Title
a. Receive the County Administrative Office’s report regarding the Internal Audit function within the County of Monterey and options to implement a committee for internal audits oversight (Board Referral No. 2018.04); and
b. Direct the County Administrative Office to submit policies to the Board.
Report
RECOMMENDATION:
It is recommended that the Board of Supervisors:
a. Receive the County Administrative Office’s report regarding the Internal Audit function within the County of Monterey and options to implement a committee for internal audits oversight (Board Referral No. 2018.04); and
b. Direct the County Administrative Office to submit policies to the Board.
SUMMARY:
On February 6, 2018, County Counsel and the County Administrative Office (CAO) received a referral (Board Referral No. 2018.04) from the Monterey County Board of Supervisors (Board) to clarify authority lying within the Auditor-Controller’s Office (ACO) to conduct performance audits or reviews on County departments. Concern was raised when the ACO notified departments that they would be contracting with an accounting firm to review programs such as the Lakes and cannabis taxes, and that departments would have to pay for these costs. The Office of the County Counsel issued an opinion that the authority to initiate a performance audit lies with the Board and only the Board can delegate that authority. The Office of County Counsel and the CAO were unable to find any records where this authority has been delegated to the ACO. The CAO conducted an analysis of internal audit programs and processes within other California counties as a means of comparison and best practices.
DISCUSSION:
California Government Code section 1237 states that all state and local agencies with an aggregate spending of fifty million dollars ($50,000,000) or more annually shall consider establishing an ongoing audit function. An internal audit program can provide assurance regarding an organization’s risk management, governance, and internal control processes that can lead to a more effective and efficient operation. An internal audit is independent and objective, and governed by established framework including standards set by the Institute of Internal Auditors or the Government Auditing Standards issued by the Comptroller General of the United States. Internal audit programs often follow both standards, as seen fit. Using risk assessment techniques and prioritization, the County can work towards ensuring programs are operating efficiently and addressing any issues of non-compliance through follow up audits. Some counties have also established whistle blower programs or a fraud hotline to investigate claims of fraud, waste, misuse, and abuse. Depending on the set of standards followed, the internal audit division should have a peer review every 3 or 5 years.
The ACO currently has one chief deputy auditor and one internal auditor; however, there are no policies or written procedures for the internal audit process, and audit activities have been conducted independently of the Board. There is no audit plan in place and departments have not budgeted costs for audits. Departments expressed concern they were suddenly notified by the ACO that they would be contracting out reviews or audits of certain programs and that those departments were expected to pay for costs of the audit. The proposed audits were not presented to any committee nor the Board. The purpose and scope of these audits were not defined nor prioritized with any transparency as to the process of selection. To date, the ACO has not presented any formal policies or an audit plan for the Board to consider and has communicated it is at the ACO’s discretion what reviews to perform.
The CAO has researched internal audit programs within other counties to help clarify the process and function of such programs to ensure that the County’s is consistent with best practices.
Government Code section 26881 states that upon order of the board of supervisors, the auditor-controller shall have the ability to review departmental and countywide internal controls for departments and institutions under the control of the board. Our research did not find any Order by the Board that had delegated such audit authority to the ACO. Furthermore, Government Code sections 26882-26886 indicate the Board of Supervisors has power to enter into contracts for audits and request the county auditor-controller to audit accounts and records of any organization under its control; if fraud or gross negligence are discovered, a copy of the report should be filed with the district attorney. The Board can provide authority in whole or for specific audits depending on the policies adopted. In conformance with Government Code, counties who follow best practices have established procedures including policies adopted by the their boards of supervisors granting authority to conduct audits of county departments.
The internal audit programs in other counties generally lie within the auditor-controller, with the chief internal auditor reporting directly to the auditor-controller, but also have reporting requirements on audit results, policies, and the audit plan to a committee and/or the board of supervisors. Most of the counties researched have an audit “charter” adopted by the board of supervisors and which provides direction, guidance and grants authority to conduct audits. These counties conduct audits and internal control reviews in accordance with an annual audit plan, that details the proposed programs to be audited in the fiscal year as well as criteria for prioritizing such audits.
Staff recommends that 1) an audit committee be formed or integrated into the existing Budget Committee; 2) Internal Audit policies be prepared and submitted to the Board for approval; and 3) an annual audit plan be prepared and submitted to the Board for approval. This would allow for a clear understanding of the program’s process and functions to the Board, county departments, and the public.
• The audit committee could be a stand-alone committee or it could be integrated into the Budget Committee and provide guidance and oversight to the internal audit program. The Budget Committee includes two members of the BSO, the CAO, County Counsel, the Assistant CAO, and Budget Director, as well as elected officials including the Treasurer-Tax Collector, the Auditor-Controller, and the Assessor-Clerk-Recorder. Having a committee overseeing the program ensures independence and a level of public accountability for effective and efficient program operation and compliance with regulations. Some of the functions of the committee would include: receiving reports including the annual audit plan and results of internal audits performed; prioritizing audits and accommodating any pressing issues or concerns; determine funding for audits not funded in the audit plan and/or outsourced; and request reviews and authorize investigations into any matter within the scope of responsibility.
• It is recommended that the ACO prepare policies that outline the framework of the internal audit program. Such policies typically include, amongst other things, the purpose and objective of the internal audit program, authority to the internal auditors to perform audits, the established independence of the internal auditors, an outline of the roles of the committee overseeing the program, responsibilities and protocols, and the professional standards the program would employ. The policies should be adopted by the Board to grant authority to the ACO to perform audits independently, or provide for the hiring of outside auditors, and allow full and unrestricted access to necessary records to complete internal audits and review.
• The annual audit plan would be prepared by the ACO utilizing risk assessment methodology and professional standards to determine what programs should be audited. This plan should be presented to the audit committee annually for the upcoming fiscal year. The plan should include any foreseeable work that is contracted out and audits and reviews that would be performed in-house. The Chief Deputy Auditor-Controller overseeing internal audits could report the progress of audits and findings to the committee on a monthly or quarterly basis. Additionally, the committee or the Board would be able to request additional audits not on the annual audit plan, as they deem necessary.
OTHER AGENCY INVOLVEMENT:
The County Administrative Office reviewed the policies and programs of various other counties (as outlined in the enclosed attachment) to document the structure of an internal audit function, and to understand their respective organizational structure and operational procedures of the internal audit function.
FINANCING:
There is no cost associated with the receipt of this report.
BOARD OF SUPERVISORS STRATEGIC INITIATIVES:
Establishing framework for the internal audit program and allowing Board to direct the Auditor-Controller to audit all County departments and organizations under the Board’s control will provide internal control processes, Board governance, and meets the Board of Supervisors strategic initiative for Administration
Check the related Board of Supervisors Strategic Initiatives:
__Economic Development
X Administration
__Health & Human Services
__Infrastructure
Public Safety
Prepared by: Raquel Escorcia, Administrative Analyst, x5030
Approved by: Paul Lewis, Budget Director, x3078
Approved by: Dewayne Woods, Assistant County Administrative Officer, x5309