County of Santa Barbara County Administration Building*

The Internal Audit Division of the Santa Barbara County Auditor-Controller's Office had a funded and filled staff of 10 FTE prior to the 2008 recession. Just prior to the discovery of the 2017 fraud, the funded staff had fallen to 5 FTE, and only 2.5 of those were filled. The Auditor-Controller agrees with the finding.

The financial management guidelines issued by the County of Santa Barbara Auditor- Controller are not applied consistently in operational departments, nor is compliance with those guidelines routinely audited by the Auditor-Controller. The Auditor-Controller partially disagrees with this finding. The Auditor-Controller does undertake compliance monitoring engagements for sensitive areas such as contract compliance; credit card policy compliance; cash handling policy compliance for petty cash transactions and cash counts at cash handling locations; and the Auditor-Controller has implemented a project to review the internal controls of departments with agency funds to test the department's compliance with the agency fund accounting policy and procedures.

Knowledge of financial management and risks by managers in some departments in the County of Santa Barbara is insufficient. The Auditor-Controller agrees with the finding.

Knowledge of potential conflicts of interest among some senior County of Santa Barbara employees is inadequate. The Auditor-Controller partially disagrees with the finding as the Auditor-Controller currently does not have insight regarding the Grand Jury's determination of inadequacy of County employees' general understanding of what conflicts of interest are. The County has adopted a Conflict of Interest Code whereby senior County employees in each department are required to complete a Fair Political Practices Certified Statement of Economic Interests Form 700 on an annual basis.

There is no consistent policy of requiring program heads, division heads, or department heads within Santa Barbara County departments to account for spending under their control to their superiors and/or to the CEO through an annual formal and written statement. The Auditor-Controller disagrees partially with the finding. All department heads, including elected officials, along with each department's chief financial officer, sign annual Fiscal Year End Certification and Representation Letters that make assertions as to fiscal oversight, revenue and expenditure accounting, expenditures of federal awards, capital assets under their purview, long term liabilities incurred, theft or fraud experienced, and any related party transactions. The department head and CFO signatures are representative for their whole department. Additionally, the County Executive Office requires quarterly budget to actual reporting for all departments. The Office of Budget and Research compiles this data and reviews it for significant variances. In the event that a department anticipates to materially exceed their budget, the Budget Director requires that the department submit an explanation for the budget overrun. The departmental response is then compiled into the Quarterly Report and presented to the Board of Supervisors. The CEO regularly monitors each department's actual performance to the legally adopted budget. The County's FIN system has built-in controls that will not allow any expenditure that would exceed each department/fund's legal level of budgetary control, which is the expenditure object level.

The Jury found that the importance of the work of the Internal Audit Division within the Office of the Auditor-Controller and of internal controls generally has a low priority across County government. The Auditor-Controller agrees with this finding.

It was stated by senior staff that a comprehensive investigation into the strengths and weaknesses of the internal controls in the County would be conducted by an outside consultant after the fraud; no such investigation took place. The Auditor-Controller disagrees partially with this finding. Senior staff stated "The County will be ordering a forensic audit by an independent accounting firm and review of internal controls, financial systems and policies." The County hired an independent forensic accounting firm that investigated and documented the fraud. The same firm has been contracted to provide an assessment of the budget and financial policies of the County and that project is in process. The Internal Audit Division and the County's independent auditors are currently conducting a review of the internal controls over agency funds in each department.

The Financial Information Network is an insufficient and inefficient system with many weaknesses that have caused most departments to create, or to have created, complementary financial software. Some of the weaknesses in FIN may have contributed to the 2017 Department of Public Works fraud. The Auditor-Controller disagrees wholly with this finding. FIN is not an insufficient or inefficient system and is functioning well as designed. No financial system can provide for every need of an organization, especially one like the County that provides a myriad of diverse and unique services. Complementary systems for specialized operations will be necessary with any financial system. According to the forensic accounting firm that investigated and documented the fraud in the Public Works Department, the employee was able to perpetrate the fraud because there was no segregation of incompatible duties; she was overly trusted; she had little direct oversight; she acquired her supervisor's password; and she created fictitious documentation. None of these are FIN system weaknesses. 0.0