Submittal to the Board of Supervisors County of Riverside, State of California From: Executive Office Submittal Date:

Evidence clearly shows that staffing shortages have plagued the Auditor- P Controller's Office since 1990. This matter has been brought to the attention of the Board of Supervisors in six (6) past Riverside County Grand Jury Reports. (19 90, 1992, 1993, 1996, 1997 and 2001) In 2001 the Riverside County Grand Jury issued a report on the Riverside County Internal Audit Unit, concluding that the IAU was inadequately staffed. In May 2002, the Board of Supervisors allocated funds to the IAU for three (3) additional senior auditors, bringing the total number of senior auditors to six (6). In February 2004, an eight percent (8%) budget cut was decreed by the Board of Supervisors resulting in the loss of twenty-three (23) posit'is, eleven (1 1) staff, and twelve (12 ) temporary positions in the Auditor-Controller's Office. In May 2004, one senior auditor resigned, reducing the senior auditing positions to five (5). Response: Respondent agrees with the finding.

The Riverside County Board of Supervisors have utilized the county's comprehensive annual financial report (CAFR), to meet the requirements of Government Code Section 25250 and Board of Supervisors' Resolution 83-338. The CAFR audit is not an indepth analysis of county operations. Without an in-depth audit, this deprives the Board of Grand Jury Report: Riverside County Auditor-Controller Internal Audit Unit Supervisors, County Executive Officer and Department Directors of information necessary to make sound fiscal evaluations and decisions. Response: Respondent agrees with the finding. The Board of Supervisors appreciates the purpose and intent of Government Code Section 25250, and is working with the Auditor-Controller toward the goal of compliance with it. Findinn 3: A severe staffing shortage has resulted in: Non-compliance with laws, regulations, policy and procedure. Difficulty in performing operational audits or special audits without adversely impacting the two-year auditing cycle. Inability to perform routine financial functional and operational audits. Failure to provide the taxpayers with accountability in spending public funds. Response: Respondent disagrees partially with the finding. Clearly, the chronic vacancy rate in the Auditor-Controller's Internal Audits unit certainly played a significant role in statutory audits not being performed as timely as possible. At the same time, deployment decisions made by the Auditor-Controller play an equal role. Frequently, the Auditor-Controller pulled Internal Audit staff off internal audit projects to assist with the CAFR or other projects within the department. In addition, it must be emphasized the Auditor-Controller does not have a statutory responsibility to conduct operational, managerial, or performance audits. The Auditor-Controller's statutory responsibility is for financial audits. The Board of Supervisors is responsible for overseeing operational performance, and has resources in place in the Executive Office to conduct performance reviews as necessary. If the Auditor- Controller assigns resources to this type of activity, it affects their ability to complete their statutorily required two-year audit cycle. Findinn 4: Riverside County has the largest average number of county employees and the fourth largest budget with a disproportionate auditing staff as shown in chart below: L Riverside ~~. ~~5 1 Grand Jury Report: Riverside County Auditor-Controller Internal Audit Unit - , Response: Respondent disagrees wholly with the finding. The number of internal auditing staff required for any given county is not a corollary of either the magnitude of their budget or their number of employees. By this logic, if we use Ventura County's listed budget-to-auditor ratio (0.0109 per million) as the benchmark, then San Bernardino would have 26 auditors instead of 16, Orange County 56 instead of 17, San Diego County 37 instead of 20, and Riverside County 24 instead of 6. Likewise, if we use San Diego County's listed employee-to-auditor ratio (1.4286 per thousand) as the benchmark, then San Bemardino would have 23 auditors instead of 16, Orange County 24 instead of 17, Ventura County 11 instead of 7, and Riverside County 27 instead of 6. In addition, the staffing level of the intemal audits units of other counties may be driven by any number of factors that may or may not apply to Riverside County. For instance, both Orange County and San Bemardino County experienced unusual financial and managerial circumstances in recent years that without doubt influence their need for their current staffing levels. The Board of Supervisors supports right sizing staffing levels based on the most efficient and effective use of the resources necessary to perform a core function. The Board supports allocation of resources based on demonstrated performance to achieve specified goals, and continues to work with the Auditor-Controller toward this objective. P..

A severe staffing shortage has resulted in: /-- Non-compliance with laws, regulations, policy and procedure. Difficulty in performing operational audits or special audits without adversely impacting the two-year auditing cycle. Inability to perform routine financial functional and operational audits. Failure to provide the taxpayers with accountability in spending public funds. Response: Respondent agrees with the finding.

Riverside County has the largest average number of county employees and the fourth largest budget with a disproportionate auditing staff as shown in chart below: - San Eemardino 26 $2,378,MUp251 203-2004 16,0430 : Oranae 37 $5,086,921,444 2003-2004 17,WM1 , : San Dim0 2.43 5.3,414,398,W 2002-2003 14,OUO I : VenWra 7 $641,215,0!20 2003-2W 8,QW Riiemide 5 $2,211,37 t,B5Q 2003-2004 19,WQ : Response: Respondent agrees with the finding.

Frequent auditing requests from county department directors for internal audits are causing limited audit resources to be diverted from other needed areas or the requests cannot be met. Response: Respondent agrees with the finding. However, this is largely a function of the Auditor-Controller's deployment decisions. 'The Board of Supervisors supports establishing firm priorities and performance measures in the Auditor-Controller's annual audit plan. 'These should focus first on core statutory functions and high-risk issues, with sufficient flexibility in workflow planning to address a manageable number of unforeseen urgent issues. Findina 6: 'There are thirty-eight (38) departments in Riverside County whose budgets ace required to be audited by the Auditor-Controller. Approximately twenty-two (22) departments have not had an in-depth audit, within the last five (5) years, as well as the County Board of Supervisors and the County Treasurer's Office. Response: Respondent agrees with the finding. Findinsr 7: A shortage of intemal auditors has hampered the process of performing risk based audits, resulting in a selected review of higher risk areas in the departments and use of a system control audit approach with limited testing. Grand Jury Report: Riverside County Auditor-Controller Internal Audit Unit Response: Respondent disagrees partially with the finding. As detailed above, the .- \ number of staff authorized is only one among many factors that influence the Internal Audit unit's performance. In the view of the Board of Supervisors, the unit's vacancy rate and management's deployment of resources play a greater role.

There are thirty-eight (38) departments in Riverside County whose budgets are required to be audited by the Auditor-Controller. Approximately twenty-two (22) departments have not had an indepth audit, within the last five (5) years, as well as the County Board of Supervisors and the County Treasurer's Office. Response: Respondent agrees with the finding.

A shortage of internal auditors has hampered the process of performing risk based audits, resulting in a selected review of higher risk areas in the departments and use of a system control audit approach with limited testing. /--- Response: Respondent agrees with the finding. Subject: 2003-2004 Grand Jury Report, Riverside County Auditor-Controller InternalA udit Unit /---

Outside CPA firms, used by county departments to perform the function that the Auditor-Controller is elected to do, results in duplication of costs and waste of taxpayer's dollars. Response: Respondent disagrees wholly with the finding. The County does not hire outside CPA firms to perform the Auditor-Controller's statutorily required internal audit responsibilities. The County retains professional services of accounting firms as needed to address special projects. This is not duplicative of the Auditor-Controller's role, nor is it in conflict with the Auditor-Controller's authority or statutory responsibility.

The Auditor-Controller is not afforded the option to have any input as to the selection of CPA firms, type of audits performed or fees incurred for the outside audits. Response: Respondent disagrees wholly with the finding. The Auditor-Controller's office participates in procuring auditing and accounting services when appropriate and necessary. However, there are occasions when it is appropriate and within the discretion of a department or the Board of Supervisors to retain such professional services without input from the Auditor-Controller. This is not in conflict with the Auditor-Controller's authority or statutory responsibility.