File County of Riverside Office of the Auditor-controller*

Lack of Manpower Sworn testimony heard by the Grand Jury revealed that nine of the scheduled internal audits for FY 2010/2011 were not completed due to a lack of manpower and/or due to the fact that they were not mandated. Only one of these audits was carried over to the FY 2011/2012 Internal Audit Plan. Two of the internal audits in the FY 2010/2011 plan were prompted by employee complaints via the Countywide "Speak Out!" program that focuses on fraud, waste, and abuse. A "Speak Out!" complaint, concerning the excessive use of overtime in the Sheriff's Department, prompted an investigative audit to be scheduled in FY 2010/2011. This audit, along with eight other scheduled audits, was eventually cancelled for either lack of manpower or because they were not mandated. It is the considered judgment of this Grand Jury that because it is law, lack of manpower is not an excuse for failure to perform these audits. Further, no concern about this failure has been expressed by the County Executive Office, Board, or the Auditor- Controller's Office. The decision to cancel planned audits due to lack of manpower or because they are not mandated may be construed as a disservice to the taxpayers, as well as the Board and department directors. ACO Response to Finding 1: Respondent disagrees partially with the finding. The FY2010/11 Audit Plan was prepared and approved by the previous administration. The previous administration also approved the layoff plan for the division. Structural attrition added to the decline in personnel. The recruitment process has been lengthy due to the fact that qualified internal auditors are difficult to recruit because of the workforce shortage in the profession and the higher pay in the private sector. The finding that the Auditor-Controller's Office is not concerned is unfair and not true. The Auditor- Controller has made a tremendous effort in this area, hiring a new Chief Auditor, two Senior Internal Auditors, two independent firms and several temporary employees to meet the mission in FY2012. Also, numerous recruitments were made to find qualified auditors. This has been made difficult by the higher pay provided in the private sector. However, the Internal Audits Division at the end of fiscal year 2012 completed twenty-six audits, as we stated we would do. The amount of audits completed were seven more than called for in the Grand Jury 2004 report. The audits not completed in FY 2011/12 were determined not to meet the qualifications of a mandated audit and would not result in material risk to the County if postponed. Grand Jury Recommendation 1: It is important that taxpayers know that County departments are managed without a waste of resources, especially during years where revenues have been seriously reduced. The Board must fund and authorize staffing levels commensurate with the tasks required by Board Resolution 83- 338 and California Government Code §25250. The increased manpower must be provided in the FY 2012-2013 budget. In the interim, the Audit Division must prioritize tasks and reinstate the eight audits that were canceled due to lack of manpower or not mandated. The Board and the Auditor-Controller must use whatever resources are necessary to comply with the California Government Code. ACO Response to Recommendation 1: The Recommendation requires further analysis. Auditor-Controller's management is currently evaluating and restructuring the Internal Audits Division. The Executive Office has increased Internal Audits FY2013 budget, allowing for more auditors. A Division Chief and two Senior Internal Auditors have been recently hired and the recruitment process is in progress to fill an additional four Senior Internal Auditor positions as soon as possible. Again, the recruitment process has been lengthy due to the fact that qualified internal auditors are difficult to recruit because of the workforce shortage in the profession and the higher pay in the private sector. It should also be noted that past practice was to count follow-up audits and additional follow-up audits as meeting mandated requirements. This is not an accurate assessment. There is a difference between a baseline audit, which the Code requires, and follow-up audits which are ancillary to the baseline audit. In regards to the eight cancelled audits, the Chief Internal Auditor will evaluate to determine the necessity of reinstating the audits that were canceled due to lack of auditors. This evaluation will be completed by the Chief Internal Auditor by October 31, 2012.

Special Districts Another function of the Audit Division is to ensure that all special districts in the County receive an annual financial audit. These audits are usually performed by public accounting firms. The Government Accounting Standards Board Statement No. 34 requires the inclusion of a Management Discussion and Analysis, which is a simple explanation of the results of the audit that can be easily understood. The Audit Division monitors and reviews these financial statements to ensure that they are conducted as required by Government Code §26909(a) and §6505(d). The Audit Division is not proactively pursuing delinquent audits of special districts, thereby placing at risk the fiduciary responsibility of these special district boards that are accountable to the taxpayers. The Audit Division has failed to review these special district audits in depth and ensure that recommended corrective actions were taken within a reasonable time frame. This results in the Auditor-Controller having no positive influence on the financial practices of special districts, a deficiency with unknown consequences. Certain special districts have been habitually delinquent, as much as two to five years, in conducting their mandated annual audits. In the case of one special district, Idyllwild Fire Protection District, the Management Discussion and Analysis was omitted from the report to the Audit Division at the request of the special district board. This omission violates Government Accounting Standard Board Statement No. 34, the rights of taxpayers to know the financial status of their district. The Audit Division's present procedures require that reminder letters be sent to all special district that are delinquent beyond twelve months after the end of the fiscal year. The timing of these letters, in effect, grants the delinquent special district an additional six months beyond the due date mandated by Government Code §26909(a)(2) and §6505(d). ACO Response to Finding 2: Respondent disagrees partially with the finding. Under the new administration, Internal Audits proactively pursues delinquent audits of Special Districts (Districts). Letters requesting audited financial statements are issued to all Districts 30 days prior to the end of the fiscal year. The office issues delinquent letters after 30 days and 60 days of not receiving audited financial statements from noncompliant Districts. However, despite our efforts to have Districts comply with legal requirements, there were 2 of 125 Districts which were noncompliant. These Districts lack the financial resources to pay for an independent audit. In an effort to have full compliance, we have implemented other procedures for noncompliant Districts. This involves conducting audits using the State Controller's Office Minimum Audit Requirements or an independent accounting firm will be hired to conduct the audit. It is standard procedure under this administration that Internal Audits Division conduct a due diligence review of all submitted financial statements of the Districts. Follow up of corrective actions stated in the financial statements is the responsibility of the District's management and the accounting firm conducting the audits. Adverse opinions or a disclaimer of opinion will be immediately reported to the Board of Supervisors for further action. Grand Jury Recommendation 2: The Audit Division must accelerate issuance of reminder letters by initiating the first letter within six months after the end of the fiscal year. The second reminder shall be mailed in April and the final reminder shall be sent no later than June 15. This change in procedure would assure taxpayers that special districts serving them are in compliance with the requirements of California Government Code §26909(a)(2) and §6505(d). The Auditor-Controller must review submitted audits from special districts and take the initiative to ensure that special district boards are taking corrective action on disclosed financial and performance deficiencies. ACO Response to Recommendation 2: The recommendation has been implemented. As stated above, letters requesting audited financial statements are issued to all districts 30 days prior to the end of the fiscal year. The office issues delinquent letters after 30 days and 60 days of not receiving audited financial statements from noncompliant districts. It is standard procedure under this administration that Internal Audits conduct a due diligence review of all submitted financial statements of the Districts. Follow up of corrective actions stated in the financial statements is the responsibility of the District's management and the accounting firm conducting the audits. Adverse opinions or a disclaimer of opinion will be immediately reported to the Board of Supervisors for further action. Our written procedures have been updated to ensure Management Discussion & Analysis reports are included in the audited financial statements.

Policies and Procedures The Audit Division is operating with a draft copy of its policies and procedures, a document that has been dormant, in draft stage since July 2009. This deficiency was previously noted in a peer review report by the San Diego Auditor-Controller's Office in 2006. When an internal audit of a County department is initiated by the Audit Division, the first request is that the department provide a copy of its policies and procedures. If they are non-existent, it becomes a major finding. ACO Response to Finding 3: Respondent disagrees wholly with the finding. To be clear, there is no such thing as a "major" finding in auditing or accounting since the term has been deemed to have misleading connotations. Professionally accepted terminology is "material" or "immaterial" and each of these concepts has a very specific meaning. The Audit Manual version presently used by the Division was written in 2007. Reviewing and updating the Audit Manual will be completed in the near future due to its level of complexity. In the interim, the policies and procedures promulgated by the Institute of Internal Auditors' Professional Practices Framework— the professional standards setting organization—remain and are adhered to by the Internal Audits Division. Grand Jury Recommendation 3: The Auditor-Controller must immediately finalize policies and procedures to guide the internal audit activity. ACO Response to Recommendation 3: Respondent disagrees partially with the finding. Updating the Internal Audit Manual is an on-going project. Current revisions and updates will be finalized with a target date of February 2013. The policies and procedures promulgated by the Institute of Internal Auditors' Professional Practices Framework— the professional standards setting organization—remain and are adhered to by the Internal Audits Division.

Operational Review In July 2011, the Auditor-Controller retained IntelliBridge Partners, an outside consulting firm, to perform an operational review of the Audit Division. The purpose of the review was to assess the County's efficiency and effectiveness in audit planning, execution, and reporting process, as well as to examine the Audit Division's organizational structure. This review was produced at a cost of $38,000. It was similar to content and recommendations to the peer review assessment of 2006 conducted by the San Diego Auditor-Controller's Office. The peer review cost nothing. The contracted consulting firm recommended: Working with the Board to revise Resolution 83-338 from auditing each County department every two years to auditing County departments based upon risk-based management criteria (e.g., high risks of fraud, waste, abuse or having a high potential to identify cost savings, or to enhance service delivery.) Hiring an audit chief executive from outside of the County that has experience in conducting all types of audits (e.g., internal, financial, performance, and compliance) and has a demonstrated track record of working with key stakeholders to produce cost savings and enhance service deliver. (Note: The Auditor-Controller did not follow this recommendation.) • Developing a comprehensive internal training program for all staff and new hires. (Note: IntelliBridge Partners that made the recommendation has now secured the contract to perform this training program.) · Conducting a form Countywide risk assessment that identifies potential opportunities for cost savings, enhancements to service delivery, and increased compliance with local, state and federal requirements. (Note: IntelliBridge Partners made the recommendation and has now secured the contract to perform the Countywide risk assessment under a new contract.) A request for proposal by the County was issued in 2011, (Internal Audit Risk Assessment Services RFP# ACARC-010), to conduct an internal audit risk assessment and to develop templates for enhanced reporting. IntelliBridge Partners performed the operational review and was selected to conduct the Countywide risk assessment and training that the firm had just recommended. Cost of this contract was $71,700. ACO Response to Finding 4: Respondent disagrees wholly with the finding. Immediately upon taking office it became apparent that a complete independent assessment of the Internal Audit Division was needed. Utilizing a Peer Review was not an option because of the need for immediate action. Also, the 2006 Peer Review was outdated. Best practice dictates that assessments be conducted every two-three years and Peer Reviews every five years. We have a new Peer Review starting on August 30, 2012. IntelliBridge Partners was selected in an open selection process available to all qualified parties. To ensure competition, the Auditor-Controller's Office proactively contacted numerous firms to advise them of the RFQ. Several firms declined to participate because of the low value of the contract. IntelliBridge Partners was selected as the lowest bidder. Grand Jury Recommendation 4: The Board and the Auditor-Controller must recognize that the July 2011, IntelliBridge Partners review was faulty in recommending that the Auditor-Controller work with the Board to replace Resolution 83-338. This resolution was passed to comply with California Government Code §25250, which mandates County departments be audited biennially. This policy delegates the mandated audit authority to the Auditor-Controller. The Auditor-Controller's Office, using only the risk assessment methodology proposed by IntelliBridge Partners, would be ignoring the biennial requirement of California law. The Board must reject this methodology. ACO Response to Recommendation 4: Respondent disagrees wholly with the finding. It is generally accepted best practice to focus audit resources on areas with the highest risk of fraud, waste and abuse. State law does not address this very critical issue. The audit risk assessment is intended to be used only as a tool to identify areas of concern by determining the level of associated risk. These areas might have otherwise gone unnoticed without the assessment. The Auditor-Controller's Office has never taken a position on changing current law and works to meet state law as promulgated.

"Speak Out!" Program Prior to September, 2009 the County lacked a fraud policy and hotline. Such a policy is required by the American Institute of Certified Public Accountants (The Institute) and California Government Code §53087.6. The Institute issued two statements on Auditing Standards SAS99 and SAS115, which mandate the need to establish a fraud hotline. These requirements were noted as significant deficiencies by outside auditors in management letters in the years 2005 through 2008. As a result, in September 2009, Board Policy C-35 "Standards of Ethical Conduct" was adopted, which requires County employees to sign acknowledging receipt. This policy includes a program entitled "Speak Out!" which encourages County employees to report anonymously, if desired, any incident of fraud, waste, abuse, and other workplace incidents. This program could prompt an investigative audit of operations that might expose deficiencies in internal control, material weaknesses, and significant deficiencies. (In one instance it already has prompted an investigation.) Sworn testimony to the Grand Jury revealed that reports received from County employees through "Speak Out!" had targeted two departments for wasteful usage of overtime. As a result, these departments were included in the FY 2010-2011 Audit Plan. Only one of these two audits was completed in November 2010, the aforementioned audit of overtime in the Department of Mental Health. The second scheduled audit involved potential overtime abuses in the Sheriff's Department. This investigative audit was canceled due to lack of manpower or because it was not mandated by government code. It is the considered judgment of this Grand Jury that if either situation exists, the importance of asking County employees to identify fraud, waste, and abuse in County departments is negated. ACO Response to Finding 5: Respondent agrees with the finding. It is the intent of the Auditor-Controller's Office to administer the "Speak Out!" program as effectively as possible to identify and investigate any fraud, waste, or abuse. The Chief Internal Auditor will conduct an evaluation of the potential overtime abuses in the Sheriff's Department to determine the necessity of conducting the canceled audit. This evaluation will be completed by the Chief Internal Auditor by October 31, 2012. Grand Jury Recommendation 5: The Auditor-Controller must perform investigative audits which are in the annual audit plan initiated by "Speak Out!" complaints. ACO Response to Recommendation 5: The recommendation has been implemented. The Internal Audit Division has revised their policies and procedures to ensure the performance of investigative audits which are in the annual audit plan initiated by "Speak Out!" complaints are completed in a timely manner.

Deficiencies Sworn testimony given to the Grand Jury, as well as written documentation, were replete with issues involving Audit Division management: Lack of training for auditors, • Turnover of personnel, · Tardiness of audits, • Insufficient number of auditors to cover Countywide obligations, Auditors burdened with non-auditing responsibilities, and Audit Division intimidating work environment. ACO Response to Finding 6: Respondent disagrees partially with the finding. Internal Audits is under new leadership and is in the process of restructuring to improve efficiency, morale and service delivery. The senior manager overseeing day-to-day operations of the Division when the complaints were made was removed as a result of the complaints. It should be noted however that holding staff accountable under a higher standard is challenging even under the best of circumstances. It should also be noted that the Grand Jury Report is based on complaints of employees who quit or were laid off due to budget cuts approved by the previous administration. Furthermore, prior to the issuance of the Grand Jury Report the organization was in the process of developing a training program. Thus far staff has been provided live seminars, on-site training, as well as webinar training. However, staff members are expected to have appropriate skill sets as these are professional classifications. Grand Jury Recommendation 6: Due to the seriousness of deficiencies in the Audit Division, the Board must immediately direct the Executive Office and Human Resources Department to form a special management committee to assess the scope and depth of the deficiencies and construct the means to eliminate or mitigate the potential damage. ACO Response to Recommendation 6: The recommendation will not be implemented because it is not warranted or is not reasonable. The new Auditor-Controller has set a higher standard of performance. It should come as no surprise that some employees may take issue with being held accountable. It should be noted however that holding staff accountable under a higher standard is challenging even under the best of circumstances. To assist in meeting higher standards we are in the process of developing a training program. Thus far staff has been provided live seminars, on-site training, as well as webinar training. However, staff is expected to have appropriate skill sets as these are professional classifications. The Internal Audit Division will use the analysis presented in the operational review conducted in July 2011, the Peer Review to be conducted August-September 2012, and Grand Jury suggestions to correct any deficiencies noted. Therefore, we believe a new special committee is a waste of taxpayer dollars.