet data with corresponding fiscal information).
• OB10
  Staff in various County departments are unfamiliar with data recovery procedures in FIN and this unfamiliarity risks data loss, which may prevent the Auditor-Controller’s Office from fulfilling its fiduciary duties.
• OB11
  The Auditor-Controller has failed to implement a policy to manage upgrades in FIN. Upgrades are not consistently prepared, approved, documented or communicated to staff and these failures may put parts of the FIN network at risk.
• OB12
  The source code of FIN is not adequately protected and might be at risk of fraud.
• OB13
  A full and formal IT audit has never been done of the FIN.
• OB14
  Not all managers and staff currently using FIN are required to sign an annual financial disclosure. The Jury notes that many of the noted weaknesses of FIN result in costly duplications of efforts by staff in other departments. 2017-18 Santa Barbara County Grand Jury 4 INTERNAL CONTROLS IN THE COUNTY OF SANTA BARBARA Some staff observations concerning FIN were:
• OB15
  It’s “…an auditing system, not a budget system.”
• OB16
  “It’s structured for the Auditor-Controller’s Office to do the CAFR.”
• OB17
  Some program managers, division heads and other non-financial staff in the operational departments are not very well versed in FIN.
• OB18
  “FIN was supposed to save money, but does not.”
• OB19
  “FIN is really just a ‘check writing system’.”
• OB20
  “It’s hard to modify FIN for any department.” The Jury notes that the County has not contracted an independent evaluation of the benefits and costs of acquiring, installing and maintaining financial management software from a major vendor. Control Risks The 2017 DPW Fraud highlighted risks to public funds in the County of Santa Barbara. The Jury notes that many of these risks are inherent in the structure of public finance in the County, and others arise from specific management decisions, notably the continued use of the FIN system. Based on its review of relevant documents and on many interviews with elected and appointed officials of the County, the Jury found significant control risks in the County’s management of its financial resources. These risks occur from the failure of elected officials and department heads to promulgate, apply and integrate financial management guidelines and IT systems in a consistent and fully rigorous manner and to hold staff accountable in financial management. The Jury also learned from several interviewees that financial training and knowledge of some senior management in some divisions and/or departments was lacking, which creates financial risks, in that some did not fully understand the context and consequences of their actions. Additional risks were found in the following areas:
• OB21
  Applying the County’s financial guidelines, where the Jury found a failure to use the County’s financial rules in a consistent manner across the departments;
• OB22
  Reporting within the departmental and County-wide administration, which does not follow a policy of requiring annual formal and written statements for financial transactions;
• OB23
  Adequate knowledge of conflicts of interest among managers, some of whom were unaware of best practices in identifying and resolving conflicts of interest; and
• OB24
  Failing to quickly apply lessons learned from the DPW Fraud as noted later in this report. Potential Contributing Factors to the 2017 DPW Fraud The Jury notes that the following may have contributed to the 2017 DPW Fraud:
• OB25
  The Internal Audit Division of the Auditor-Controller’s Office was understaffed. Staffing had fallen from a high of ten full-time equivalent (FTE) positions before the 2008 Recession to five FTE positions, three of which were vacant at the time the fraud was discovered. In addition, although this division bears the day-to-day responsibility of auditing internal controls in other departments, several staff interviewed both within and outside the Auditor- Controller’s Office, told the Jury that, unlike in some other counties where internal auditors are “hired in,” it is a “training ground.” 2017-18 Santa Barbara County Grand Jury 5 INTERNAL CONTROLS IN THE COUNTY OF SANTA BARBARA
• OB26
  Every department in the County is expected to have its own system of internal controls. Although some staff in the different operational departments were familiar with the CA Guidelines and County guidelines and tried to follow them, others were not as familiar.
• OB27
  Although the Auditor-Controller’s Office has issued guidelines over the years, the Jury learned that some of the guidelines were not readily available, including an outdated document on countywide internal controls. The Auditor-Controller has not routinely audited operational departments for compliance.
• OB28
  Weaknesses in the Financial Information Network (FIN) may have contributed to the fraud. Risk Mitigation After the 2017 DPW Fraud In the fall of 2017, following the discovery of the fraud, the Jury was informed by several senior staff interviewed that an outside consultant would be hired to conduct “an in-depth investigation into the strengths and weaknesses” of the internal controls within the County. An outside consultant was hired. However, the report issued by the consultant was not an “in- depth investigation into the strengths and weaknesses” of the internal controls within the County. It was a report to determine the amount of the fraud for insurance purposes. The Jury notes that the BOS has never required staff to commission such an evaluation by an outside agent. The actions taken by County management in response to the 2017 fraud in the Department of Public Works were slow. Staff members were not required to change FIN passwords, temporary vendor numbers are still used even if there has been more than one transaction with the entity, and paper checks are still often used in place of ACH (Automated Clearing House) transfers, increasing the risk of theft or loss. The Jury notes that several actions have occurred since the 2017 DPW Fraud and the subsequent Loss Analysis. These include, but are not limited to, quarterly meetings by the Auditor-Controller with the chief financial officers of the departments, and the issuance of an “Internal Controls Policy.” In addition, DPW has given internal control training to its entire accounting staff, and DPW accounting supervisors and managers attended a webinar training on fraud and internal controls. Other Observations Several staff interviewed were not familiar with the definition of “conflict of interest” and/or could not recall an example of a conflict of interest in their career. The Jury notes based on its interviews with County staff that they believe the Internal Audit Division has a low priority with the County Executive Office and the BOS.

Agency Responses 5

Government agencies' official responses to this report's findings and recommendations. Click on a response to see the structured breakdown.

No Responses Found 2

Government entities assigned to respond to this report. No response documents have been linked in our database.