Auditor-Controller Response to the Fy 2007-2008 Grand Jury Report entitled: Controls Self-assessment Program Restart*

A tri-annual Department Internal Control Self-Assessment Program was initiated by the A-C and the CEO in February 2004. The current CSA requires every department to be responsible for reviewing its internal controls, determining risk areas within its operations, and strengthening its internal control structure. Response: Partially agree in that the CSA Program was first initiated in February 2004. However, good business practice, not the CSA, requires departments/agencies to review internal controls, determine risk areas, and strengthen the internal control structure. The CSA Program serves as a reminder of these department responsibilities and provides guidelines for departments to consider in their ongoing assessment of internal controls. The CSA Program also provides a mechanism for departments to report on the status of internal controls and the basis for the Auditor-Controller to evaluate the condition of internal controls throughout the County. Also, as a matter of clarification, the Grand Jury's use of the term "tri-annual" may imply a program initiated three times a year. The CSA is a triennial program (i.e. the program is initiated once every 3 years.)

The CSA is primarily focused on financial controls versus operational controls. Response: Respectfully disagree. Certainly, financial controls are fundamental to the County's internal control structure. The Department Internal Control Questionnaire, which was provided to departments to use a starting point for evaluating internal controls, focuses on financial controls because of the fundamental nature of these controls. In addition, financial operations are often based on common internal control areas, such as cash, accounts payable, etc., which lend themselves to common questions. However, the questionnaire represents only one tool for departments to use in assessing internal controls. Departments were instructed to perform a risk assessment of all significant operations, which may then lead to an assessment of operational controls as well.

A risk assessment is an outcome of the CSA. The A-C is responsible for conducting a county-wide risk assessment of all agencies and departments. Response: Partially agree. There are several risk assessments conducted for different purposes. We conduct an annual countywide risk assessment in connection with the development of the annual Audit Plan. In addition, during our validations of departments' CSA responses, we may find that some departments do not assess risks on a regular basis; therefore, the required risk assessment could be considered "an outcome of the CSA." However, for departments to meet the ongoing responsibility of assessing internal controls as discussed in our response to F-01 above, risk assessments must be performed periodically by departments. In addition, the risk assessment process is more of an input to the CSA process, rather than an outcome. Departments were instructed to perform a risk assessment before evaluating internal controls, to identify control activities needed to mitigate specific risks.

CEO Program Management Analysts participate in both entrance and exit interviews on departmental audits. Response: Respectfully disagree. Although we welcome Program Management Analysts (PMAs) to attend audit entrance and exit conferences, this office cannot recall one instance where a PMA attended a meeting for an internal audit.

In order to improve the CSA, audit procedures now provide for staff auditors to meet with agency and department staff to provide guidance and implementation assistance and to help identify areas of potential financial exposure. Responses: Disagree. Staff auditors meet with departments to provide guidance and help identify areas of exposure. However, such audit procedures have always been part of the Internal Audit Division. These procedures have not "now" been implemented, as suggested by the finding.

The Treasurer-Tax Collector will participate in the mandatory 2007 CSA using the 2004 CSA questionnaire completed in January 2007 (and the Public Administrator/Public Guardian questionnaire was completed in February, 2007) in conjunction with extensive external audits. Response: Agree. However, clarification is necessary to explain that, although the Treasurer-Tax Collector used the 2004 Questionnaire, the Treasurer-Tax Collector will be expected to meet all new requirements set forth in the 2007 CSA Program. In addition, the Treasurer-Tax Collector is audited frequently with internal audits as well as external audits. C-05: CSA responses to the A-C were not timely. Due dates were widely missed. Response: Partially disagree. While responses were not always timely, departments in general were receptive to the CSA Program in concept. Given that the CSA is a relatively new program, some learning curve is to be expected. Although we agree that the majority of confirmations due on July 31, 2007 were late, the vast majority of departments submitted their completed assessments by the due date of October 31, 2007. Therefore, the conclusion by the Grand Jury that "CSA responses to the A-C were not timely" and "Due dates were widely missed" mischaracterizes the general responsiveness of County management.