County Fraud Hotline - Does it Work?*

Procedures of the Orange County Internal Audit Department for processing calls to the Fraud Hotline still exist only in a draft form dating from 1997. Response: Agrees with finding The draft procedures were available and being followed by all staff except for being dated and signed. Internal Audit Department (IAD) has now finalized the Fraud Hotline procedures by dating and signing the procedures.

A designated person within the IAD staffs the Fraud Hotline during business hours. Many after-hour calls are not processed because callers do not leave adequate information for investigation. Response: Agrees with finding The IAD is meeting with County Executive Office (CEO) - Telephone/Network Related Services to enhance the after-hour caller options to obtain adequate information for investigation.

Most calls to the Fraud Hotline are redirected to another department or agency. Response: Disagrees partially with finding The IAD has met with other agencies about their established hotlines. Each hotline has its own distinct purpose and function to best serve the caller with their specific needs. IAD is working with the CEO - Telephone/Network Related Services to enhance the options available by telephone to best guide the caller to the appropriate hotline.

Many reference telephone numbers used by the IAD are incorrect, and telephone number verification processes are not in place. Response: Agrees with finding A procedure has been incorporated in our written Fraud Hotline procedures to annually validate the reference numbers as well as to ask the caller to call back if the reference number was incorrect. Exhibit 2 5. Although posters were initially provided to county agencies and departments, few of the posters are currently displayed and many county employees are not aware of the Hotline. There is no publicity program to enhance public awareness. Response: Agrees with finding The IAD will partner with the County Executive Office – Employee Relations (CEO/ER), Human Resources Department (HR), County Executive Office - Information Technology Office (CEO/IT) and other agencies to develop an outreach program and send out new posters to enhance public awareness. Additionally, the IAD does have a Controlled Self- Assessment process where information is given to participants about the County Hotline.

Inform Orange County employees of the existence of the Fraud Hotline by redistributing posters to all agencies and departments. Place and maintain additional posters in county public-announcement areas, e.g., Board of Supervisors' bulletin boards at the Hall of Administration. Send a quarterly internal e-mail to all employees explaining the purpose of the Hotline. Contact the employee organizations and request that they provide quarterly information about the County Fraud Hotline in their communications to employees. (Finding 5) Response: The recommendation has not been implemented, but will be implemented in the future The IAD is in the process of updating the Fraud Hotline poster by meeting with the CEO/ER, HR and County Counsel. After the poster is updated and printed, the IAD will redistribute the posters to all County agencies and departments and employees. In addition, IAD will partner with the CEO/ER to develop a process for e-mailing all employees annual information about the purpose of the Hotline and we have requested the CEO/ER contact information of the various employee organizations and will request that they provide quarterly information about the County Fraud Hotline in their communications to employees. In addition, information regarding the different hotlines will be included in a separate page in the County Telephone Directory as part of an enhanced outreach program.

Orange County Intranet, which is for internal use only, provides no information regarding the Fraud Hotline. Response: Agrees with Finding The IAD is working with CEO/IT to provide information on the County Internet and Intranet sites about the Fraud Hotline. Additionally, it should be noted the Intranet site also houses the Internal Audit Department website where there is reference to the County Fraud Hotline.

Orange County Office of Risk Management, the District Attorney and the IAD all operate hotlines, yet those three organizations do not coordinate their systems. Response: Disagrees partially with finding Internal Audit Response: The stated agencies each have hotline numbers and systems and communication does occur between departments to address specific types of complaints in accordance with statutory requirements. The IAD Fraud Hotline is designed to address instances of waste, fraud or abuse of County resources. It is not designed to receive and process consumer fraud, welfare fraud, MediCal fraud and other such specialized concerns. When the IAD Fraud Hotline receives such calls, that caller is referred to the appropriate organization, which includes CEO/Risk Management and the District Attorney. CEO/Risk Management Response: While each hotline has its own mission and function, communication has been exchanged on a case specific basis between the departments operating different hotlines to insure complete and timely responses or inquires.

The Fraud Hotline's Procedures Manual assures anonymity for callers but docs not address protection of callers from retaliation. Exhibit 2 Response: Agrees with finding The IAD has met with County Counsel, HR and CEO/ER to develop language to address protection of callers from retaliation and update the Fraud Hotline procedures. The language will specifically address retaliation, however, if it is determined that a County employee filed a complaint in bad faith, said employee may be subject to appropriate disciplinary action. This prohibition against retaliation is in addition to the protections contained in California Labor Code §1102.5, and any amendment thereto. Response to Recommendations: 1. Finalize and issue the operating procedures for the Fraud Hotline. (Finding 1) Response: The recommendation has been implemented The IAD has finalized the Fraud Hotline procedures that include the provisions of Finding 4 and 8 by dating and signing the procedures.