📋
Extraído del Informe Consolidado

Esta investigación fue publicada originalmente como parte de un informe consolidado más amplio que contiene múltiples investigaciones. Consulte el PDF consolidado para ver el documento completo.

Riverside County Grand Jury • 2021-2022

Riverside County

Published: May 26, 2022 26 pages
View PDF View Full Original

Findings and Recommendations 12 findings

F1
California Government Code §25250 requires counties to audit their departments every two- years. The ACO's use of "Follow-Up" and "Change of Department Head" audits to fulfill this legal requirement violates California law. Supported by Facts 1.1 and 3.1
Related Recommendations (2)
R2
By January 1, 2024, the Board adopt a policy that requires internal audit plans to audit all departments every two-years with an emphasis on high-risk financial and operational topics. Based on Findings 1, 5, and 7 Financial Impact - Minimal
R6
By January 1, 2024, the Board adopt a policy that requires the ACO to (a) indicate severity of risks identified in internal audit reports, (b) the amount of time departments have to reduce or eliminate those risks, and (c) when follow-up internal audits will occur. Based on Findings 3, 5, 8, and 9 Financial Impact - Minimal Recommendation 7 By January 1, 2024, the Board adopt a policy that requires the ACO to include the status of departments implementing required corrective actions in its follow-up audit reports. Based on Finding 9 Financial Impact - Minimal to Moderate Recommendation 8 By January 1, 2024, the Board adopt a policy that requires the ACO to provide them with the following types of reports: Bi-Annual Systemic Internal Audit Findings Reports • Annual Risk Assessment and Management Plan • Quarterly Internal Audit Status Reports • Contract Monitoring Reports Countywide Risk Management Dashboard Based on Findings 1, 3, 5, 7, 8, 9, 10, and 11 Financial Impact - Minimal to Moderate Recommendation 9 By January 1, 2024, the Board adopt a policy that requires internal audit findings be included in all department leaders' annual performance reviews. Based on Findings 3, 5, 9, and 11 Financial Impact - Minimal Recommendation 10 By January 1, 2024, the Board adopt a policy that establishes a Countywide Risk Management Dashboard. Based on Findings 3, 4, 6, 7, 8, 9, 10, and 11 Financial Impact - Moderate to Significant Depending on Implementation 22
F2
Professional Standard 1100 requires the Internal Audit Unit be independent. With the Internal Audit Unit included within the ACO's "Audits and Specialized Accounting Division," the Internal Audit Unit is not completely independent. Hence, the ACO is not complying with Standard 1100. Supported by Fact 2.1
Related Recommendations (2)
R11
By January 1, 2024, the County evaluate the financial compensation it provides internal auditors working within the ACO and take the necessary actions to achieve the following: Competitive financial compensation packages for each internal audit job • classification level. Enhanced compensation for internal auditors with a "Certified Internal Audit" • certification. Enhanced compensation for internal auditors with additional professional • certifications in Information Technology and fraud detection. Update Job Descriptions to include Enhanced compensation for Professional • Certifications Based on Findings 4, 5, and 6 Financial Impact – Moderate to Significant Depending on Implementation Recommendation 12 By July 1, 2023, the ACO divide the Audits and Specialized Accounting Division into two divisions: (1) "Audits" Division and (2) "Specialized Accounting" Division. Based on Finding 2 Financial Impact - Minimal
R13
By January 1, 2024, the Board adopt a policy that requires the ACO to review and update the internal audit charter to be in full compliance with the Standards. Based on Findings 2 and 12 Financial Impact - Minimal LEGALLY REQUIRED RESPONSES According to California Penal Code §933 (c), the following responses are required : Riverside County: Board of Supervisors Recommendations 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, and 13 Riverside County: County Executive Officer Recommendations 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 Riverside County Auditor Controller Recommendations 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 23
F3
The County's internal audits are marginalized and, in many cases, just ignored. Supported by Facts 3.5, 3.6, 3.7, 3.8, and 3.9
Related Recommendations (2)
R5
By January 1, 2024, the Board adopt a policy that establishes procedures to resolve disputed internal audit findings between the ACO and department/agency directors. Based on Findings 3, 5, 11, and 12 Financial Impact - Minimal
R6
By January 1, 2024, the Board adopt a policy that requires the ACO to (a) indicate severity of risks identified in internal audit reports, (b) the amount of time departments have to reduce or eliminate those risks, and (c) when follow-up internal audits will occur. Based on Findings 3, 5, 8, and 9 Financial Impact - Minimal Recommendation 7 By January 1, 2024, the Board adopt a policy that requires the ACO to include the status of departments implementing required corrective actions in its follow-up audit reports. Based on Finding 9 Financial Impact - Minimal to Moderate Recommendation 8 By January 1, 2024, the Board adopt a policy that requires the ACO to provide them with the following types of reports: Bi-Annual Systemic Internal Audit Findings Reports • Annual Risk Assessment and Management Plan • Quarterly Internal Audit Status Reports • Contract Monitoring Reports Countywide Risk Management Dashboard Based on Findings 1, 3, 5, 7, 8, 9, 10, and 11 Financial Impact - Minimal to Moderate Recommendation 9 By January 1, 2024, the Board adopt a policy that requires internal audit findings be included in all department leaders' annual performance reviews. Based on Findings 3, 5, 9, and 11 Financial Impact - Minimal Recommendation 10 By January 1, 2024, the Board adopt a policy that establishes a Countywide Risk Management Dashboard. Based on Findings 3, 4, 6, 7, 8, 9, 10, and 11 Financial Impact - Moderate to Significant Depending on Implementation 22
F4
The County's Internal Audit Unit members do not have the combined knowledge, skill, and experience to perform their responsibilities as required by Standard 1210. Supported by Facts 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, and 3.2
Related Recommendations (2)
R4
By January 1, 2024, the Board adopt a policy that requires the ACO to have at least one internal auditor with a Certified Fraud Examiner and at least one internal auditor with expertise in Information Technology. Based on Findings 4 and 6 Financial Impact - Moderate to Significant Depending on Implementation 21
R11
By January 1, 2024, the County evaluate the financial compensation it provides internal auditors working within the ACO and take the necessary actions to achieve the following: Competitive financial compensation packages for each internal audit job • classification level. Enhanced compensation for internal auditors with a "Certified Internal Audit" • certification. Enhanced compensation for internal auditors with additional professional • certifications in Information Technology and fraud detection. Update Job Descriptions to include Enhanced compensation for Professional • Certifications Based on Findings 4, 5, and 6 Financial Impact – Moderate to Significant Depending on Implementation Recommendation 12 By July 1, 2023, the ACO divide the Audits and Specialized Accounting Division into two divisions: (1) "Audits" Division and (2) "Specialized Accounting" Division. Based on Finding 2 Financial Impact - Minimal
F5
The County consistently fails to rectify known limitations in its Internal Audit Unit. Supported by Facts 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, and 2.10
No recommendations for this finding
F6
The County's Internal Audit Unit members lack professional certifications and experience in critical areas, which in turns exposes the County to potential financial and operational risks. Supported by Facts 2.9, 2.10, 3.3, and 3.4
No recommendations for this finding
F7
The County's lack of an audit oversight committee has resulted in some high-risk areas missed by internal audits for several years. Supported by Facts 1.4, 1.5, 2.9, 2.10, 3.3, 3.4, and 3.10
Related Recommendations (2)
R1
By January 1, 2024, the Board adopt a policy establishing an Audit Oversight Committee with membership drawn from the Board, Executive Office, ACO, Risk Management Steering Committee, private sector, and all five supervisor districts. Based on Finding 7 Financial Impact - Minimal
R3
By January 1, 2024, the Board adopt a policy that requires the ACO to conduct any internal or external audit at the discretion of the Board and/or Executive Office regardless if the topic appears on an approved annual audit plan or not. Based on Finding 7, 8, 9, 10, and 11 Financial Impact – Minimal
F8
The County's internal audit reports do not provide the Board and Executive Office with (a) summary information about the seriousness of its findings, (b) likelihood of negative impacts to the County, or (c) how quickly corrections need to be made. Supported by Fact 3.10 19
No recommendations for this finding
F9
The County's follow-up internal audit reports do not provide the Board and Executive Office with summary information on the status of departments implementing required corrective actions. Supported by Fact 3.11
Related Recommendations (1)
R6
By January 1, 2024, the Board adopt a policy that requires the ACO to (a) indicate severity of risks identified in internal audit reports, (b) the amount of time departments have to reduce or eliminate those risks, and (c) when follow-up internal audits will occur. Based on Findings 3, 5, 8, and 9 Financial Impact - Minimal Recommendation 7 By January 1, 2024, the Board adopt a policy that requires the ACO to include the status of departments implementing required corrective actions in its follow-up audit reports. Based on Finding 9 Financial Impact - Minimal to Moderate Recommendation 8 By January 1, 2024, the Board adopt a policy that requires the ACO to provide them with the following types of reports: Bi-Annual Systemic Internal Audit Findings Reports • Annual Risk Assessment and Management Plan • Quarterly Internal Audit Status Reports • Contract Monitoring Reports Countywide Risk Management Dashboard Based on Findings 1, 3, 5, 7, 8, 9, 10, and 11 Financial Impact - Minimal to Moderate Recommendation 9 By January 1, 2024, the Board adopt a policy that requires internal audit findings be included in all department leaders' annual performance reviews. Based on Findings 3, 5, 9, and 11 Financial Impact - Minimal Recommendation 10 By January 1, 2024, the Board adopt a policy that establishes a Countywide Risk Management Dashboard. Based on Findings 3, 4, 6, 7, 8, 9, 10, and 11 Financial Impact - Moderate to Significant Depending on Implementation 22
F10
The County lacks summary reports and a monitoring mechanism that provides the Board and Executive Office with the following types of reports: Bi-Annual Systemic Internal Audit Findings Reports • Annual Risk Assessment and Management Plan • Quarterly Internal Audit Status Reports . Contract Monitoring Reports . Countywide Risk Management Dashboard • Supported by Facts 1.2, 1.5, 3.8, 3.9, 3.11, 3.12, and 3.13
No recommendations for this finding
F11
An internal audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility, including access to confidential records. The County's internal audit charter has not been updated in 39 years. The County's internal charter is outdated and does not comply with Standard 1010. Supported by Fact 1.3
No recommendations for this finding
F12
Dysfunctional working relationships among County and department leaders significantly hinders the effectiveness of internal audits. Supported by Facts 3.8, 3.9, 3.11, 3.12, and 3.13 DISCUSSION Governmental agencies that strive for excellence engage in two general activities: (1) actively seek ways to assess their current effectiveness to provide services to their constituents and (2) aggressively take steps to improve. Their attitude is to continuously improve and not settle for the status quo. Riverside County has the opportunity to transform its current use of internal audits from primarily ignored to highly effective tools to monitor compliance with financial laws, policies, and procedures. One of the many lessons learned from the 1994 Orange County, California bankruptcy was that internal audits play a critical role in to preventing serious financial problems and help to improve county procedures. The Board, Executive Office, and ACO have known about the issues surrounding internal audits for many years and have not yet taken the steps necessary to resolve them. Unlike Orange 20 County in the 1990s, Riverside County's Board, Executive Office, and ACO have the opportunity to be proactive in establishing the importance of internal audits and resolve outstanding issues surrounding the County's internal audits. Riverside County has changed dramatically in the past decade. However, the County appears to be content with the status quo. The Grand Jury is not aware of anyone who advocates for improvements within the ACO. Other department leaders do advocate for their departments to receive additional funds, additional personnel, and/or resources. In conclusion, the Board, Executive Office, and ACO have the opportunity to demonstrate their leadership abilities by transforming the current ineffectual internal audit system into a highly effective one. The question is, "Will they?"
No recommendations for this finding

Additional Recommendations 21

These recommendations are not explicitly linked to specific findings.