Riverside County Auditor-Controller Internal Audit Division

Sworn testimony heard by the Grand Jury revealed that nine of the scheduled internal audits for FY 2010/2011 were not completed due to a lack of manpower and/or due to the fact that they were not mandated. Only one of these audits was carried over to the FY 2011/2012 Internal Audit Plan. Two of the internal audits in the FY 2010/2011 plan were prompted by employee complaints via the Countywide “Speak Out!” program that focuses on fraud, waste, and abuse. A “Speak Out!” complaint, concerning the excessive use of overtime in the Sheriff’s Department, prompted an investigative audit to be scheduled in FY 2010/2011. This audit, along with eight other scheduled audits, was eventually cancelled for either lack of manpower or because they were not mandated. It is the considered judgment of this Grand Jury that because it is law, lack of manpower is not an excuse for failure to perform these audits. Further, no concern about this failure has been expressed by the County Executive Office, Board, or the Auditor-Controller’s Office. The decision to cancel planned audits due to lack of manpower or because they are not mandated may be construed as a disservice to the taxpayers, as well as to the Board and department directors. Special Districts

Another function of the Audit Division is to ensure that all special districts in the County receive an annual financial audit. These audits are usually performed by public accounting firms. The Government Accounting Standards Board Statement No. 34 requires the inclusion of a Management Discussion and Analysis, which is a simple explanation of the results of the audit that can be easily understood. The Audit Division monitors and reviews these financial statements to ensure that they are conducted as required by Government Code §26909(a) and §6505(d). The Audit Division is not proactively pursuing delinquent audits of special districts, thereby placing at risk the fiduciary responsibility of these special district boards that are accountable to the taxpayers. The Audit Division has failed to review these special district audits in depth and ensure that recommended corrective actions were taken within a reasonable time frame. This results in the Auditor-Controller having no positive influence on the financial practices of special districts, a deficiency with unknown consequences. Certain special districts have been habitually delinquent, as much as two to five years, in conducting their mandated annual audits. In the case of one special 3 district, Idyllwild Fire Protection District, the Management Discussion and Analysis was omitted from the report to the Audit Division at the request of the special district board. This omission violates Government Accounting Standard Board Statement No. 34, the rights of taxpayers to know the financial status of their district. The Audit Division’s present procedures require that reminder letters be sent to all special districts that are delinquent beyond twelve months after the end of the fiscal year. The timing of these letters, in effect, grants the delinquent special district an additional six months beyond the due date mandated by Government Code §26909(a)(2) and §6505(d). Policies and Procedures

The Audit Division is operating with a draft copy of its policies and procedures, a document that has been dormant, in draft stage since July 2009. This deficiency was previously noted in a peer review report by the San Diego Auditor- Controller’s Office in 2006. When an internal audit of a County department is initiated by the Audit Division, the first request is that the department provide a copy of its policies and procedures. If they are non-existent, it becomes a major finding. Operational Review

In July 2011, the Auditor-Controller retained IntelliBridge Partners, an outside consulting firm, to perform an operational review of the Audit Division. The purpose of the review was to assess the County’s efficiency and effectiveness in audit planning, execution, and reporting process, as well as to examine the Audit Division’s organizational structure. This review was produced at a cost of $38,000. It was similar in content and recommendations to the peer review assessment of 2006 conducted by the San Diego Auditor-Controller’s Office. The peer review cost nothing. The contracted consulting firm recommended: • working with the Board to revise Resolution 83-338 from auditing each County department every two years to auditing County departments based upon risk-based management criteria (e.g., high risks of fraud, waste, abuse or having a high potential to identify cost savings, or to enhance service delivery.) • hiring an audit chief executive from outside of the County that has experience in conducting all types of audits (e.g., internal, financial, performance, and compliance) and has a demonstrated track record of working with key stakeholders to produce cost savings and enhance 4 service delivery. (Note: The Auditor-Controller did not follow this

Prior to September, 2009 the County lacked a fraud policy and hotline. Such a policy is required by the American Institute of Certified Public Accountants (The Institute) and California Government Code §53087.6. The Institute issued two statements on Auditing Standards SAS 99 and SAS 115, which mandate the need to establish a fraud hotline. These requirements were noted as significant deficiencies by outside auditors in management letters in the years 2005 through

Sworn testimony given to the Grand Jury, as well as written documentation, were replete with issues involving Audit Division management: • lack of training for auditors, • turnover of personnel, • tardiness of audits, • insufficient number of auditors to cover Countywide obligations, • auditors burdened with non-auditing responsibilities, and • Audit Division intimidating work environment.