County Executve Office*

The Ventura County Auditor-Controller is an elected official who is required to meet the qualifications for the position of Auditor described in Califomia Government Code §26945. Response: Concur.

The Auditor-Controller is the County of Ventura's Chief Financial Officer and maintains all basic financial information, analyzes accounting reports, and makes appropriate recommendations to the Board of Supervisors (BOS) and County agencies relating to the County's _ financial condition. Response: Do Not Concur. According to Government Code 26881, “The county auditor, or in counties that have the office of controller, the auditor-controller shall be the chief accounting officer of the county. Upon order of the board of supervisors, the auditor or auditor-controller shall - prescribe, and shall exercise a general supervision, including the ability to review departmental and countywide internal controls, over the accounting forms and the method of keeping the accounts of all offices, departments and institutions under the control of the board of supervisors and of all districts whose funds are kept in the county treasury.” The duties of the Auditor-Controller are outlined in the code and do not specifically include making recommendations on the County’s financial condition.

The Auditor-Controller is responsible for financial compliance and operational audits of County agencies, public authorities, and dependent districts. Response: Concur in Part. The Board is ultimately responsible and has delegated this responsibility to the Auditor-Controller. 6/26/07 County Governance

The BOS is the governing body of Ventura County. The Board has the authority to adopt ordinances and make appropriations. The final budgets of agencies under both elected and appointed County officials are approved by the BOS. Response: Agree.

County Ordinance No. 4235 (CEO Ordinance) was adopted by the BOS on May 22, 2001, less than two months after the current County Executive Officer (CEO) was hired, to redefine that position and to re-title it from County Administrative Officer to County Executive Officer. Response: Respectfully disagree. Ordinance 4224 was adopted December 5, 2000 and it is this ordinance that set in place the shift in responsibilities. This ordinance was subsequently amended by the Board of Supervisors on May 22, 2001 with Ordinance 4235, changing the name from Chief Administrative Officer to County Executive Officer. Ordinance 4265 adopted by the Board of Supervisors on June 4, 2002 made the Clerk of the Board of Supervisors an appointed position and amended Ordinances 4224 and 4235 to appoint the County Executive Officer ex-officio Clerk of the Board.

6/26/07 The BOS is the governing body of Ventura County. The Board has the authority to adopt ordinances and make appropriations. The final budgets of agencies under both elected and appointed County officials are approved by the BOS. Response: Concur. County Ordinance No. 4235 (CEO Ordinance) was adopted by the BOS on May 22, 2001, less than two months after the current County Executive Officer (CEQ) was hired, to redefine that position and to re- title it from County Administrator to County Executive Officer. Response: Do Not Concur. Ordinance No. 4235 did not redefine the position. It merely restored the title of County Executive to reflect the duties and responsibility of the job. The CEO Ordinance reflected a change in the role of the County’s chief employee from an administrator to an executive. Response: See F-05. Concur in Part. “In April 2000, ‘due to the publicized financial difficulties confronting the County, the opportunity to strategically maximize the County’s relationship with both the state and federal governments, the need to increase public confidence in County government and the future recruitment of a permanent CAQ.....’, the Board decided it was appropriate to revisit the powers and authority delegated to the CAO. After taking public testimony on the proposed role, authority and responsibility of the then Chief Administrative Officer, in June believing the County needed not only strong political leadership but strong central leadership at the executive and operational level, the Board adopted a resolution — restating, strengthening and delegating authority to the CAO. Strengthening and centralizing authority with in the CAO was to improve the County’s system of checks and balances. Specifically, the centralizing the authority of the office was to: e Provide leadership e Provide fiscal oversight e Reduce the possibility of fiefdoms with unchecked powers e Preclude autonomous actions with financial implications on the part of managers and officials e Assure that the information and data required to make management decisions, to perform financial analysis, and to advise the Board is available within the Chief Administrative Office e Improve the quality of information provided to the Board for policy decisions” (Reprinted from 6/6/2000 Board letter) The position of Chief Financial Officer was established at that time to help develop the office’s capacity for financial forecasting and financial management. Ordinance 4224 which basically mirrored the duties, responsibilities and delegated authorities identified in the resolution was introduced for first reading on November 21, 2000, and became effective, January 5, 2001, three months prior to current County Executive Officer being employed.

The CEO Ordinance changed budgeting responsibility from the Auditor-Controller to the CEO. This consolidated budgeting and finance under one office. Response: Do Not Concur. The budget responsibility has always resided in the CAO/CEQ’s office. The activities of projecting general purpose revenue and appropriations were separated between the Auditor-Controller and the CAO respectively, based upon agreements between the offices. The ordinance reestablished the CEO as the office responsible for general purpose revenue projections, thus consolidating these two key responsibilities in one office. In conjunction with its transfer of the revenue budget responsibilities, the debt issuances functions were also. transferred to the CEO from the Auditor-Controller where these financial functions had historically been performed. The investment function remains in the elected Treasurer-Tax Collector Office. 6/26/07 .

The CEO Ordinance states, “All departmental requests for Board action shall be through the CEO. Board members are encouraged to seek both CEO and County Counsel review of proposed items.” Response: Agree.

The CEO Ordinance established specific duties and responsibilities of the CEO including, “The CEO shall, in cooperation with the Auditor-Controller, supervise, direct, review, and maintain an adequate internal auditing system.” Response: Agree.

6/26/07 The CEO Ordinance states, “All departmental requests for Board action shall be through the CEO. Board members are encouraged to seek both CEO and County Counsel review of proposed items.” Response: Concur in Part. The section of the ordinance quoted in the Grand Jury Finding F-08 reads in its entirety as follows: . “All departmental requests for Board action shall be through the CEO. Board members are encouraged to seek both CEO and County Counsel review of proposed items. Should such review not take place prior to presentation to the Board, it shall be Board policy to refer the item to the CEO for report back.” Elected Officials are encouraged to follow the normal Board letter review process. However Elected Officials have the right, which they exercise on occasion, to put arryihing they wish on the Agenda outside of that process. The CEO Ordinance established specific duties and responsibilities of the CEO including, “The CEO shall, in cooperation with the Auditor- Controller, supervise, direct, review, and maintain an adequate internal auditing system.” Response: Concur. Supervisors rely on the CEO and his staff for recommendations on financial management issues. Response: Partially Concur. BOS relies on CEO, and the CEO is required to make recommendations. However, the CEO is not the exclusive source of advice. The Board also relies on the Auditor Controller and Treasurer Tax Collector for financial advice. ‘

The CEO and the Chairman of the BOS set the time allocations for the BOS discussion of agenda items. Response: Agree.

The Auditor-Controller is often involved late or not involved at all in reviewing issues being decided by the BOS that affect the fiscal health of the County. Response: Agree. In general, corrective action has been taken by the CEO to enforce the County policy of providing 10 working days to review items before being filed on the Board agenda.

F-14 6/26/07 The CEO and the Chairman of the BOS set the time allocations for the BOS discussion of agenda items. Response: Concur in Part. The Chief Deputy Clerk of the Board sets an estimated time duration for discussion of “Time Certain” agenda items. The Clerk does this after consulting with the Chair of the Board of Supervisors, County Executive Office, and Elected/Department Heads as appropriate. The Auditor-Controller is often involved late or not involved at all in reviewing issues being decided by the BOS that affect the fiscal health of the County. Response: Do Not Concur. The Auditor-Controller is regularly involved in reviewing issues that affect the fiscal health of the County. The Auditor participates in the Financial Review Committee, the Capital Projects Committee, and attends all Board meetings. In some instances, the Auditor’s involvement has come later in the process. However, with rare exception, any decision by the BOS is delayed if the Auditor requests more time for review. The Auditor-Controller is rarely asked by the BOS for an opinion on issues that affect the fiscal health of the County and she does. Response: Do Not Concur. The Auditor-Controller is welcome to speak on any issue, especially those that affect the fiscal health of the County. Budgeting was transferred from the Auditor-Controller to the CEO because state law requires that the BOS be responsible for the budget. The Auditor-Controller is independently elected and does not report to the BOS. Response: Concur in Part. As stated in the response to F-07, the CEO has always been responsible for the development and presentation of the budget. Under previous CAO organizational structures, the CAO had responsibility for putting together the organization’s spending plan but did not have the responsibility or authority for projecting revenues. Being totally reliant on another organization for this key element of budgeting was inefficient and in some instances inappropriate.

Budgeting was transferred from the Auditor-Controller to the CEO because state law requires that the BOS be responsible for the budget. The Auditor-Controller is independently elected and does not report to the BOS. Response: Respectfully disagree. The allocation of budgetary resources has always been the responsibility of the Board of Supervisors. The role of the Auditor-Controller in the budget process is to review estimates for revenues/financing sources, to insure the budget is balanced, to record the Board's budgetary decisions, to publish the budget in the format required by the State Controller, among other duties. These duties were not transferred to the CEO.

The office of the CEO recommends proposed (target) budgets, including the budget for the Auditor-Controller. Response: Concur. However, technically, proposed and target budgets are two distinct products. The target budget is the budget prepared by the CEO based upon the CEO’s calculation of performing current service levels at next year’s cost combined with the CEO’s estimate of available funding. There is no real proposed budget. The preliminary budget is what the CEO recommends to the Board of Supervisors after discussion with departments and evaluating department requests. By State Law the Auditor Controller is responsible for the annual Budget Tabulation which is presented at the start of the annual budget process.

Agencies requesting budgets greater than the CEO's target budget, including agencies headed by an elected official, must justify their requested increase to the CEO before the overall” target budget is submitted to the BOS. Response: Do Not Concur. As mentioned above, target budgets are determined by CEO based on providing current services at next year’s prices and available funding. All departments including elected officials are provided an opportunity to discuss their concerns with the CEO calculations and to seek support for additional levels of service. If departmental requests are something that the CEO can support it goes into the department’s preliminary budget presented to the Board. However, any requests of the departments, including elected officials, beyond the appropriations recommended by the CEO are considered “supplemental” and are also presented to the Board of Supervisors with cost information and discussion. Department heads, including elected officials, have an opportunity and responsibility to discuss their additional funding requests directly with the BOS. 6/26/07

Requests for supplemental funding for budgets not included in the target budget document are presented to the BOS without support or recommendation from the CEO. The BOS rarely approves a supplemental budget request. Response: Respectfully disagree. The CEO has recommended supplemental requests when, in the determination of the CEO, there are sufficient resources to do so. The Board of Supervisors considers the departmental requests and the CEO recommendations when making their decisions. At times a supplemental request is not required if the CEO has already adjusted the target budget to incorporate budget requests that follow previous Board actions.

The Auditor-Controller has asked for additional audit staff during the past six years. The appeals to the BOS have been denied, as have requests by other County agencies for additional funding. Response: Agree. The supplemental requests during the budget hearings for the Auditor- Controller's office have not generally received support. However, some budgetary adjustments have been made mid-year, based on significant system requirements such as the Ventura County Human Resources/Payroll system and Ventura County Financial Management System implementations.

6/26/07 Requests for supplemental funding for budgets not included in the target budget document are presented to the BOS without support or recommendation from the CEO. The BOS rarely approves a supplemental budget request. Response: Concur in Part. The term “rarely” is subjective. The Board has full discretion to approve supplemental requests. Generally, the tendency to approve those requests is based upon the perceived need relative to the availability of funding. At the budget hearings for fiscal year 2006-07, the Board of Supervisors approved supplemental requests to add 21 positions, $1.2 million in appropriations and $557,000 in revenue. 12 out of 21 positions were allocated to elected officials’ offices. The Auditor-Controller has asked for additional audit staff during the past six years. The appeals to the BOS have been denied, as have requests by other County agencies for additional funding. Response: Concur with Clarification. The reductions in staffing from the Audit Division were initiated and directed by the Auditor-Controller. During budget cycles of downturn, the elimination of vacant positions in lieu of laying-off filled positions in functional areas other than the Audit Division was at the discretion of the Auditor-Controller. Based on circumstances at the time, the Auditor-Controller’s decisions were not unreasonable. in the past five years, the office of the Chief Deputy Executive Officer has grown from two employees to approximately 12, with eight analysts reporting directly to the Chief Deputy. Those reporting directly all earn approximately $100,000 per year. Response: Do Not Concur. In 2001/02, there were 15 positions working in Budget and Finance. Today there are 9. Additionally, 2.5 positions responsible for intergovernmental affairs and legislative analysis were transferred to the Budget and Finance Division to be supervised by the Chief Deputy as an economy measure during budget reductions in 2003/04. Audit Division

Government Code §26884 states, “In the event the BOS elects to require that the county Auditor-Controller perform the additional services [audit] authorized by this chapter it shall have the power and it shall be its duty to provide the proper appropriations for any additional personnel, equipment, supplies or expenses made necessary thereby.” Response: Agree.

The current (March 1, 2007) audit staff consists of two auditors: one with CPA certification and one with a BS degree in accounting. The entry level salary is $38,000 per year. Response: Partially agree. The finding considers only the number of filled positions. However, this does not speak fo the additional vacant allocations in various stages of recruitment.

6/26/07 Government Code §26884 states, “In the event the BOS elects to require that the county Auditor-Controller perform the additional services [audit] authorized by this chapter it shall have the power and it shall be its duty to provide the proper appropriations for any additional personnel, equipment, supplies or expenses made necessary thereby.” Response: Concur. The current (March 1, 2007) audit staff consists of two auditors, one with CPA certification and one with a BS degree in accounting. The entry level salary is $38,000 per year. . Response: Concur With Clarification. The salary ranges for an Internal Auditor series are: Internal Auditor! $38,386 to $49,135 Internal Auditor Il $44,567 to $57,046 Internal Auditor Ill $49,025 to $62,751 Internal Auditor IV $55,257 to $70,729 On March 1, 2007, there were two filled positions, one at the Internal Auditor Il and another at Internal Auditor Ill level with salary levels of $47,005 and $58,682 respectively. In addition, the appointing authorities (department heads) have the ability to request a higher starting salary level other than entry level if certain criteria are met including experience and qualifications of the selected applicant and/or due to difficult to fill positions. Therefore, if appropriately justified a candidate may receive a higher level of compensation up to $70,724. The Audit Division is budgeted for two Auditor Ill positions at $50,000 each and two Auditor IV positions at $70,000 each. Response: Concur With Clarification. Refer to F-21 showing the salary ranges for the Internal Auditor series. Although the Auditor-Controller has budgeted allocations at the Ill and IV levels, all recent requests for recruitments have been for

6/26/07 Internal Auditor |, Il, ill’s. It is a common practice to “underfill” a higher level position with lower level positions. This has been a consistent practice in the Audit Division, and the Internal Auditor IV positions (the highest level) are typically held as internal promotional opportunities for which a recruitment is not held. In addition to the line auditor staff positions, the Audit Division has two upper-management positions, a Chief Deputy Auditor Controller, and an Auditor Manager (Fiscal Manager Il). As a result, there are a total of six staff allocations budgeted in the Audit Division. Current senior level auditor compensation levels are not sufficient to attract and/or retain experienced senior level auditor staff. During 2006, the Audit Division hired three entry-level Auditor | employees at $38,000 each because experienced Auditor III and Auditor IV auditors could not be recruited. Response: Do Not Concur. As mentioned in the response to F-22, Auditor IV positions are not opened for public recruitment. They are held to provide a career path, allowing internal promotions for qualified employees. The requested recruitments by the Auditor-Controller were for the Internal Auditor series I, Il, Ill. Applicants are screened for the minimum qualifications at each level and referred to the department based on the highest qualifying level. The following shows the hiring activity for 2006: len Hired : Hired Date Eligible Level Classification Starting Salary nt. Auditor! | Int. Auditor | nt. Auditor | Nov. 19, 2006 | Int. Auditor Ill As evidenced by the hiring patterns, qualified applicants at the more senior levels are being recruited and employed. In addition, entry-level positions and their respective salary levels have been adjusted to offer starting salaries higher than entry level. Further study of compensation levels would be required to determine if compensation is the sole reason for recruitment and retention issues as noted by the finding.

The audit staff in 2003 consisted of seven people; four CPAs (two of whom had Master's degrees), two certified internal auditors, and one © certified fraud examiner. Response: Concur With Clarification. According to the personnel records, as of January 1, 2003, there were six (6) positions filled in the Audit Division. Of the positions filled the credentials and qualifications were as follows: Deputy Director Aud-Contr. BA, CPA, CIA, CFE, CGFM — M Pd bl Manage) fe PAuditer if} 88, 8A FAuclitor [ws FAuditor |} pg FAauditor I} pg

The audit staff in 1991 consisted of ten auditors. Response: Concur With Clarification. The Audit-Controller’s budget included 10 audit positions. We do not know how many of the positions remained vacant.

The Audit Division frequently has open positions which it is unable to fill. The only recruitment advertisement is that which is posted on the County Web site. Response: Concur With Clarification. The County’s standard recruitment activity and outreach efforts are directed via the Internet through the County’s Human Resources webpage. A department may request that additional “marketing” and recruitment efforts be made with advertisements in local newspapers, trade journals, direct mailers, flyers, etc... Recruitment figures indicate that from the beginning of 2005 to April of 2007, 273 applicants were submitted for Internal Auditor openings. Of those submitted applicants 100 were screened and 6/26/07 referred to the department as qualified candidates within the Internal Auditor series. A total of 9 of the referred candidates were offered employment and 8 were hired. All notices for employment opportunities were posted on the Internet. Human Resources did not receive requests for any additional recruitment efforts to be made for special screening criteria or credentials and qualifications. .

With the exception of the Chief Deputy Auditor-Controller all current audit staff has been employed by the county for one year or less. Response: Concur in Part With Clarification. The length of tenure in staff level positions is somewhat perplexing; qualified applicants are being recruited and hired but the longevity of staff in the positions is short. The causes for the turnover rate will require greater study to determine if compensation or other factors contribute to the retention problem.

The audit staff has been weakened due to turnover of experienced auditors seeking career advancement. Response: Concur in Part. As stated in F-27, the high turnover rate results in an inexperienced workforce. However, experienced auditors have been recruited and hired. The reasons for the turnover rate for the experienced staff is a conclusion not a finding. The causes of high turnover appear not to have been explored thoroughly in this report.

The Audit Plan for 1990-91 for the County of Ventura provided 14,147 direct time audit hours with mostly experienced auditors. Response: No Comment.

The Audit Plan for 2006-07 for the County of Ventura provided 5,760 hours with mostly inexperienced auditors. Response: No Comment. 6/26/07

The Audit Division is understaffed in numbers and qualifications. With the exception of mandated audits, only cursory other audit activities are being accomplished. Response: Partially agree. Although ideal auditors would have a number of certifications and advanced degrees, all current auditors meet or exceed job qualifications. Also, of the 20 audits completed and in progress as of this response during FY 2006-07, 50 percent are mandated and 50 percent are considered discretionary.

County entities with revenues from fees charged to the public for services rendered are termed “enterprise fund” organizations. Such organizations are not currently being audited except for audits mandated by state and federal laws. For example e The Department of Airports has not had a comprehensive financial audit since 1989. e No record can be found of the last comprehensive financial audit of the Harbor Department. Response: Respectfully disagree. Financial audits are performed where legally or contractually required. The latest annual department of Airports Passenger Facilities fees audit was completed on July 12, 2006. The Harbor department received an audit in the area of financial management in the late 1990's, with the follow-up audit being completed in April 1999.

6/26/07 The Audit Division is understaffed in numbers and qualifications. With the exception of mandated audits, only cursory other audit activities are being accomplished. Response: Do Not Concur. This is not a finding but rather a conclusion that is not based on | any particular set of facts. County entities with revenues from fees charged to the public for services rendered are termed “enterprise fund" organizations. Such organizations are not currently being audited except for audits mandated by state and federal laws. For example: _¢ The Department of Airports has not had a comprehensive financial audit since 1989. e No record can be found of the last comprehensive financial audit of _ the Harbor Department. Response: Do Not Concur. There are many county agencies that charge fees to the public for services rendered that are not accounted for in an enterprise fund. According to government accounting standards, enterprise funds may be used to report any activity for which a fee is charged to external users for goods or services. All enterprise funds are included in the countywide financial audit performed by an independent CPA firm annually. A major audit of the Harbor Department occurred in 1999, both departments are included in the annual audit, and several smaller audits of the Airport Department (grants, facility charges, and revenue) have occurred in the last few years. In order to accomplish tri-annual audits of all 26 agencies in the County of Ventura, additional experienced auditors are needed. Response: Concur in Part. This is not a finding but rather a conclusion that is not based on any particular set of facts. If there were to be tri-annual audits of 26 county agencies, there may need to be additional auditors. However, there are neither facts to support the need for tri-annual audits of the 26 county agencies mentioned (there are 27

F-35 agencies/departments) nor workload measures to justify additional staffing. In the 2001-2002 budget approved by the BOS, three positions were transferred from the Auditor-Controller's Office to the CEO in order to strengthen the County's financial management. This resulted in a decrease of three auditors in the Audit Division. Response: Do Not Concur. Despite certain financial responsibilities being transferred from the Auditor-Controller to the CEOQ’s office, the budgets approved by the Board of Supervisors, during the two-year period from fiscal year 2000-01 through fiscal year 2002-03, reflect an overall gain of 1 position in the Auditor-Controller’s office. The number of auditors decreased by one during that period offset by increases in other positions within the Auditor-Controller’s office. During that same time period the CEO’s office took on additional responsibilities and staffing level remained the same. A supplemental budget request in the amount of $155,000 by the Auditor- Controller to fund replacing those three positions in the Audit Division was not recommended by the CEO and was subsequently denied by the BOS. The Auditor-Controller informed the BOS that this lack of funding would delay the full implementation of the enhanced audit program by leaving audit positions vacant. . Response: Do Not Concur. As mentioned in F-34, the Board of Supervisors did not reduce the Auditor-Controller budgets by 3 positions. There was no supplemental request for additional positions for the 2001-02 fiscal year. However, there was a net cost request of $155,000 apparently to obtain full funding for vacant positions. This funding request was denied because historic salary expenditures in the Auditor- Controller’s budget did not warrant the additional appropriations. Prior Grand Jury Reports

A supplemental budget request in the amount of $155,000 by the Auditor-Controller to fund replacing those three positions in the Audit Division was not recommended by the CEO and was subsequently denied by the BOS. The Auditor-Controller informed the BOS that this lack of funding would delay the full implementation of the enhanced audit program by leaving audit positions vacant. Response: Partially agree. In Fiscal Year 2001-02, the three position allocations referred to above were not eliminated. The funding was reduced, which necessitated three positions be kept vacant.

6/26/07 In the Auditor-Controller's August 14, 2002, response to the report "The Public Administrator and Public Guardian as Conservator" of the 2001-2002 Ventura County Grand Jury, which was sent to the BOS and the CEO, the Auditor-Controller stated, "Because of

In the Auditor-Controller’s July 17, 2003, response to the report “Independent Auditing within Ventura County Government” of the 2002 /2003 Ventura County Grand Jury (2002-03 Grand Jury), which was sent to the BOS and the CEO, the Auditor-Controller stated, “... the internal audit function with the Auditor-Controller’s Office should be strengthened, particularly in light of difficult financial circumstances.” The Auditor-Controller also stated, “We believe the Board of Supervisors is aware of the importance of internal audits for the Auditor-Controller.” Response: Agree.

The Auditor-Controller agreed with 2002-03 Grand Jury recommendation R-3 that the BOS take active responsibility for internal audit resources, including annual budget, staffing size, salaries, and position classification. Response: Agree.

6/26/07 limited audit resources, audits of the PA/PG must compete with other audit requirements and priorities." Response: Concur. This was the Auditor-Controller’s response. In the Auditor-Controller's July 17, 2003, response to the report "Independent Auditing within Ventura County Government" of the 2002- 2003 Ventura County Grand Jury (2002-03 Grand Jury),which was sent to the BOS and the CEO, the Auditor-Controller stated, "... the internal audit function with the Auditor-Controller's Office should be strengthened, particularly in light of difficult financial circumstances." The Auditor-Controller also stated, "We believe the Board of Supervisors is aware of the importance of internal audits for the Auditor-Controller." Response: Concur. This was the AC response. The Auditor-Controller agreed with 2002-03 Grand Jury recommendation R-3 that the BOS take active responsibility for internal audit resources, including annual budget, staffing size, salaries, and position classification. Response: Do Not Concur. The Auditor-Controller’s response stated, “We partially concur with the recommendation. The Auditor-Controller’s responsibility is to — request additional resources. It has been noted in several public settings that the audit function becomes more important, particularly when faced with difficult financial times. Implementation requires additional County resources.” The BOS responded to recommendation R-3 in the 2002-03 Grand Jury report by suggesting that individual departments deal with the issue of internal audits through reorganization and the reallocation of resources, Response: Concur With Clarification. The response of the Board of Supervisors dealt with proper allocation of limited resources. The Board of Supervisors

response was “during times of increasingly scarce resources, any requests for additional internal audit resources would need to compete with requests to fund other high priority public programs and services. As an alternative to appropriating additional resources to meet critical functions, departments are encouraged whenever possible to consider internal reorganizations and evaluate reallocation of their existing resources.” In the Auditor-Controller's May 12, 2004, response to the report “Anatomy of an Audit" of the 2003-2004 Ventura County Grand Jury, which was sent to the BOS and the CEO, the Auditor-Controller stated, “We do not have sufficient audit resources to establish a meaningful audit program for the County.” Response: Concur With Clarification. This response needs to be taken in context of the recommendation to which the Auditor-Controller was responding. The recommendation was “Audit Division and HSA should develop more effective contingency plans to cover key personnel changes.” The full response of the Auditor-Controller was “Although we agree with the spirit and intent, we will not be able to implement the recommendation. Currently, the Audit Division has seven and is scheduled to lose two authorized audit staff positions by July 1, 2004, because of budgetary reductions. Of the seven authorized positions, four are vacant because of budgetary constraints and also the hiring freeze. We do not have sufficient audit resources to establish a meaningful audit program for the County let alone audit resource to develop more effective contingency plans to cover key personnel changes.” Internal Control Self-Assessment Program

Government Code §26881 states, “...Auditor-Controller shall prescribe, and shall exercise general supervision, including the ability to review departmental and countywide internal controls.” Response: Agree.

Auditing, whether contracted through independent CPA firms or performed by the Audit Division, is one of the means used by the Office of the Auditor-Controller to fulfill its statutory responsibilities. Response: Agree.

Under government auditing standards, department management is responsible for establishing an effective system of internal controls to ensure compliance with laws and regulations. Response: Agree.

6/26/07 Government Code §26881 states, “...Auditor-Controller shall prescribe, and shall exercise general supervision, including the ability to review department and countywide internal controls.” Response: Concur With Clarification. “Upon order of the board of supervisors the auditor or auditor- controller shall prescribe, and shall exercise a general supervision over, the accounting forms and the method of keeping the accounts of all offices, departments and institutions under the

The initial efforts of the Internal Control Self-Assessment Program were developed to assist departments to perform the review. Thereafter, the Audit Division would periodically assess each department's implementation of the Self-Assessment Program and recommend necessary corrective actions. Response: Agree.

6/26/07 control of the board of supervisors and of all districts whose funds are kept in the county treasury.” Auditing, whether contracted through independent CPA firms or performed by the Audit Division, is one of the means used by the Office of the Auditor-Controller to fulfill its statutory responsibilities. Response: Concur. Under government auditing standards, department management is responsible for establishing an effective system of internal controls to ensure compliance with laws and regulations. Response: Concur. The tri-annual Departmental Internal Control Self-Assessment Program _ was initiated by the Auditor-Controller and the CEO in February 2004. Under this plan, every department is responsible for reviewing its internal controls, determining risk areas within its operations, and strengthening its internal control structure. Response: Concur. The initial efforts of the Internal Control Self-Assessment Program were developed to assist departments to perform the review. Thereafter, the Audit Division would periodically assess each department's implementation of the Self-Assessment Program and recommend necessary corrective actions. Response: Concur. Not all county agencies completed the questionnaires and returned them to the Auditor-Controller as required by the Departmental Internal Control Self-Assessment Program. Among those not in compliance was the office of Treasurer-Tax Collector. Response: Concur.

F-48 As a result of staff reductions in the Audit Division, no follow-up or review of the Internal Control Self-Assessment Questionnaires has been done. Response: Concur in Part. Conclusion not a finding. Follow-up on compliance with filing requirement is easily handled as a clerical function. Review of self- assessment and providing advice obviously would require audit expertise. While all departments have been directed to report to the Auditor- Controller when weaknesses in internal controls are found, compliance is inconsistent. Response: Part of the Internal Control Self Assessments which are submitted to the Auditor-Controller would assist in identifying weakness in internal controls. If this is the direction the Grand Jury report references, then we concur that compliance has not been at 100%. A Breakdown of Internal Controls

While all departments have been directed to report to the Auditor Controller when weaknesses in internal controls are found, compliance is inconsistent. Response: Agree.

F-50 6/26/07 In 2005, embezzlement was discovered in the Public Guardian’s Office, resulting in part from a breakdown in that office’s internal controls. Response: Concur. The Auditor-Controller was not involved in detecting or correcting the breakdown in internal controls in the Public Guardian’s Office. Response: Concur in Part. The Auditor-Controller did not make corrections in internal controls of the Public Guardian’s office, and was not responsible to do so. The Auditor-Controller did write a report that detected weaknesses in internal control and brought it to the attention of the Public Guardian, as did a previous Grand Jury.

The Auditor-Controller was not involved in detecting or correcting the breakdown in internal controls in the Public Guardian’s Office. Response: Respectfully disagree. Our previous audit had identified weaknesses in oversight and controls.

Accriminal investigation of embezzlement within the Public Guardian’s Office and indictments of those accused in those crimes cost Ventura County over $628,000 through the end of November 2006. Response: Concur With Clarification. The basis of the claimed costs is not provided in the report, but it is expected the total cost will approach $1 million. The “loss” from the embezzlement is estimated to be $10,000. The remainder of the cost is composed of staff time, District Attorney investigation and prosecution time, and the Board-ordered outside independent audit (see F-53).

Restitution to four victims of embezzlement in the Public Guardian's Office cost Ventura County more than $81,000, plus an additional amount still under negotiation with a fifth victim. Continuing investigation may uncover additional victims. Response: Concur With Clarification. Disagree with the amount of the net loss, but agree there was some and it is possible that additional victims may be discovered. There are no pending “negotiations” with a victim. After two years of investigation the probability of discovering additional victims is unlikely.

| The County has contracted for an outside audit of the Public Guardian’s Office at a cost of $56,750, with an option to expand that audit to include the entire office of the Treasurer-Tax Collector. Response: Concur.

California statutes provide that the Auditor-Controller has the authority and responsibility for the County's audit program. Response: Concur in Part. _ Pursuant to Government Code Section 26883 the Board of Supervisors instructed the Auditor-Controller to perform audits. 6/26/07 —_ Independent CPA Firms

The Auditor-Controller hires an independent Certified Public Accounting (CPA) firm each year to perform a financial statement audit and express an opinion on those financial statements. Response: Agree.

The independent auditor does not evaluate or express an opinion on the effectiveness of the County’s internal controls. Response: Partially agree. Although the external auditor does not express an opinion on internal controls, the auditor does consider the County’s internal control over financial reporting in order to determine their auditing procedures for the purpose of expressing an opinion on the financial statements.

F-58 6/26/07 The Auditor-Controller hires an independent Certified Public Accounting (CPA) firm each year to perform a financial statement audit and express opinion on those financial statements. Response: Concur With Clarification. The County contracts with an outside auditor on recommendation of the Auditor-Controller to the Board of Supervisors. The independent auditor does not evaluate or express an opinion on the effectiveness of the County's internal controls. Response: Concur in Part. As part of the financial audit, the independent auditor will evaluate internal controls to determine their level of substantive testing. Although the independent auditors do not express an opinion on the effectiveness of the County’s internal controls, they do prepare a management letter discussing deficiencies in controls that they believe should be addressed. The Auditor-Controller has changed audit firms three times in the past three years, e KPMG performed the fiscal year 2003-2004 audit. | e Macias Gina performed the fiscal year 2004-2005 audit. e Vavrine, Trine, Day performed the fiscal year 2005-2006 audit. Each of these firms was paid approximately $150,000 for their services. Response: Concur With Clarification. The County changed audit firms based on the recommendation of the Auditor-Controller to the Board of Sueprvisors. Changes in financial audit firms were due to pricing, failure to provide services per contract, and quality of services. Response: Concur.

Changes in financial audit firms were due to pricing, failure to provide services per contract, and quality of services. Response: Partially agree. It is practice to issue Requests for Proposals for audit services at least once every three to 5 years.

The CEO allocates funds to selected departments for independent management audits (e.g., review of internal controls, evaluation of department procedures and processes). Departments: receiving such budget allocations are not required to notify the CEO if their audits do not exceed $10,000. Response: Respectfully disagree. The CEO has budget funds for various management reviews. The CEO has engaged the services for such reviews. Limited coordination took place before such funds were expended, to minimize conflicting priorities with audits scheduled by the internal audit division. In general, departments are not allocated funds for audits. The exception to this is the Health Care Agency, which may engage outside audit firms to review the very specialized issues dealing with medical billings.

The Auditor-Controller is not included in the decision to hire management auditors, setting the scope of the audits, or informed as to the results of the work. Response: Partially agree. In the case of the most recent external audit of the Public Guardian/Public Administrator, the Auditor-Controller was consulted in reviewing the scope of the audit and reviewing the draft report.

6/26/07 Do not disagree, but this is more a conclusion than a finding. A review of the Auditor-Controller’s letters presenting the KPMG, Macias and Vavrinek contracts to the Board indicated that the Auditor-Controller believed that each contractor would “provide the best value considering such factors as experience with and knowledge of County operations, size of the firm and availability of resources, and audit approach and experience with similar size counties.” It should also be noted that the contracts were potentially for multi-year services, “...subject to satisfactory performance and approval by the Board of Supervisors.” The fact that the Auditor-Controller did not recommend the Board continue either the KPMG or Macias contract would Indicate the Auditor-Controller was not satisfied with some aspect of either cost or performance. The CEO allocates funds to selected departments for independent management audits (e.g., review of internal controls, evaluation of department procedures and processes). Departments receiving such budget allocations are not required to notify the CEO if their audits do not exceed $10,000. Response: Concur in Part. The CEO does not specifically allocate funds to departments for independent management audits. Occasionally, a department will request additional funding for such an audit and it will be evaluated in conjunction with all other requests for funds. A department has the ability within their allocated budget to fund audits, management reports, and studies to improve operations of the department. The Auditor-Controller is not included in the decision to hire management auditors, setting the scope of the audits, or informed as to the results of the work. Response: Do Not Concur. . Depending « on the type and scope of audit, the Auditor-Controller may be directly involved. Department heads are routinely notified that the Auditor-Controller should be involved in scheduling outside audits and participating in audit exit interviews. Response: The CEO is unfamiliar with the referenced notices and has not seen any reports from the Auditor-Controller identifying departments that have failed to comply. Audit Committee

In 1997 and again in 2002, the Government Finance Officers Association (GFOA) recommended that every governmental entity should establish an audit committee or its equivalent. [Ref-01] . Response: Agree.

The auditor of a state or local government's financial statements must be independent, both in fact and in appearance. A properly constituted audit committee helps to enhance the financial statement auditor's real and perceived independence by providing a direct link between the auditor and the governing board. [Ref-01] Response: Agree.

One role of an audit committee is to facilitate communication between management, the auditors, and the governing board. Response: Agree.

Response: Concur in Part. A properly constituted audit committee may enhance the Board of Supervisors administration and control over the audit function that is currently delegated to the Auditor-Controller. However, the Auditor-Controller currently has a direct communication link to the BOS. An audit committee may be of value, but if intended to be a go-between for Auditor-Controller to BOS, it would actually break the direct link that exists. C-13 The CEO has control of the agendas for BOS meetings, determining what issues will be represented for action. Effectively, elected officials must defer to the appointed CEO when they want BOS actions. (F-06, F- 08, F-11) Response: Do Not Concur. All elected officials have the right to place any issue they wish on the Board agenda and they do so regularly. In only one instance has the CEO ever made a recommendation opposing the substance of an issue brought by an elected official, and only after it was placed on the agenda for public discussion. 6/26/07 C-14 The CEO has failed to comply with the provision in the CEO ordinance that mandates maintenance of "...an adequate internal auditing system." Budgets for the Auditor-Controller developed by the CEO have left the Audit Division understaffed and with primarily junior-level personnel. As a consequence of denying appeals from the Auditor-Controller for additional resources, the BOS accepts this violation of its CEO Ordinance and is thus responsible for the consequences of an ineffective audit program. The Auditor-Controller must share in that responsibility by not presenting a sufficiently forceful argument to the BOS to override the CEO's recommended budget for the Auditor-Controller. (F-09, F-10, F-13, F-15, F-16, F-18, F-21, F-23, F-27, F-31, F-34, F-35) Response: Do Not Concur. Conclusion is based on flawed findings. The Auditor-Controller has received proportional share of scarce resources, has not filled all the positions authorized, has not spent budget approved by the Board, and has met her obligation to perform all mandated audits. C-15 The Auditor-Controller established a tri-annual Internal Control Self- Assessment Program, which the CEO and BOS endorsed. The head of each agency was required to ensure that its departments complete a detailed questionnaire to identify weaknesses in their internal controls. The Audit Division was responsible for reviewing the questionnaires to determine completeness, noting problem areas, assisting agencies with developing corrective procedures, and performing audits to ensure implementation of procedures. This program proved inadequate to ensure that the internal controls in the various County agencies were enforced. Not all agencies responded to the questionnaire. Audit Division staff is not adequate to review the questionnaires and follow up on their findings. (F-44, F-46, F-47, F-48) Response: Concur in Part. Agree with the conclusions stated up to the last sentence. The ability to follow-up on these questionnaires would have to be prioritized by the Auditor-Controller along with other work. The statement that the audit division staff is not adequate is not conclusive from the data presented. Auditor-Controller had sufficient resources to report the Treasurer's failure to complete the self-assessment questionnaire. 6/26/07 C-16 The BOS and CEO have ignored repeated warnings by the Auditor- Controller regarding the weakening of the Audit Division. The Audit Division's inability to "...establish a meaningful audit program for the County..." contributed to an environment where theft and embezzlement in the Public Guardian's Office were made possible. (F-21, F-23, F-27, F-29, F-30, F-31, F-34, F-36 through F-40) Response: Do Not Concur. The environment where theft and embezzlement occurred in the Guardian's Office was previously detected by the Auditor- Controller, but not corrected by the Public Guardian. The Auditor- Controller received approval from the Board of Supervisors for more resources than she was able to use, making the lack of additional resources moot. C-17 The CEO Ordinance has concentrated the County's fiscal and financial operations in the CEO's Office. Inadequate budget resources in the Auditor-Controller's Audit Division have reduced that organization's ability to provide an effective County audit function. A key consequence is the dilution of the checks and balances needed in government to ensure the integrity of its operations. This potentially impacts public confidence in County government. (F-07, F-14 through F-18, F-21, F-23, F-24, F-25, F-27, F-31, F-33, F-48, F-60) Response: Do Not Concur, Except for Last Sentence. Failure of any sort, particularly to correct known deficiency in control does impact public confidence in government. However, the weaknesses to the extent they may exist are neither the result of inadequate budget resources nor from placing more financial responsibility with the CEO. The Board of Supervisors provided more resources than the Auditor-Controller was able to use. The prioritization and production of work is a departmental responsibility. Checks and balances were not diluted by lack of appropriations and authority. The failure in the Guardian's office was not a failure to audit. It was a management failure to correct.

6/26/07 In 1997 and again in 2002, the Government Finance Officers Associate (GFOA) recommended that every government entity should establish an audit committee or its equivalent. [Ref-01}. The auditor of a state or local government's financial statements must be independent, both in fact and in appearance. A properly constituted audit committee helps to enhance the financial statement auditor's real and perceived independence by providing a direct link between the auditor and the governing board. [Ref-01] . One role of an audit committee is to facilitate communication between management, the auditors, and the governing board. The GFOA recommends the use of an audit committee to limit the reliance of governing bodies on the technical expertise of the independent auditor. According to the GFOA, an audit committee is also useful in helping to focus and document the government's process for managing the financial statement audit. Response: To F-62, F-63, F-64, F-65, and F-66 These are all statements taken from Recommended Practices adopted by the GFOA Executive Committee in October 2002. The primary focus is the independence “in fact and appearance” of the auditor of local government’s financial statements. The responsibility for preparation of financial statements varies across local government entities and within the same type of entities. The responsibility for auditing also varies; in some cities the auditor is an appointed position. Here at the County, that responsibility has been delegated to the elected Auditor Controller. GFOA guidance is advisory due to these vast differences in governmental structures. If the independence of the audit review of the County’s financial statements is in question, then there may be value to the Board of Supervisors in exploring ways to increase the independence, one of which may be an audit oversight committee.

The BOS approved a resolution on March 15, 1983, to create an Audit Advisory Committee. This action was prompted by Recommendation #1 in the report “Auditor-Controller’ of the 1981- 1982 Ventura County Grand Jury. Response: Agree.

The BOS approved a resolution on March 15, 1983, to create an Audit Advisory Committee. This action was prompted by Recommendation #1 in the report “Auditor-Controller’ of the 1981-1982 Ventura County Grand Jury Response: Concur in Part. There is no record of a resolution in connection with this matter. A board letter from Norman R. Hawkes, Auditor-Controller dated March 10, 1983 was approved by the Board of Supervisors on March 15, 1983. The full text of the recommendation contained in the Board Letter reads as follows: “Recommendation: Your Board is requested and it is recommended that you support the concept of an audit advisory committee for Ventura County and that you appoint Supervisor John Flynn to serve on that committee.” An Audit Advisory Committee of seven members — including a County Supervisor ~ was appointed in accord with the BOS resolution. However, the Audit Advisory Committee was never able to obtain a quorum for conducting a meeting and subsequently ceased to exist. In the Auditor-Controller’s response to the 2002-03 Grand Jury report, the BOS was informed that the Audit Advisory Committee no longer existed. Response: Concur in Part. Again, there is no record of a resolution in connection with this issue. The full text of both finding F-14 from the 2002-2003 Grand Jury Report on “Independent Auditing within Ventura County Government”, and the Auditor-Controller’s response is provided below: “F-14 Past Boards of Supervisors had members participating in an Audit Advisory Board. For the current Board of Supervisors, visibility into the audit process had been limited to the end product.” “Response: We partially concur with the finding. ._During the mid-80’s an Audit Advisory Committee existed. It ended due to lack of attendance at meetings. The Auditor-Controller has always been available to the Board of Supervisors, and input is requested for audit planning purposes each year from the Board of Supervisors, department heads and 6/26/07 -

F-70 6/26/07 County Executive Office. With the Fraud Hotline, semiannual reporting has been made to the Board of Supervisors.” The CEO is tasked by the CEO Ordinance to tract BOS directives and to monitor their implementation. Response: Concur. The 2002-03 Grand Jury report “Independent Auditing within Ventura County Government” recommended that the BOS establish an oversight mechanism such as an independent audit committee. “R-1. In order to insure that the County meets the newer standards for independent audit the Board of Supervisors establish an effective oversight mechanism to insure adequate ‘ audit resources and independence. “R-2. The Grand Jury recommends the establishment of an Audit Oversight Committee reporting to the Board of Supervisors. This committee would be charged with responsibility for oversight of internal controls and independent audits within the County. It would be composed of a Chair, a Co-Chair, The Chief Executive Officer, the Auditor-Controller, the Treasurer-Tax collector as a non-voting member, and one outside member from the private sector appointed by the Board of Supervisors. The Purpose of this committee would be: A. Oversee the establishment and maintenance of the County’s internal control structure. Oversee the quality of financial reporting activities. Oversee and monitor County compliance with internal controls, pertinent laws, regulations and standards. D. Oversee the resources allocated to the internal control and internal audit functions. E. Receive regular briefings from the internal audit staff on all planned and in process audits. F. Study the Orange County paradigm to internal audits with . a view to avoiding potential audit weaknesses.

The 2002-03 Grand Jury report “Independent Auditing within Ventura County Government” recommended that the BOS establish an oversight mechanism such as an independent audit committee.

F-72 G. Review the possibility of separation of the duties of Auditor-Controller. The Auditor responsibilities would return to its elected status while the Controller responsibility would report to the CEQ.” Response: Concur. This is a portion of the recommendations presented in the 2002-03 Grand Jury Report The responses from the BOS, CEO, and Auditor-Controller to recommendations R-1 and R-2 in the 2002-03 Grand Jury report were generally positive. Response: Concur in Part. The actual response was that the CEO “partially concur” to both recommendations and while the Auditor-Controller “partially concurred” with R-1 and agreed with the “spirit” of R-2, but there were specific concerns identified with the list of items A-G. The Auditor-Controller agreed to coordinate with the BOS and the CEO to determine the best course of action in the establishment of an Audit Oversight Committee by September 30, 2003. Response: Concur.

The Auditor-Controller agreed to coordinate with the BOS and the CEO to determine the best course of action in the establishment of an Audit Oversight Committee by September 30, 2003. Response: Agree. \)

Action to create an Audit Oversight Committee was never taken. 6/26/07 Response: The CEO is unfamiliar with the research, activity and action the Auditor-Controller may have undertaken internally relative to making a recommendation on establishing an Audit Oversight Committee. However, time and energy was invested in addressing other 2002-03 Grand Jury recommendations, including the issue of internal controls. The Auditor-Controller and the CEO jointly launched the Departmental Internal Control Self-Assessment Program. a Conclusions C-1 C-02 C-03 By State law, the Auditor-Controller, an elected official, is charged with responsibilities normally associated with those of a chief financial officer. The independence and effectiveness of the Auditor-Controller to perform essential elements of its statutory requirements, including operational audits for the County of Ventura, have been negatively impacted over the past six years. (F-01, F-02, F-03,