JtlL-17-29@i 14:52 Ientura Count\\" Auditor 805 654 seSI P.0/1s

We believe the Board of Supervisors of the importance of internal audits by the Auditor- is aware Controller. In a time of limiled budgets, the Board of Supervisors is faced with the very difficuli task of balancing priorities. However, the Jnternal auditfunction within theAuditor-Controlier'sOffice should be strengthened, particularly in light of difficultfinancial circumstances. Over the last two years the audit function has identiOed over $1.6 million in costsavings to the CountyofVentura. Fhone (805) 654-3151 Fat: (8os) ss4-sosl auditor.countyofventuta.org christine.cohen@rtlail. co.ventura ca~us JIJL-17-2@03 14:S2 VENTURA COtINTY AUDITOR S05 654 5081 P.03/10 u Honorable Bruce A. Glark July 17, 2003 ' 2. The citizens of the County of Ventura recognize and appreciate the importance of the elected, independent Auditor-Controller. This strengthens the checks and balances and segregation of duties within the County and reduces potential for conflicts of interest.

The independence of the elected Auditor-Conlroller and the internal audit funclion has been maintained. Developments with respect to the new audit standards continue to be monitored, and this office will actively participate with the State Association of County Auditors and the State Controller in developing applicable standardsfor CaliforniaAuditor-Controllers.

The collegial approach lo performance and compliance audits provides the best results in achieving the goal of corrective action. A more aggressive approach is used during audits involving fraud or other highly serious issues.

Inlernal controls are continually monitored. In fact, such monitoring has ied io the development of a Departmental Internal Controf SeIf-Assessment Review program targeted for implementation in the third quarter of 2003. We will work with the County Executive OFOce to develop final internal control strategies needed, as Ifyou have any questions or need additional information, please call me at (805) 654-3151, Sincerely, / / CHRISTINE L. COHEN Auditor-Controller Enclosures / Grand Jury cc: HonorableJudy Mikels, Chair, Board ofSupervisors Honorable Steve Bennett, Vice Chair, Board ofSupervisors Honorable Linda Parks, Board ofSupervisors Honorabie Kalhy 1- Long, Board of Supervisors Honorable John Flynn, Board ofSupervisors John F. Johnslon, Coun Executive OFOcer JLIL-17-2003 14:52 i/'ENTLIRA COI_INT.1" AUDITOR %05 654 S081 P.04/10 t ATTACHMENT I FINDINGS Findinqs F 1: The Board of Supervisors has the Oduciary responsibilityfor all Countygovernment. Response: We with the Grand Jury'sfinding, concur Finding F 2: The County Executive Officer the Board of Supervisors' agent implementing the County's iniernal is in control system. ResDonse: We partially with the finding. The internal controf system management's responsibility, concur is which includes not only the County Executive Officer as agent to ihe Board of Supervisors, but also the managementof each Countydepartment, Ftndino F-3: The Auditor-Controller the Board of Supervisors' agentfor implementing independentaudit, is an Resnonse; We partially with the Onding. As independently elected ofOcial, the Auditor-Controller concur an is also directly accountable to the citizensofthe County for implementing independentaudii an Finding F4: With respectto lhe new auditing standard, the Board of Supervisors is the head of County Government, Response: We generally concur with the Onding. There are several new standards related to Govemment Accounting Office Amendment NO. Independence to Government Auditing Standards and the Sarbanes-Oxley legislation creating the Public Company Accounting Oversight Board. Sarbanes- Oxley is currently only applicable to public companies, not governments. Final interpretations applicable for the County and other local govemmentswill evolve Finding F 5: In the California Government Code, the Legislature has found that it is essentiai to establish audit procedures thatconform to federal standards of independence and quality. Resnanse: We partially agree with the Onding. Galifornia Government Code section 53130 refers to audits of block grants and references Federal Standsrds of Independence and Quality. California Government 1 ll_lL-17-2003 14:52 'ENTI_IRA COUNT\\( AUDITOR nCI 05 684 S081 P.05/1S Code section 1236 requires that audit standards foilow the audit procedures established by the Institute of Internal Audits (llA). The statusofcurrenlstandards evolving, with recent and evolving is changes the Oeld of auditing standards under Generally Accepted Governmental Auditing in Standards and General Accounting Office regulations. The exact applicabili to \\ocal government internal audits with elected AuditorControllers and using under Generally Accepted AudiOng Standards requires additional review. Findin? F 6: In terms of full time employees, auditors represent small fraction of the employees of the ONce of the a Auditar-Conlraller. ResYonse: We concur with this hnding. Audit siaffrepresents seven ofseventy-three positions. Findino F 7: Some of the otherimportant business and accounting functionsofthe Auditor-Controller are; Claims and Disbursing Payroll General Ledger Reconciliation ofAccounts O Invoices/Billing Collections/AccountsReceivable Accountng for Fixed Assets Preparing the ComprehensiveAnnual Financial Report Maintaining and developing the County's Accounting System Overhead Allocations and Costsludies Accounts Payable Response: We generally concur with the findings. However, a numberof important functions that are mandated by California statute to be performed by the CountyAuditorhave been omitted, including. Calculating and distributing proper taxes Debt accounting, monitoring and reporting Appropiation control Financial reporting and review ofsiate quarterly and annual reports Publication of formal budgettabulation and adopted budgetdocuments 2 ll_lL-17-2003 14:5? ''ENTLIRA COtINT\\( AUDITOR S0S 654 5081 P.06/1S Cash controf and monitoring Review ofdepartmental and Countywide internal controls Findino F B: In 1981, there 17 auditors. By 1989, there about dozen auditors. Gurrenlly, there were were a are six auditors. Resoonse; We generally concur with the finding. Currently there are seven allocations, including the Chief Deputy. Findin$ F-9' In Fiscal Year (FY) 1981-1982, the AudR DJvision performed 55 audits. In Calendar Year 1989, 35 aadits were on the agenda of the Board of Supervisors, In CY 2000* seven audits were on the agenda of the Board of Supervisors. Response: We actually with the finding; however, the paragraph Js misleading. In FY 1981-82, the audis concur were primarily of federal grants and of financial statements. With the advent of the Single Audit Act of 1984, all audits of federal grants consolidated into audit performed by the outside were one audiiors. As result, the focus of the Internal Audit Division changed from accomplishing primarily a federal grant and Hnancial statement audits to accomplishing performance audits. Therefore, in addition to the reduction of stafOng, the types of audits accomplished signJOcantly reduced the number of reports issued. Since performanGe audits are addressed to department heads, such reports do not appear on the Board of Supervisors' agenda. However, copies of all audit reports are sent to members of the Board of Supervisors. During fiscal year2000, we issued fourteen (14) audit reports as compared to the seven (7) reported bythe Grand Jury. Finding F 10: The majority of areas that an intemal audit would normally address are in the Auditor-Controller's operations, where the Auditor-Controllersets accountng policy. or areas Response: We disagree with the finding. The Auditor-Controller operating accordance with state is in govemment statutes. The regulations focus external audits and Onancial audits. There new on are options available to perform intemal audits requiring further study. Internal audits include compliance, performance and operational audits. Internal audits involve oulside of Auditor- areas Controller operations or accounting policy, Compliance with grant requirements and performance audits do not generaiiy focus on Auditor-Controlleroperations, butfocus on whether departments are in compliance with requirements set by the federal or state govemments, and whether outcomes of particular programs have benefted from additional resources allocated to such programs. Furthermore, it is important to distinguish behNeen the accounting functions and the audit functionsof the Auditor-Controiler's OFOce. The Internal Audit Division separate and distinct division of the is a 3 JIJL-l c-2003 14:53 'ENTURA COUNTY AUDITOR o n 05 654 5081 P.07/18 Auditor-Controlles OFOce managed by a Certified Public Accountant The division is not involved in the setting of accounting policy Finding F-11: The current structure places ihe Auditor-Controller in a conOicting situation when there are differences between the Controller staffand the Auditstaff. Response: We disagree with the Onding siated. We not of differences between staff in audii as are aware our and otherdivisions. Finding F 12, The current audit policy was last issued in 1891 and revised in 199T. It supports a collegial approach to performing the auditing process, and states "audit reports will be discussed with the auditee slaff and management. At this point, the focus will be on improving operations and correcting noted deficiencies in a mutuslly agreed upon manner. The auditee will be given the opportuni to initiaie corrective actions on any noted weaknesses." Resyonse: We partially concur. Although the abovestated finding is true, it is not complete. The same policy also states: "Every attempt should be made to resolve differences behveen the auditor and manageraent relating to audit results. However, there are times when disagreements will occur, but neRher the auditor management should concede they believe their position supportable and nor is defendable. i) Audits are not meant to make a departmentlook bad or to publ~cly discredit a program, but to institute change. Change is better implemented with a cooperative approach. We have had great success with obtaining buy-in from management, when working cooperatively, to take corrective action and imprave operations. Findin4 13: On audits the attitude engendered by the currentcollegial policy has led to excessive delays between some the of preliminary report and fnal report. issuance a a Resoonse: We disagree with the Onding. Sufficient informaOon was not provided to determine how the conclusion was reached and supported. However, all audit agencies, including the General Accounting OFOce, State Bureau ofAudits and any other audit agencies accomplishing performance audits, face the dilemma of excessive delays. The delays are caused by a multitude of reasons. To impiy thatthe is primarily thecollegialpolicy is incorrect. cause Finding F 14: Past Boards of Supervisors had members participating in an Audit Advisory Board. For the current Board of Supervisors, visibilily into the audit process had been limrted to the end product. JUL-17-20E3 14:53 'viENTIJRA COLINT`( AUDITOR S05 684 S081 P.0S/1S Response We partially with the finding. During the mid-198Os Audit Advisory Commiftee existed. It GonGur an ended due to lack of aitendance at meetings. The Auditor-Controller has always been available to the Board of Supervisors, and input is requested for audit planning purposes each year from the Board of Supervisars, department heads and County Executive Offce. With lhe Fraud Hotline, semiannual repofing has been made to the Board of Supervisors. Findino F 15 The value to the Board ofSupervisorsof some audits is limited due to the excessive time taken to complete the audits. Resnonse: We partially concur with the fnding. Value remainsfor the Board of Supervisors when audits result in needed changes. Findino F 16. Current policy has led to the auditee having too strong an influence over the content of a Onal audit report. Resoonse: We disagree with the finding. Sufficient information was not provided to determine how the conclusion reached and supported, The Onding makes serious charge that the current policy was a compromises the independence of the audit function. Specific instance(s) where the auditor's independence may have been compromised is needed~io address the issue. Valid Ondings resulting from the audit process are not influenced by the auditee. The collegial approach allows the Auditee input in the developmentofcorrective action. Findina F 17: Recentattempts to increase the sizeand expertise of the auditstaff have been minimally successful. Resnonse: We partially concur with the Onding. It is difficult to fnd experienced performance auditors. The statement that recent attempts to increase the expertise of the audiX staff have been mimmally successful not accurate. SufOcient information not provided to determine how the conclusion is was was reached and supported. Of the audii staff of seven, four are certified publtc aGcountants, two have master degrees, two are certified intemal auditors, and one is a certiOed fraud examiner. The technical certiOcations acquired Coun employees. Additionally, the audit staff has were as a combined total of more than sixty (60) years of performance auditing experience. In addition, many forrner auditstaffhave been prarnoted ta managementpositions wiihin the Auditor- Controller's OFHce, other County departments, and in ci and federal government positions, based on the progressive expertise they gained in the Audit Division. I JUL-17-2003 14:i4 lENTtIRA COLINTY A1.IDITOR nCI 05 654 S081 P.09/1S Findino F-18: The audit staff, in the recent past, was seen by County agencies as not possessing the depth of expertise necessary to do performance auditing ofiechnicalfunctions, Response: We disagree with the fnding As stated, the finding misleading. As prescibed by the govemment is auditing standards, the expertise ofthe entire audit staff must be considered in determining whether suflcient expertise is available to accompl`lsh an audit. Therefore, an auditor who lacks lhe necessary expertise may still accomplish an audit if the expertise is available within the audit staff. County agencies could correctly perceive that the auditor-in-charge of a speciOc audit does not have the necessary expertise, but incorrectly perceive the same is true ofthe audit staff in general. Audits for which we do not have the necessary expertise are not undertaken Under these circumstances, we contractout the audit. Finding F-19: There is no policy associated with a required response time to draft audits by audited departments. This deficiency has resulted in an inordinate time frame to complete some audits. Response: We disagree with the Onding. The lack of a required response time has not resulted in an inordinate time frame ta complete some audits. Lengthy delays are not resolved simply by establishing required response times, As stated previously) delays are caused by a multitude of reasons, the leas! of which is lack of a required response lime. Based on past experience, required response timesdo not reduce delays. Findinn F-20: The Coun Administrative Manual contains number of topics associated with internal controls, but a no explicitinternal control policy, and mechanism, no review Response: We partia\\ly wiih the Onding. The various Coun internal controf policies follow standard concur internal controf policies reviewe4by the County's outside auditors, currently KPMG. Policies as are also descrtbed the Notes to the Comprehensive Annual Financial Report, year-end in in memorandums to all departmeni heads and fiscal officers, and individual depairnent policy statements The Auditor-Controller's Office Audit Division has developed Departmental Internal Control Self- a Assessment program, which is estimated to be distributed in the third quarter of 2003. Under this plan, every department will review its intemal controls, determining the risk areas within its operations, and strengthen the internal controf structure- It envisioned that the Orst will be is review an educational effort, with the assistance of the County Executive Office, and that future audits will compliance. assess 6 TI_lL-r,-z@03 14:54 iviENTURA COtINT\\" AUVITOR 0S 654 SESI P. 10/18 c, Finding F-21: Each department, by the nature of its aGtivities, has a unique set of internal controls, Response: We with the finding concur FJnding F 22 Efficient audits of a particular activity require an objective statement of internal controls. Such objective stalements are not in evidence for some departments. This deficiency can lead to disputes between audltors and managementthat adversely irnpacts the timeiy compleiion of audits. Response. We generally with the fading. Discussion of internal controls norrna! part of intemal concur is a an audit Finding F 23: Given the small of the audit ofOce, the standard pcactice the office relatively inefficient the size in is in following ways: A. Generally auditors work as individuals not as a team, B. There is no guidance or support provided to working auditors atthe beginning of an audit. C. Feedback by middle mBnagement to the audit staff seems only lo be provided after substaniial effort has been expended. D. Training limited. is Response: We disagree with the finding, A: We always have and will continue to establish audit teams for complex and difOcult audits. For regular and routine audits, individuals rather than teams assigned to extend the breadth of are audit coverage. B: As prescribed by government auditing standards, all audits planned, The auditor initially are accamplishes a survey and interacts with the Audit Chief to develop the audit justification/objectives, which ultimateiy approved by the Auditor-Controller. are C: Auditors are instructed to turn in work papers weekly, ifcompleted, for review by the Audit Chief. The Audit Chief holds scheduled weekly meetings with each auditor to discuss the work papers and determine the status and progress ofthe audit. During the meeting, ihe auditoralso has the opportunityto address difficulties, and problemswith the audit. concems, ? It_lL-17-2003 14:S4 'ENTURA COLINT\\l' AtIDITOR ses G54 50S1 P. II/IS D: The audit staffcompletes at least 80 hours ofcontinuing professional education every 2 years, as prescribed by government auditing standards. Of the 80 hours, at least 24 must be related to governmental accounting auditing. Additionalfunding would allow training. or more Finding F-24: Some audit personnel consider the integrity of their efforts Gompromised by multiple negotiations engendered by the "collegial" approach Resoonse: We disagree with the Onding. Although some staffmay have personal feelings of compromise during the process, the results ofthe auditprocess are to strengthen and imprcve the policies under audit. Findin? F 25: Other accounting standards identify the critical need of the internal auditorganization to report to the audit committee of organization, and not io the Auditor-Controller. an Response: We disagree wrth the Onding. There has been no speciOc ruling related to elected Auditor- Controllers. For external audits, the auditors would continue to conduct day-io-day operations with staff of the Auditor-Controiler's Office while also reporting to the Audit Committee The General Accounting Office revised Independence 3.30.2 provides presumption of organizational a independence to report externally if the audit organization's head is directly elected by voters of the jurisdiction being audited. The reporting to theAudit Committee is an enhancement. This area is currently evolving, and documentation to date does not make the distinction of an independently elected Auditor-Controller, provided by California law. We believe audits as our independent. remain Finding F-26: The Benchmarking and Best Practices Survey of the National Associalion of Local Government Auditor (NALGA), for the year 2000, determined that internal auditing activities returned savings averaging $3.36 per $1.00 spenl in iniemal auditcosts. Also, the City of San Jose determined that, from May 1985 through June2001, $7.00 retumed foreach %1.00ofinternal auditcosts, was Resvonse: We partially concur with the finding. The benchmarking of activities should not be used to compare across entities that are inherently different. The purpose ofbenchmarking is to cneasure the outcome of a particular aperatian, not to make comparisons out of context. We believe increased audit functions will be beneficial to the Coun. JLIL-17-2@03 14:4 t,IENTURA COLINT\\" AUDITOR 105 654 5081 P. 12/1S t ATTACHMENT 11 CONCLUSIONS: Conclusion C-1 The Board of Supervisors has the fiduciary responsibility to ensure the proper operation of County Government. This responsibility resis on two legs, The Orst leg is the development and operation of a system of internal controls. The second leg is an effective independent audit process to insure that the system ofinternal controls is effective. (F-1, F-2, F-3, F-4) Resoonse: We with overall responsibility of Board of Supervisors. Internal controls and independent concur audit process are two methods to encourage effective fiscal operatians of County Government. In addition, the Board ensures proper program operaiion of County Govemment, as well as other related duties Conclusion C-2: The currentstructure of independentauditdoes not meetthe independencecriteriaof GovernmentAuditing Standards (GAS) Amendment NO. 3. There inherent conflict behNeen Auditor and Controller is an responsibilities. (F-5, F-6, F-7, F-10, F-lli F-25) Resoonse: We disagree with the conclusion, The General Accounting Office standards allows excepiions for elected heads of audit organizations. The standards have not been determined to apply to rnternal audits. This is an area that is evolving and we will continue to monitor future developments. in the meantime, state law governs the responsibilities of the Auditor-Controller functions. The curreni strudure complies with Califomia statutes governing the responsibilitiesofthe Auditor-Controller. Conclusion C-3: Past administrations have allowed the auditing capability to deteriorate signiOcantly, yet the size, complexity and technology of County government has increased significantly over the past ten years. (F-8, F-9, F-17j F18) Resnonse: We that lhe budgeted dollars and allocations for audit staff in the AuditorController's OFEce concur decreased dramatically, whiie complexity has increased. The Board has recognized the audii needs at several times in the recent past. However, the immediate need to make subsequent position cuts required giving up the new audit positions. Other units of the Auditor-Controller's OFOce maintain necessary Audilor-Conlroller processing and reporting functions, have absorbed cuts, and can afford no more. Gonclusion C-4: The existing internal control policies, procedures and practice; and audit policies, procedures and praciices need to be revised in light of the new policy on independence from the Comptroller Genera! of the United States. (F-5, F12, F,13, F-14, F-15, F-16, F-19, F-23) 1 JUL-17-2003 14:55 IENTLIRA COLINT\\) AUDITOR S05 654 5081 P. 13/1S Response: We partiaily concur with the conclusion as stated. Please see referenced Ondings for more detailed discussion. We agree that existing intemal control and audit policies need to be reviewed in light of new siandards. It is not yet car which pollcies would actually require revision, The policies are effective of January 1,2003. The applicability to governmental accounting and auditing, intemal as audits versus external financial audits, and particularty in relation lo elected California Auditor- Controllers, has not been Tully addressed and is evolving Conclusion C-5: I The perceived independence of the audit process has been eroded due to the current collegial policy. (F-13, F-24) Response: We disagree with this canclusian. The collegial approach on audits to improve perfarmance and compliance provides education, interaction and Onal successful result Jn most Anyquestion a cases. of fraud otheT not compromised during these audtts and deali with or serious issues is are aggresstvely Conclusion C-6; There clear, focused policy internal cnntrols within the County government. (F20, F021, F-22) is no on Response: We disagree with this conclusion. Internal controls are reviewed in each and every audit conducted by internal audit. The remainder of the Auditor-Conlrolleris Office wel! versed intemal control is on concepts, as are the fiscal ofOcers throughout the Countyl and any breaches are closed as soon as discovered. Year-end publications provide specific internal controf policies over cash and agency funds. The Administative Manual provides fiscal intemal control information. The annual Single Audit includes an extensive review of County's internal controls. In addition, recognizing the need for continuous improvements, this office has developed the Departmental Internal Controf Self- Assessment Review program to be implemented in the third quarteT of 2003, which will further determine the improvemenb required departmentsthroughoutthe County in Gonclusion C-7: There is deficiency in oversight by the Board of Supervisors over both internal controls and independent audits, (F~l4, Flsj Fl7, F-20) Resoonse: We disagree with this conclusion. The Board of Supervisors is well aware of the need for internal controls and independent audits. The contract for the annual Single Audit goes to the Board each year. Two educationa1 presentations were provided relating to Governmental Accounting Standards Statement NO. 34: Basic Financial Statemer7ts, and Management's Discussion and Analysis--for State and Local Governmenfs. More such sessions or communications may be provided by the Auditor-Controllerif desired by the Board ofSupervisors, so 2 JUL-17-z003 14:55 IJENTI.IRA COIJNTV AUDITOR S05 654 5031 P. 14/16 1 Conclusion C-8: Jnternal auditfunctions can more than pay forthemselves. (F-26) Resvonse: We concur as a probability that audits can pay for themselves either directly or in avoiding future costs. TtlL-l r f T - 1 z003 14:55 IENTIJRA COUNTV AUDITOR S0S 654 5081 P. 15/1S ATTACHMENT 111 RECOMMENDATIONS: Recommendation R-1: In order to insure that the County meets the newer standards for independent auditing, the Board of Supervisors establish an effective oversight mechanism lo insure adequate audit resources and independence. Resvonse: We partially concur with this recommendatjon. Howeveri the newer standards are still under review with respect to the applicauon wiihin the State of California and local governments with elected Auditor-Controllersand alsowith respectto internal audits versus external audits, 7he implementation requires furtherstudy.