Do the Right Things Right! County Auditor’s Annual Performance Report Fiscal Year 2004 Maricopa County, Arizona Executive Summary Internal Audit’s Mission To: Andrew Kunasek, Chairman, Board of Supervisors Fulton Brock, Supervisor, District I Don Stapley, Supervisor, District II Max W. Wilson, Supervisor, District IV Mary Rose Wilcox, Supervisor, District V To provide objective, accurate, and meaningful information about County operations so the Board of Supervisors can make informed decisions to better serve County citizens From: Ross L. Tate, County Auditor Date: October 29, 2004 Internal Audit Assists With Health System Transition Work In January 2004, under the direction of the Board of Supervisors, Internal Audit realigned its focus to concentrate on Maricopa Integrated Health System (MIHS). By revising the fiscal year 2004 Audit Plan, Internal Audit was able to provide assistance to County Management during a critical transition of health care operations to a Special Health Care District. Internal Auditors are Good Investment Internal auditing is a good investment for operational improvement and fraud deterrence. The presence of internal auditors can deter employees from committing fraud because of the perceived danger of getting caught. $6 Millions $5 continue to exceed its cost. A well run internal audit function is an investment that benefits County management and citizens. $4 Savings produced by Internal Audit $3 $2 When the cost savings from fraud and error detection is combined with the deterrent effect, the value of auditing activities is even more evident. Internal Audit savings Internal Audit Cost vs Savings Produced $1 Audit Budget $0 FY96 FY97 FY98 FY99 FY00 FY01 FY02 FY03 Federal Action Requires Strengthening of Internal Control Environment In recent years, the federal government has acted to require strengthening of financial controls in publicly-held companies. For example, these companies must: ƒ ƒ Have an internal audit function and audit committee Be in compliance with stringent laws and regulations These new regulations have raised the bar for all organizations. Some local governments are considering voluntary adoption to promote accountability. i FY04 Maricopa County Leaders Recognize Value Maricopa County leaders have long recognized the value of internal controls, accountability, and transparency in government. They have wisely invested in an independent internal audit function, reporting directly to the Board of Supervisors. Internal Audit also has an advisory reporting relationship to a Citizen’s Audit Advisory Committee, which the Board established in 1997. Chairman Kunasek and Internal Audit celebrate national recognition for fiscal year 2004: 2 NACo Awards, 1 national audit award, and 1 national writing award (not shown). See page v for details. Internal Audit is Active in Regional Leadership Aligning its strategic goals with those of the Board of Supervisors, Internal Audit takes an active role in local, regional, and national events. Below are two examples of our involvement on a national level. County Auditor Ross Tate and IT Auditor Tom Fraser were invited to the annual conference of the National Association of Local Government Auditors in Richmond Virginia to present Maricopa County’s success in using computer assisted auditing technology. Ross Tate presented Maricopa County’s experiences and lessons learned in auditing County performance measures last summer at the Association of Government Accountant’s annual conference in Washington D.C. ii Organizational Independence Internal Audit reports directly to the Board of Supervisors, with an advisory reporting relationship to a Citizen’s Audit Advisory Committee. Board of Supervisors Andrew Kunasek District III Don Stapley District II Max W. Wilson District IV Mary Rose Wilcox District V Fulton Brock District I Citizen’s Audit Advisory Committee Internal Audit County Management iii Citizen’s Audit Advisory Committee Ralph Lamoreaux (seated, far left) is a CPA with a BA degree (accounting emphasis) from Southern Utah University and an MBA from the University of Utah. He worked 33 years with the U.S. General Accounting Office: 5 years at the Denver regional office and 28 years at Washington D.C. headquarters. He retired in July 2000. District I Supervisor Fulton Brock appointed him on August 8, 2001. Jill Rissi (seated, 2nd from left) is an RN with degrees in psychology and nursing and a masters in policy analysis and program evaluation from ASU. She has 18 years of auditing, budgeting, financial administration, program and policy development, and healthcare experience. Ms. Rissi has overseen various clinics and programs and is currently the Associate Finance and Administration Director at St. Luke’s Charitable Health Trust. Appointed by District II Supervisor Don Stapley on April 5, 2000. Victoria Prins, Chairperson (seated, 3rd from left), is a CPA and a Certified Government Financial Manager. She has an accounting degree and an MPA from ASU. Ms. Prins has accounting and management experience in city, county, and state government. She is the Arizona Supreme Court Chief Financial Officer. Appointed by District III Supervisor Andrew Kunasek on April 2, 2003. Ryan Brownsberger (seated, 2nd from right), is a CPA with an Iowa State University accounting degree and an MBA from ASU. He has 8 years of experience in auditing, accounting, budgeting, and business management. He currently is an independent contractor for Citigroup through Primerica Financial Services. Appointed by District IV Supervisor Max Wilson on June 1, 2003. Richard Lozar (seated, far right), has extensive experience in accounting and management. He worked as a Controller and General Manager in the hospitality industry and as an Accounting and Financial Consultant. Mr. Lozar is currently the Director of Business Affairs for Cook College & Theological School in Tempe (a school for Native Americans). Appointed by District V Supervisor Mary Rose Wilcox on May 14, 1997. Tom Manos, County Chief Financial Officer (standing, far left), has been Maricopa County’s CFO since 1997. Dennis Levine, Office of the Auditor General (standing, 2nd from left), is a CPA and a Certified Government Financial Manager. He has degrees in accounting and psychology from ASU and has been with the State of Arizona, Office of the Auditor General since 1979. Mr. Levine has been a Financial Audit Manager with the Office's Financial Audit Division since 1986 and has overseen audits of state agencies, universities, counties, community colleges, and school districts. He has been the audit manager on the Maricopa County audit since 1998. Ross Tate, County Auditor (standing, 2nd from right), see page 9 for his biography. William S. Knopf, Office of County Counsel (standing, far right), has been an attorney with the Maricopa County Attorney’s Office since 1979. iv National Awards Received National Association of Counties 2004 Achievement Award Performance Reporting for Citizens National Association Conference Phoenix, Arizona July 2004 2004 Achievement Award Continuous Monitoring 2003 Honorable Mention Knighton Award Nat’l Assoc. of Local Government Auditors Countywide Fixed Assets National Association Conference Richmond, Virginia, May 2004 2004 Certificate of Recognition Association of Government Accountants Service Efforts & Accomplishments Program Charter Participant 53rd Annual Professional Development Conference Washington, D.C., June, 2004 v 2004 Award of Excellence APEX (Awards for Publication Excellence) Investment & Financial Materials Category Financial Condition Report Internal Audit Writes National Article The County Auditor and audit staff members wrote a two page article titled “Ensuring the Accuracy of Performance Measures” in the November/December 2003 issue of Government West magazine. Previous awards . . . National Association of Local Government Auditors 2002 Commitment to Quality Improvement Award Institute of Internal Auditors 2002 Special Project Award Performance Measure Certification Maricopa County Internal Audit 2001 Special Project Award Financial Condition Report 2000 Special Project Award Cash Handling Workshop 2002 Award of Excellence Gov’t Finance Officers Association Performance Measure Certification Program National Association of Counties 2002 Achievement Award Performance Measure Certification 2001 Achievement Award Financial Condition Report 2003 Distinguished Local Government Leadership Award Association of Government Accountants “Got Controls” Management Bulletin Ross Tate, County Auditor 2000 Achievement Award 2001 Achievement Award Cash Handling Workshop vi Award Winning Products Control Bulletins Our one-page “Got Control” bulletins communicate important control issues to County executives, managers, and employees.  National Association of Counties Achievement Award (2001) Control Self Assessment These workshops help employees determine their department’s control weaknesses and risks. Entertaining videos are featured with County management and elected officials demonstrating the right and wrong way to handle cash, monitor contracts, and process payables. National Association of Local Government Auditors Special Project Award (2000)  National Association of Counties Achievement Award (2000)  Financial Condition Report We annually assess and report on Maricopa County's financial condition in a highly visual, user-friendly, annual Financial Condition Report. This report displays key financial trends and compares Maricopa's performance with those of 10 western US counties. APEX (Awards for Publication Excellence) Award of Excellence (2004)  National Association of Local Government Auditors Special Project Award (2001)  National Association of Counties Achievement Award (2001)  Performance Measure Certification In response to Maricopa County’s adoption of a performance management system, Managing for Results, we review inputs, outputs, efficiency, and progress toward outcome goals. We assign and report certification ratings to County leaders and top management. National Association of Counties Achievement Award (2002)  Government Finance Officers Association Award for Excellence (2002)  National Association of Local Government Auditors Special Project Award (2002)  Citizens’ Report The Citizens’ Report provides citizens, the Board of Supervisors, and County administration with a new tool for evaluating public policy and reporting government accountability. National Association of Counties Achievement Award (2004)  Association of Government Accountants Certificate of Recognition (2004)  National Center for Civic Innovation $30,000 Grant (Alfred P. Sloan Foundation) (2004)  vii Information Technology Services The County’s increasing reliance on Information Technology (IT) can increase productivity but can also increase the risk of unauthorized changes, data destruction, errors, unauthorized access to confidential data, downtime, and fraud. Because of these risks, we developed an IT audit function staffed by dedicated, experienced IT auditors who perform the following activities:  Continuous Monitoring IT audit staff continuously monitor certain types of County transactions to ensure that County resources are used appropriately. These monitoring efforts focus on high-risk areas, such as routinely checking vendor payments. If resources are available, this function will be expanded to use fraud detection software to monitor and assess p-card (credit card) payments.   National Association of Counties Achievement Award (2004) IT General Controls and Application Audits IT General Controls and Application audits focus on reviewing the adequacy of each department’s computer system controls to ensure County data integrity, confidentiality, and availability. Audit examples are: payroll application, financial application, and data center operations.  Virus Detection / Vulnerability Assessments Viruses and other types of computer attacks can be a serious threat to County operations. The County can deter these dangerous attacks by using aggressive virus protection systems and appropriate security measures. IT audit staff regularly reviews computer virus detection efforts and system vulnerability to ensure that proper controls are in place to reduce the risk of attack. An attack could cost the County a productivity loss up to $126,350 each hour.  System Development Assessments We encourage County departments to use approved systems development methodologies when they develop new systems or enhance existing systems. These methodologies include: project management controls, logical access controls, test and training controls, and project implementation controls. IT audit staff is currently involved with monitoring the Integrated Criminal Justice Information System (ICJIS) development project.  Web Page Management We designed our Internal Audit web page to provide useful information to County management, employees, citizens, and peers. Our website contains copies of our reports plus some tools we use for effective auditing. viii Vision Internal Audit’s vision is to facilitate positive change throughout County operations while ensuring that public resources are used for their intended purpose. “Do the right things right!” Table of Contents Page Performance Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Inputs / Resources & Outputs . . . . . . . . . . . . . . . . . . . . . . . . 6 Appendices: A ~ Professional Staff Biographies . . . . . . . . . . . . . . . . . 9 B ~ Project Summaries . . . . . . . . . . . . . . . . . . . . . . . . . 13 C ~ Other Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 D ~ Single Audit Reviews . . . . . . . . . . . . . . . . . . . . . . . 29 E ~ Internal Audit Department Profile . . . . . . . . . . . . . . 30 F ~ Citizen’s Audit Advisory Committee Charter . . . . . . 33 G ~ Internal Audit Department Charter . . . . . . . . . . . . . 35 Performance Results Internal Audit’s Four Goals Assist the County in its mission to provide fiscally responsible public services by: ♦ Goal 1: Completing 90% of the Board of Supervisors' approved annual Audit Plan and reporting this objective, accurate, and meaningful information to the Board in a timely manner; no later than 90 days after the fiscal year-end. ♦ Goal 2: Providing objective, accurate, and meaningful information in a way that earns a 90% customer satisfaction rating each year from our primary customers, namely, the Board of Supervisors and the County Administrative Officer. ♦ Goal 3: Working with clients to ensure that 90% of audit report recommendations are implemented within three years of being reported. This goal will also assist Internal Audit in its vision to facilitate positive change throughout the County. ♦ Goal 4: Becoming a regional leader. Create and produce innovative, effective audit products and methodologies and share these on a regional and national level through publications, presentations, and award programs. Programs Internal Audit is Managing for Results (MfR) through two programs: Audit Services and Management Services. (MfR is Maricopa County’s performance management system.) Internal Audit Audit Services Program Management Services Program Provide independent assessments and recommendations to the BOS and County management so they can make informed and fiscally prudent decisions. Provide strategic information and education to County officials and employees so that they can perform their jobs more effectively. Consulting Education & Training Information & Reporting 1 Key Performance Measures Internal Audit has seven key performance measures (with FY 2004 results): Audit Services Program ♦ 97% of IA recommendations were concurred with by clients ♦ 99% of IA recommendations were implemented within three years ♦ 96% satisfaction rating was received from Board and County Management for audit reports ♦ $1,371,236 economic impact was achieved Management Services Program ♦ 100% satisfaction rating received from customers indicating consulting services delivered by Internal Audit helped them do their job ♦ 86% satisfaction rating received from customers indicating educational efforts (newsletters, courses, etc.) help them do their job more effectively ♦ 100% overall approval rating achieved for Internal Audit’s strategic information reports by Board of Supervisors and key County management The following pages illustrate Internal Audit’s results. Economic Impact Although the amounts vary each year, Internal Audit’s economic impact (savings) continues to exceed its cost by a comfortable margin, as shown below. A well run internal audit function is an investment that benefits County management and citizens. Internal Audit has identified/recovered 3 times its budget in cumulative savings over the past 8 years. (Note: Budget shown in graph below includes co-source dollars.) Internal Audit Cost vs Savings Produced $6 $5 Millions $4 $3 Savings produced by Internal Audit $2 $1 Audit Budget $0 FY96 FY97 FY98 FY99 FY00 2 FY01 FY02 FY03 FY04 Audit Dollar Recoveries The table below shows FY 2004 audit projects that resulted in significant recoveries, savings, cost avoidance, or other economic impact. Audit Mail Services Contract Animal Care & Control Impact $ Description 663,892 Excess accumulated postage charges recovered from outsourced mailroom vendor 500,000 Animal Care and Control could have collected up to $500,000 more in revenue from adoption and other fees if FY2003 transaction discounts had been more carefully managed Equipment Services 97,000 A $7,000 potential reduction in Telecom charges plus $90,000 in unidentified inventory write-offs that will be controlled in the future Planning & Development 85,524 $65,420 inactive permit fees were not collected; $17,609 in fees was unassessed and uncollected for issued permits or permits undergoing review; a $2,495 prepaid training expenditure was not recovered when an employee could not attend the class Superintendent of Schools 17,700 Grazing fees languished for five years in an unused account—as a result of the audit, the fees were transferred to the General Fund Office of Contract Counsel 5,050 An external consultant billed 101 hours (at $50 per hour) that were not allowed per the contract MIHS Transition: Contracts, 1099 Validation 2,070 Amount of IRS penalties that were averted when MIHS reissued corrected 1099’s $ Recovery & Cost Avoidance Total: $ 1,371,236 3 FY04 Audits with Estimated Cost Avoidance Internal Audit’s work is not always measurable; for example, improved internal controls may result in cost savings. The table below shows an audit project that resulted in potential cost avoidance. Audit Impact Internet Usage Review Description $ 6,200,000 If the County is able to reduce its non-productive Internet use by at least 10 minutes a day on average for each of the County’s 9,000 Internet users, the County could save $6.2 million per year in personnel costs. Non-productive use is defined as personal use believed to be conducted on “company” time. Internal Audit is now conducting continuous unannounced monitoring of internet use. Potential Cost Avoidance Total: $ 6,200,000 Our Cost vs. The Cost to Outsource the Audit Function FY 2004 audit work would have cost the County twice as much if external auditors had been used instead of internal audit staff. (Note: “Internal Audit Budget” bar includes co-source budget dollars.) FY04 Cost Comparison (Millions) Internal Audit Budget Projected Cost to Outsource Internal Audit's Work 0 1 4 2 3 4 What Did Our Customers Say? Quotes below are taken from FY 2004 customer surveys: “Ross & staff: Best ever!!” “As always very well done!”” “This effort has assisted the department in evolving its performance measures to be more meaningful with a basis in real data.” “Well done report—very valuable for my ability to manage the program. Outstanding presentation.” “The auditor was particularly responsive and professional in working with our staff throughout the audit. Her ability to reach consensus and produce effective audit recommendations is appreciated.” The Maricopa County Management Team reported they were 85% satisfied with Internal Audit’s mission fulfillment. — Maricopa County Research & Reporting, FY04 “We received excellent service from the entire audit team.” “I appreciate the manner in which the audit was conducted. I believe the process was fair and the outcome objective.” “I want to thank the staff for their assistance and professionalism.” “Your help with this special project was very much appreciated. I appreciate the quick turn-around time, especially over the holidays. Thank you very much for the good work and the willingness of the Audit team to help on such short notice.” “Good for maintaining internal discipline for these areas.” “I really appreciate your understanding and consideration for the fast-pace and implementation deadlines being faced by the project as we prepare for the Go Live date.” 5 Inputs / Resources & Outputs Department Budget The County’s internal audit costs remain low compared to other counties, as shown below. The benchmark average annual cost for an audit department is $1.5 million (comparing Maricopa with six benchmark counties). The national audit department budget average for local governments is $1.8 million. (Note: National averages are taken from the 2004 Fairfax County survey of 39 of the largest local government audit departments.) Internal Audit Budget Size Comparisons FY 2003-04 (Millions) $3 $2 $1 $0 Multnomah King Maricopa Clark FY04 IA Budget San Diego Harris Orange Average Internal Audit has produced good results with minimal resources (our staff investment is more economical than our benchmark counties). 0.12% What % is Internal Audit of the Total County Budget? (All are less than 1%) FY 2003-04 0.10% 0.08% 0.06% 0.04% 0.02% 0.00% King Clark San Diego Orange Audit Budget % 6 Maricopa Average Harris Multnomah Cost Per Audit Employee Our investment cost per audit staff member (includes auditors and administrative staff) is low compared to our benchmark counties. Cost per Internal Audit Employee FY 2003-04 (Thousands) $120 $100 $80 $60 $40 $20 $0 San Diego Maricopa Harris Multnomah Budget per Employee Staff Size Maricopa County has fewer internal auditors compared to the benchmark average of 13.5 auditors per audit shop, as shown in the graph to the right. The national average according to the Fairfax County survey is 17.25 auditors. King Orange Clark Average Number of Auditors Comparison FY 2003-04 20 18 16 14 12 10 8 6 4 2 0 Multnomah King Clark Maricopa # of Auditors Orange San Diego Harris Average Outputs Internal Audit’s FY 2004 outputs consist of the number of audit reports issued, consulting engagements, educational classes taught, and strategic information reports issued. Audit Services Program: Management Services Program: Consulting Activities 23 Educational Activities 11 Strategic Information & Reporting Activities Note: Figures are based on the Annual Audit Plan and may not correspond to MfR reported data. 16 TOTAL: 8 58 7 Appendices 8 Appendix A: Professional Staff Biographies Internal Audit employed the following individuals during FY 2003-2004. Ross L. Tate, County Auditor Mr. Tate is a Certified Internal Auditor, Certified Management Accountant, and Certified Government Financial Manager. He has a bachelor’s degree from Brigham Young University in business operations & systems analysis and 18 years of professional internal auditing experience. Mr. Tate joined the Maricopa County Internal Audit Department in 1989 and has been County Auditor since 1995. He is an active member of the National Association of Local Government Auditors, the Institute of Internal Auditor’s Phoenix Chapter, and the Arizona Local Government Auditor’s Association. Joan Simpson, Office Manager Ms. Simpson has a bachelor’s degree in social science with a major in political science from Milton Keynes University in the United Kingdom. She has professional experience in both the private sector and in government. She also has developed her technical skills in the use of software programs to further enhance her productivity within the office. D. Eve Murillo, Audit Manager Ms. Murillo is a Certified Public Accountant and a Certified Fraud Examiner. She has a bachelor's degree in liberal arts from the University of Illinois, a masters in business administration from Florida Institute of Technology, and 15 years of accounting and internal auditing experience. Ms. Murillo is a member of the National and Arizona Chapter of the Association of Certified Fraud Examiners and the Arizona Local Government Auditor's Association. Joe M. Seratte, Audit Manager Mr. Seratte is a Certified Public Accountant, Certified Internal Auditor, and has a certification in Control Self-Assessment. He holds an accounting degree from Oklahoma State University and a master's degree from the American Graduate School of International Management (Thunderbird) in Glendale, Arizona. He has 23 years experience in auditing, finance, and accounting and is a member of the American Institute of Certified Public Accountants and the Institute of Internal Auditors. 9 Richard L. Chard, Senior Auditor Mr. Chard is a Certified Public Accountant and has a history degree from the University of Redlands and postgraduate work in accounting and public administration through Arizona State University and Western International University. Before joining Internal Audit eight years ago, he worked five years in Maricopa County's Department of Finance and Health Systems Finance. John Schulz, Senior Auditor Mr. Schulz has 25 years of experience in program evaluation, budgeting, and financial administration within healthcare, law enforcement and government. He holds a degree in government from University of Maryland and a masters of public administration from Arizona State University. He is a Certified Fraud Examiner and is a member of the Association of Certified Fraud Examiners and the Arizona Local Government Auditors Association. Cathleen L. Galassi - Senior Auditor Ms. Galassi has a bachelor’s degree in philosophy from Loyola Marymount University, California, and post-graduate work in organizational psychology. She has extensive experience, including audit management at financial institutions, along with accounting and budgeting at healthcare and non-profit institutions. Ms. Galassi’s experience includes participation on merger and acquisition teams and system conversion projects. Ms. Galassi is a member of The Institute of Internal Auditors. Patra E. Carroll, Senior Auditor Ms. Carroll is a Certified Public Accountant candidate with over 8 years of financial, performance, compliance, and tax auditing experience within both state and county government. She has a bachelor's degree in accounting from Arizona State University and is a member of the Arizona Local Government Auditors Association and American Society for Public Administration. Susan Adams, Senior Information Technology Auditor Ms. Adams is a Certified Information Systems Auditor. She has a bachelor's degree in accounting from Utah State University and an MBA from the University of Utah. She has 12 years professional experience in accounting and audit with 6 years as an Information Systems auditor. Ms. Adams is currently serving as Secretary for the Information Systems Audit and Control Association's Phoenix Chapter and is a member of the Arizona Local Government Auditors Association. 10 Thomas L. Fraser, Information Technology Auditor Mr. Fraser is a Certified Fraud Examiner who holds degrees in business administration and business management. He has 12 years of accounting and professional internal audit experience. Mr. Fraser is a member of the Institute of Internal Auditors, Arizona Chapter of the Association of Certified Fraud Examiners, Information Systems Audit and Control Association, and is the President of the Arizona Local Government Auditors Association. Susan Huntley, Associate Auditor Ms. Huntley has a bachelor's degree in psychology and a masters in public administration from the University of North Florida. Ms. Huntley has 21 years of professional experience which includes quality assurance, auditing, and systems implementation and design. Ms. Huntley is a member of the Arizona Local Government Auditors Association and the National Institute for Government Procurement. Ms. Huntley left the County in May 2004. Kimmie Wong, Associate Auditor Ms. Wong has a bachelor's degree in business administrative services from Arizona State University and a masters in public administration from Western International University. She has over 7 years of experience reviewing grant audits and 8 years of professional internal auditing experience. Ms. Wong is a member of the Arizona Local Government Auditors Association and the Association of Certified Fraud Examiners' Arizona Chapter. Christina Black, Associate Auditor Ms. Black is a Certified Government Audit Professional with over 8 years of professional internal audit experience and 10 years of accounting and revenue auditing experience. She has a bachelor's degree in accounting from Missouri Western State College and is a member of the Arizona Chapter of the Association of Certified Fraud Examiners, Arizona Local Government Auditors Association, and the Institute of Internal Auditor’s Phoenix Chapter, where she serves as Chair on the Awards Committee. Lisa Cave, Associate Auditor Ms. Cave has a bachelor’s degree in accounting from Arizona State University West. She has over 6 years of professional experience in accounting and business. Ms. Cave is currently working towards her masters in business administration. Ms. Cave is a member of the Arizona Local Government Auditors Association, Certified Fraud Examiners, and the Institute of Internal Auditors. 11 Laurie Aquino, Staff Auditor Mrs. Aquino has a bachelor’s degree in accounting from Arizona State University West. She has four years of professional experience in accounting and business. Mrs. Aquino is a member of the Arizona Local Government Auditors Association and the Arizona Chapter of the Association of Certified Fraud Examiners. Trisa Cole, Staff Auditor Ms. Cole graduated Arizona State University West with a bachelor’s degree in global business / finance and a post baccalaureate certificate in accountancy. She is a member of the Arizona Local Government Auditors Association, Arizona Chapter of the Association of Certified Fraud Examiners, and the American Institute of Certified Public Accountants. Internal Audit staff members participate in many professional and service organizations, as shown below. Please see Appendix E, page 32 for Internal Audit’s educational requirements. * American Institute of Certified Public Accountants (AICPA) * American Society for Public Administration (ASPA) * Arizona Local Government Auditors Association (ALGAA) * Arizona Chapter of the Association of Certified Fraud Examiners (CFE) * Arizona Chapter of the American Society for Public Administrators * Information Systems Audit and Control Association (ISACA) * Institute of Internal Auditors (IIA) * Maricopa County Adjunct Faculty * Maricopa County Blood Drive * National Association of Certified Fraud Examiners (CFE) * National Association of Local Government Auditors (NALGA) * National Institute for Government Procurement * Toastmasters International 12 Appendix B: Project Summaries Report Title Page Report Title Audit Projects Page MIHS Transition Projects ♦ Adult Probation & MAS 14 ♦ Animal Care & Control 14 ♦ Animal Care Special Request 14 ♦ Board of Supervisors 15 ♦ Central Service Cost Allocation 15 ♦ Community Development 15 ♦ Correctional Health Services 16 ♦ Customer Service Survey 16 ♦ Equipment Services 16 ♦ Fixed Assets Inventories 17 ♦ Grant Compliance Review 17 ♦ Capital and Operating Leases 25 ♦ ICJIS Follow-Up Review 17 ♦ Fixed Assets 25 ♦ Internet Usage Review 18 ♦ HP Claims Quality Assessment 25 ♦ Internet Usage Monitoring 18 ♦ IGA’s 26 ♦ Justice Courts MAS 18 ♦ Inventory Contracts 26 ♦ Mail Services Contract 19 ♦ Inventory Controls 26 ♦ Performance Measure Certification 19 ♦ 19 ♦ Long-Term Care Provider Contracts 27 Planning & Development ♦ Random Cash Counts 20 ♦ Transportation Services ♦ Superintendent of Schools 20 Background 21 Completed ♦ Account Payables 22 ♦ Cash Monitoring 22 ♦ Clinics Profitability 23 ♦ Contracts: IRS Form 1099 23 ♦ Financial Condition 23 ♦ Transition Contracts Committee 24 In-Progress 13 27 Adult Probation and MAS ~ December 2003 The Maricopa County Adult Probation Department (APD) reports directly to the Presiding Judge of the Superior Court. APD is heavily regulated by Arizona Revised Statute requirements that detail the department’s basic operations and caseload limitations. Other regulations applicable to APD are defined by Arizona Supreme Court Administrative Orders. Garfield Community Significant Issues Controls over the collection of restitution, fines, fees, and reimbursements appear to be adequate and comply with court-ordered terms of probation and modifications Some posted fee transfers to the Clerk of the Court’s system are not completed timely Compliance with Minimum Accounting Standards (MAS) has improved since the last audit, however, additional controls and improvements are needed Animal Care and Control ~ June 2004 Changing citizen expectations prompted Animal Care and Control’s (AC&C) mission to evolve over the years. Initially, AC&C’s primary mandate was to protect the public from rabies by vaccinating, licensing, and impounding stray and potentially rabid dogs. According to the Humane Society of the United States, during the 1970's, animal overpopulation replaced rabies as one of the most serious problems facing municipal governments. A new policy strategy emerged that guided the animal shelter community into the mid 1990's: Legislation, Education, and Sterilization. Efforts began to reduce euthanasias by establishing local sterilization programs, mandating adequate licensing fees, and educating pet guardians and veterinarians on the importance of sterilization. Significant Issues Excessive use of adoption fee discounts may have reduced FY 2003 revenues by an estimated $500,000 Animal disposition statistics, when compared against information from the department’s internal system, are accurately reported Controls over inventory and procurement are weak, contributing to budgetary overages and increasing the likelihood of loss and waste Animal Care Special Request ~ November 2003 Identified $207,048 in overstated revenue resulting from duplicated forms recorded in the Treasurer’s fund Noted understated expenses of $125,207 between July 1997 and August 2003 due to Animal Care and Control’s failure to accurately inform the Treasurer’s Office of expenses charged Noted that three forms listing Animal Care and Control expenses were not posted to the Treasurer’s fund 14 Board of Supervisors Expenditures ~ March 2004 The Board of Supervisors of Maricopa County undergoes an audit every 3-5 years, conducted by an independent audit agency. A local auditing firm reviewed the Board’s FY 2004 expenditure records. Significant Issues No process is in place to reconcile orders billed to orders received, when purchasing office supplies using the Board’s Procurement Card Cellular phone usage indicated that the required Monthly Reimbursement Form is not consistently completed Central Service Cost Allocation ~ February 2004 The Department of Finance (DOF) prepares the Full Cost Central Service Allocation Plan to recoup central service agency expenditures that benefit non-General Fund departments and agencies. A central service agency (CSA) is one whose costs support, manage, and maintain County operations. With input from each CSA, DOF determines the basis for distributing CSA expenditures to appropriate non-General Fund departments. The Office of Management and Budget uses the allocations for budgeting purposes. The County has 14 organizations designated as CSAs. Significant Issues Maricopa County uses a cost allocation methodology that is widely recognized and common in local governments Testing of Central Service Cost allocation records and calculations found the plan fair, accurate, and timely Community Development ~ September 2003 Internal Audit determined that Community Development Department (CDD) operations did not present a significant, overall risk to the County. CDD does not receive any General Fund revenues, and extensive reviews on a federal level (HUD) have not reported any significant issues. Therefore, a preliminary survey and risk assessment were conducted, but a formal report was not issued. 15 Correctional Health Services ~ January 2004 Maricopa County Correctional Health Services (CHS) provides health care services for persons detained in the Sheriff’s Office (MCSO) jail system and the Juvenile Court Detention system. CHS was established as a separate County department in 1992 after previously operating as a division of the Department of Public Health, and later the Maricopa Integrated Health System (MIHS). CHS facilities are licensed by the Arizona Department of Health Services and are accredited through the National Commission on Correctional Health Care (NCCHC). Significant Issues CHS administers the contract for temporary workers effectively, however, excessive use of manual time system entries has lead to some over-billings Physical security over non-controlled substances should be improved Two of five tested Managing for Results performance measures were inaccurate Customer Service Survey ~ December 2003 At the request of the County Administrative Officer last year (FY 2003), Internal Audit conducted a limited customer service survey. The survey consisted of auditors posing as citizens and placing 210 phone calls and conducting 14 site visits to 17 County departments. This year (FY 2004), Internal Audit conducted an expanded customer service survey that included 555 phone calls to 34 departments and 52 site visits to 18 departments. Significant Issues 95% of our calls reached a courteous and professional employee or recording 94% of County sites visited were open; of these open sites, 98% had a person available to assist citizens Equipment Services ~ January 2004 Maricopa County Equipment Services (MCES) acquires, repairs, maintains, and disposes vehicles and heavy-duty equipment owned by Maricopa County. The department also operates a fleet of vehicles for work related use by County employees. Repair shops, service stations, and fueling stations are located throughout the County. MCES is intended to be a self-supporting enterprise that covers its operating costs through customer charges. In addition, fuel is sold to certain local governments through intergovernmental agreements. Significant Issues Accountability over parts inventory should be improved Opportunities exist for reducing telecommunications expenses Organizational changes should be made to improve checks and balances over parts inventories and accounts receivable 16 Fixed Asset Inventories ~ November 2003 Maricopa County has invested more than a billion dollars in its fixed assets, which are defined as items costing more than $5,000 and lasting more than one year. These assets are tracked by the Department of Finance; each department is responsible for maintaining and validating its assets. Significant Issues 5 of 6 departments reviewed have an adequate process for conducting year-end inventory counts However, 5 of 6 departments also had asset issues that require some follow up Grant Compliance Review ~ March 2004 In 1984, the United States Congress passed the Single Audit Act. The Federal Office of Management and Budget implemented the Single Audit Act, requiring recipients who annually receive $300,000 or more of federal assistance are required to undergo a comprehensive financial and compliance audit each year. As required by federal guidelines, we reviewed 38 independent audit reports of community-based organizations that received $14.6 million in County-distributed federal grants. Significant Issues Twelve of the audit reports contained 34 findings related to County-distributed federal dollars Only 4 of the 34 findings were material, and none directly affected the County or specific programs Integrated Criminal Justice Information System (ICJIS) Follow-Up Review ~ January 2004 Maricopa County Voters approved Proposition 400 in 1998, which raised the sales tax collected within the County by 1/5th of a cent. These funds are being used to build new adult and juvenile detention facilities and pay for programs aimed at reducing the overall jail population. The integration of electronic information used in the criminal justice computer system (ICJIS) is an important part of this initiative. During FY 2002, Internal Audit conducted a review of the ICJIS project with the objective of evaluating controls related to management and execution of ICJIS implementation. The report, issued September 2002, identified issues relating to management controls, including project planning, project operational controls, resource use, communications, and reporting. Significant Issues Overall, the auditors found that ICJIS project management controls have improved since December 2002 and appear to be functioning effectively The auditors noted 14 of the original 16 recommendations for improvement have been addressed. The remaining two recommendations relate to the lack of an “end-game” strategy 17 Internet Usage Review ~ March 2004 The County established an Administrative Policy to create “general privileges, responsibilities and restrictions in the use of County Technology Resources by County employees so that the value of these resources is maximized.” The policy outlines acceptable and unacceptable use of County computing resources, authority and responsibilities, and consequences of improper use of resources. The policy clearly states that the County has the ability to monitor and record computer usage, including Internet use, at any time, without prior notice or warning to the user. Furthermore, users have no expectation of privacy in the use of these tools. Significant Issues The County is a local government leader in identifying risks associated with Internet usage, establishing suitable policies, and developing controls to proactively monitor employee usage Current Internet filters block only adult content-related sites and do not address other types of unacceptable sites, as outlined in County policy Current Internet usage monitoring and logging tools are not adequate to identify actual employee abuse Internet Usage Monitoring ~ Ongoing In accordance with County Policy, Internal Audit selected a number of County Internet users and monitored their usage over a three-day period for the estimated time spent on the Internet and the type of sites visited. These ongoing reviews are intended to increase management’s awareness of employee Internet usage, promote acceptable use, and limit potential abuse of County resources. Significant Issues Sampled 15 users out of 9 departments A summary report was sent to the appropriate department head Justice Courts MAS ~ May 2004 The 23 Justice Courts in Maricopa County handle criminal traffic, misdemeanor cases, and a variety of civil matters not in excess of $10,000. Most cities and towns operate their own municipal courts that handle some of the same types of cases, including civil traffic and misdemeanors. Internal Audit performed a Minimum Accounting Standards (MAS) review of eight Maricopa County Justice Courts and the Gila Bend Municipal Court. Significant Issues Our examination of the courts’ financial procedures and practices shows that all comply with most MAS requirements, as required by the Administrative Office of the Arizona Supreme Court Although we did find some exceptions, none present a significant risk to the courts 18 Mail Services Contract ~ July 2004 The County established a contract with a mail services vendor in July 1996 to provide mailroom operations and delivery services to County facilities. The contract appoints both the Materials Management Department (MM) and Facilities Management Department (FMD) as contract monitors. We reviewed the mail services contract vendor billings, reconciled the County’s Postage Reserve fund maintained by the vendor, and validated expenditure adjustments by MM and FMD. Significant Issues A lack of established controls allowed the vendor to overcharge the County $663,891 in postage Vendor has refunded the County $649,600 in over billed postage and agreed to refund an additional $14,291 in related pre-sort fees Postage billings prepared by the vendor and validated by Materials Management are not accurate and have resulted in most user departments being either under or overcharged Performance Measure Certification ~ June 2004 Internal Audit’s performance measure certification program (PMC) enables County leaders to rely upon reported performance measures to make informed decisions concerning government resources. PMC reviews determine the accuracy of reported measures and the reliability of data collection procedures. Significant Issues Reviewed 41 performance measures from ten departments Only around 50% of the measures reviewed could be certified as “accurate” Planning and Development ~ June 2004 Arizona law requires counties to establish a planning and zoning commission to conserve and promote public health and safety and to provide for the future growth and improvements of jurisdictional areas. Planning and Development is responsible for coordinating all private property improvements and establishing and enforcing rules, regulations, and ordinances applicable to development. Significant Issues Building permits are not issued timely due to an inefficient plan review process and inadequate management monitoring controls (Planning and Development reported that lack of staff also contributed to plan review inefficiency) The department does not always assess and collect fees for all permit work performed An effective system has not been established to identify and collect all fees due on inactive permits 19 Random Cash Counts ~ October 2003 Internal Audit performed a series of random cash and check counts at selected locations within the Justice Courts, Animal Care and Control, and the Environmental Services Department. The department’s control procedures were also reviewed. Significant Issues Internal Audit found no significant exceptions to physical counts of cash and checks during our testing procedures. However, some significant control weaknesses were noted in two of the three County departments. Superintendent of Schools ~ February 2004 The Maricopa County Superintendent of Schools (SOS) is an elected officer of the County. The first County Superintendent of Schools in Maricopa County was elected in 1871. The Superintendent oversees, and is the governing board for, the Maricopa County Regional Schools District, which provides alternative educational services to school districts and students throughout Maricopa County. Significant Issues An SOS fund balance of $17,700, comprised of fees from grazing on public lands, could be transferred to the County General Fund Warrants are effectively processed for the 41 school districts serviced by Maricopa County Internal controls over cash receipts and payroll garnishments could be improved 20 MIHS Transition Projects Background In November 2003, Maricopa County voters approved Proposition 414. The passing of 414 allows the Maricopa Integrated Health System (MIHS) to be transitioned into the Maricopa County Special Health Care District. Leaders from MIHS and Maricopa County have been working diligently to prepare the transfer of assets and agreements for a transition date of January 1, 2005, or sooner. In January 2004, under the direction of the Board of Supervisors, Internal Audit shifted its focus from its Board-approved Annual Audit Plan to MIHS transition issues. By revising its fiscal year 2004 Audit Plan, Internal Audit was able to provide assistance to County Management during a critical transition of health care operations to a Special Health Care District. Internal Audit is continuing its focus on MIHS Transition work into fiscal year 2005. Therefore, on the following pages you will see that projects are shown as completed or in-progress. 21 Completed MIHS Transition Projects Accounts Payable ~ April 2004 Accounts Payable Processing Performance may impact the MIHS transition to a Special Health Care District, including: Holding payments to enhance cash flows Ageing accuracy Accrual accuracy We concluded that: Checks clear the bank timely, and are not held 100 reviewed invoices showed invoice document date matched system date September and October 2003 manual accruals were tested and appear reasonable 45-day payment timeliness goal is only met 72% of the time Purchase order and contract reference numbers are not routinely recorded in the system; this impairs the audit trail and makes analysis difficult The vendor table integrity is compromised; vendors are entered multiple times with name variations Manual accrual policies and procedures are lacking Although MIHS should work to achieve its accounts payable payment goals, current Accounts Payable processing performance will not deter transition success. Cash Monitoring ~ FY 2004 This is the third year Internal Audit (IA) has engaged in continuous cash monitoring. In the initial year, IA made County and MIHS management aware of precipitous declines in MIHS cash balances. Subsequently, IA has monitored and reported MIHS cash trends. MIHS, largely as a result of the increased awareness of negative cash trends, has taken measures to stabilize and more effectively manage cash. However, MIHS operating cash continues to be problematic, especially as Maricopa Long Term Care Program market share declines, reducing the largest source of MIHS positive cash flow. 22 Clinics Profitability ~ June 2004 We reviewed the profitability of 10 MIHS Delivery System Family Health Centers (FHCs), as shown in MIHS’ monthly financial statements. We also identified key issues concerning the FHC’s contribution to the entire MIHS system. We noted that factors other than reported losses, such as health plan service delivery requirements and alternative costs of providing heath services in the absence of local FHC facilities, affect the valuation of each location’s contribution to MIHS. Contracts: IRS Form 1099 Reconciliation ~ August 2004 We reviewed MIHS’ compliance with processing IRS 1099 forms (report of total annual payments to vendors for services purchased). Incomplete and inaccurate IRS 1099 forms could result in IRS penalties. Errors could also result in poor vendor/provider relations. We found: 2% of Health Plans and 15% of Delivery System 1099 forms were misstated These inaccuracies total approximately $3 million MIHS was not able to locate 32% of Health Plan W-9 forms (vendor tax ID number notifications) MIHS was not able to locate 44% of Delivery System W-9 forms Potential IRS penalties could reach over $3,300 Financial Condition Report ~ July 2004 The Financial Condition Report annually assesses Maricopa County’s financial condition. The report extensively uses graphics to create a highly visual, user-friendly, interesting, and understandable report for the benefit of elected officials, management, and the public. Using Comprehensive Annual Financial Reports and internal Health System Financial Reports as our primary sources, we analyzed information such as liquidity, revenues per capita, unreserved fund balance, and long-term debt. We presented key financial indicators in five or ten year trends. This year’s report focuses on Health System financial indicators and follows with General Fund analysis. We included benchmark analysis, comparing Maricopa County key trends with those of ten similar counties. The County Health System reports negative trends. Total health system cash levels have dropped to critically low levels, the health plans have moved from profits to losses, and health plans membership continues to decline. The General Fund reports strong financial condition indicators, including growing unreserved fund balance, low debt, and strong liquidity. 23 Transition Contracts Committee ~ FY04 The committee’s weekly meetings were led by the County Materials Management Director. Other members included the MIHS Materials Management Director and Internal Audit staff (County Auditor, Audit Manager, and Senior Auditor). Occasionally other MIHS and County personnel attended meetings. Internal Audit’s role was to assist MIHS with identifying and verifying all contracted vendors and providers in order to ensure that all vendors/providers would be notified of the impending assignment of County contracts to the Special Health Care District. Internal Audit assistance highlights: Compared the Treasurer’s electronic check register to the MIHS Contract Register (list of vendors) to identify MIHS payments to vendor/providers not shown on MIHS’ Contract Register. This effort ensured that no contracted vendors were overlooked for assignment letters merely because they were not listed on the MIHS Contract Register. The comparison mentioned above identified a significant number (by count and dollars) of purchases made from non-contracted vendors. Internal Audit compiled a list of all vendors paid more than $25,000 who were not on the MIHS contract register and therefore did not have valid current contracts with Maricopa County. Verified the accuracy of the Contract Register by comparing its listed vendors with vendor names appearing on Board of Supervisor-approved contracts shown in Agenda Central. Researched Clerk of the Board records for vendor/ provider names listed in MIHS “pool contracts” (contracts containing numerous individual or entity names) to assure accuracy and thoroughness of assignment letters. Reviewed MIHS’ compliance with processing IRS 1099 forms. Incomplete and inaccurate IRS 1099 forms could result in IRS penalties. Errors could also result in poor vendor/provider relations. See page 23 for more detail. 24 In-Progress MIHS Transition Projects Capital and Operating Leases We will verifiy that operating leases are accrately accounted for, identify the financial impact of certain leases, and identify process improvements throughout the lease cycle. Our ojectives include: Assisting MIHS in the use of “lease versus buy” analysis in determining the most effective way to acquire capital assets Identifying inappropriate sales, use, or property tax charges on MIHS leased assets (we have identified approximately $10,000 in potentially invalid sales and use tax and we anticipate this number to grow signifigantly as we complete our review) Verifying the accuracy of bed day charges on MIHS specialty bed lease payments Verifying Centerre Rehabilitation Hospital receipts for leasehold reimbursements per the terms of the lease contract Working with the Maricopa Medical Center Finance Department and the MIHS Contract and Procurement Departments to identify control weaknesses that may allow unrecognized lease expenditures to occur Fixed Assets We are reviewing MIHS Fixed Asset internal controls to provide an accurate asset count and valuation as well as ensure an effective process for maintaining hospital assets and related records. An outside firm, American Appraisal, has primary responsibility for the count and valuation of MIHS fixed assets. Our objectives include determining if: The personal property values reported by American Appraisal are reasonable Information related to the acquisition, tracking, and disposal of assets is adequately maintained Policies and procedures address proper and consistent accounting treatment of fixed assets HP Claims Quality Assessment Audit Review MIHS requested Internal Audit to assist with a process review and evaluation of Health Plans (HP) Claims Quality Assessment Audit methodology, tools, and related policies and procedures. Internal Audit assisted with tightening controls over the claims receipt process Data Entry audit process has been separated from Processing Audit, which separates “quick and simple” data entry audits from complex and time consuming claim quality audits Claims receipt and data entry audits have been revised to include new forms, new controls, and daily monitoring Processing Audits are under review and require further evaluation and monitoring 25 IGA’s We are reviewing Intergovernmental Agreements (IGA’s) to identify any issues that could have an impact on the MIHS transition. The project will continue into the FY 2004-2005 fiscal year to ensure accurate information is presented to the new hospital board. The areas of review include: Board of Supervisor approval of all new IGA’s, amendments, and changes to contract terms Identification of all IGA’s that will be in effect through the transition date Termination authority and assign ability options Financial impact validation Inventory Contracts We are reviewing 14 MIHS supply/service contracts and 6 lease contracts during the MIHS Transition Inventory review. We will determine if: Contracts are updated with changes to terms and pricing Communication between the Purchasing and Contracts department could be enhanced The MIHS system has a mechanism to alert users when contract amounts (NTE) have been exceeded Prices paid conform to contract terms Inventory Controls We are reviewing 14 MIHS departments’ controls over inventory. We will determine if policies and procedures are sufficient to prevent errors, fraud, theft or misuse of MIHS medical supply inventory. Our areas of review include: MIHS controls over warehouse security Written inventory policies and procedures at the department level Effective reconciliation procedures 26 Long-Term Care Provider Contracts We reviewed selected MIHS contracts with long-term care providers (nursing home and assisted living facilities), and a contract with the Regional Behavioral Health Authority. The objectives of this audit were to determine if: Claims are paid in accordance with contract terms Share of Cost amounts (client portion of costs) are accurately accounted for and deducted from MIHS claim payments to nursing homes Controls over Regional Behavioral Health Authority billing, revenue recognition, and revenue collections are adequate The audit is complete and issuance of our report is pending MIHS' response. Transportation Services Regional Behavioral Health Authority The Regional Behavioral Health Authority (RBHA) in Maricopa County, places their clients in the MIHS owned Desert Vista Behavioral Health Center. Upon discharge, RBHA clients require transportation to other facilities such as the RBHA Crisis Recovery Unit. It is RBHA’s responsibility to pay for their clients’ transportation when discharged from Desert Vista. The objectives of this audit are to determine: If MIHS paid for RBHA client transportation in error The dollar amount of any erroneous payments If MIHS recovered these costs The audit is complete and issuance of our report is pending MIHS' response. Ambulance Services Contracts (3 vendor contracts) The MIHS Patient Transportation Services department (PTS) arranges transportation for MIHS health plan members and others with healthcare transportation needs. PTS handles approximately 44,500 transports per year, averaging 123 transports per day. The objectives of this audit are to determine if: Contracts are negotiated and executed in accordance with Article 3 Procurement Code or Article 13 policy requirements Contractors fulfill contractual obligations and comply with contract terms and conditions Billing invoices agree to contract pricing list, and payments do not exceed authorized rates MIHS effectively monitors contractors’ performance and contract compliance The audit is complete and issuance of our report is pending MIHS' response. 27 Appendix C: Other Projects Board of Supervisors Progress Reports ~ Monthly These reports are prepared to satisfy Internal Audit’s charter requirements to monthly update Board members. Consulting Activities ~ Throughout the Year We completed the following department-requested consulting projects: Alternative Fuel County Affiliation County Cell Phone Usage and Analysis Countywide Donation Policy Eagle — HRMS Mail Services and Contract MCDOT Organizational Contracts Office of Contract Counsel Claims Outsourcing Surplus Function Proposition 202 Analysis Control Self Assessment Classes ~ Throughout the Year Internal Audit conducted five Control Self Assessment (CSA) workshops attended by a total of 95 County employees. The classes improve employees understanding of good contract monitoring, cash handling practices, and payable processing. Electronic Government Council ~ Ongoing Internal Audit participates on a task force that provides the CIO and Executive Management input on future County direction in EGov applications, website development, and interfacing with state and other jurisdictions. Hosting Activities ~ Ongoing We were asked to share our Performance Measure Certification Program and Managing for Results work with visiting officials. One was from Nashville/Davidson County, Tennessee, who happened to be in town to attend the National Association of Counties (NACo) convention hosted by Maricopa County. The other was from South Africa who was interested in learning about local government administration and management best practices. ICJIS SDLC Development ~ Ongoing We conducted on-going monitoring of the Integrated Criminal Justice Information System (ICJIS) project. Areas of review and monitoring included: budgets, project management, time schedules (deadlines), and security. Information is reported to the Board and Presiding Judge. Management Control Bulletins (“Got Controls?”) ~ Ongoing We created a one-page information bulletin entitled “Got Controls?” to communicate important control issues to County executives, managers, and employees. These bulletins feature useful common internal control methodologies. The bulletins issued for FY 2004 featured IT network protection and internet usage. Risk Assessment ~ Annually Internal Audit uses its Countywide risk assessment as a necessary planning tool to help determine high, low, and medium risk areas that should be audited and reviewed. This tool is a precursor to the audit plan. 28 Appendix D: Single Audit Reviews Maricopa County passed through $14.6 million of federal grant funds to 39 subrecipients, required to undergo a Single Audit, in FY 2001-2002/CY 2002. As mandated by OMB Circular A-133, we reviewed 38 subrecipient Single Audit Reports and found that twelve contained a total of 34 findings related to County pass-through dollars. Only four of the findings are material and indirectly affect the County or specific County programs. Internal Audit will follow up on one overdue Single Audit Report. The subrecipients are: Pass Through Agency ~ Maricopa County Department of Environmental Services Regional Public Transportation Authority Pass Through Agency ~ Maricopa County Department of Human Services American Red Cross, Arizona Call-A-Teen Youth Resources, Catholic Social Services, Chandler Unified School District, City of Avondale, City of El Mirage, City of Glendale, City of Scottsdale, City of Tempe, City of Tolleson, Community Services of Arizona, East Valley Institute of Technology, Foundation for Senior Living, Gilbert Unified School District, Maricopa County Community College District, Mesa School District, New Life Center, Regional Public Transportation Authority, Save the Family, Scottsdale Unified School District, Tempe Community Action Agency, Town of Buckeye, Town of Gila Bend, Town of Guadalupe Pass Through Agency ~ Maricopa County Juvenile Probation City of Glendale, City of Phoenix Pass Through Agency ~ Maricopa Integrated Health System Aids Project Arizona, Area Agency on Aging, ASU-Student Health HIV Program, Body Positive, Ebony House, Phoenix Children’s Hospital Pass Through Agency ~ Maricopa County Department of Public Health Aids Project Arizona, Area Agency on Aging, ASU-Community Health Services, Banner Health, Body Positive, Catholic Social Services, Chicanos Por La Causa, Clinic Adelante (Nov 2002), Concilio Latino de Salud (Oct 2002), Mountain Park Health Center (Nov 2002), Phoenix Children’s Hospital, Phoenix Shanti Group, St. Joseph’s Hospital 29 Appendix E: Internal Audit Department Profile Definition Internal auditing is an independent, objective assurance and consulting activity that adds value and improves operations. Internal auditing helps an organization reach objectives by bringing a systematic, disciplined approach to improve the effectiveness of risk management, control, and governance processes. Mission The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board of Supervisors can make informed decisions to better serve County citizens. Vision To facilitate positive change throughout County operations while ensuring that public resources are used for their intended purpose. History The Board of Supervisors appointed the first County Auditor in 1978 and established an internal audit function. In 1994, the Board of Supervisors created a Citizen’s Audit Advisory Committee comprised of private citizens and County officials. (See Appendix F for charter.) In 1997, the Board of Supervisors formalized the County’s internal audit function by adopting a department charter, which was amended in December 2002. (See Appendix G for charter.) Citizen’s Audit Advisory Committee (Audit Committee) The Board Appointed Citizens’ Audit Advisory Committee supports further strengthening of the County’s Internal Audit Department. This committee, comprised of accounting and business professionals, actively engages in analyzing risk throughout the County and making recommendations. This committee is an important link between the Board of Supervisors and the County’s auditors, both internal and external. The Maricopa County Citizen’s Audit Advisory Committee meets regularly to review and comment on audit reports, County financial statements, and other audit information (audit plan, special requests, etc.). Organizational Independence Auditors should be removed from organizational and political pressures to ensure objectivity. As our charter designates, the Maricopa County Internal Audit Department reports directly to an elected Board of Supervisors thereby establishing an effective level of independence from management. This reporting structure provides the Board of Supervisors with a direct line of communication to Internal Audit and provides assurance that County officials cannot influence the nature or scope of audit work performed. Government Auditing Standards support locating internal audit departments’ outside the management function in order to encourage independence. Routine meetings with an independent audit committee further enhance independence. The County Auditor also meets with an oversight committee comprised of the County Administrative Officer and two Board members. 20 30 Reporting Structure of the Internal Audit Department Board of Supervisors Audit Committee County Management Internal Audit Resources A fully staffed, professional internal audit department provides value-added services to the County. Each year Internal Audit analyzes and adapts its resources to meet upcoming County auditing and consulting needs. To provide flexibility, the audit staff has education and experience in various audit areas: finance, performance, information systems, and management services. Each audit is performed by a team that collectively possesses the necessary knowledge and skills to fit the assignment. Government operations are inherently complex; certain functions cannot be properly reviewed without specialized expertise. Hiring a wide variety of staff specialists, however, would not be cost-beneficial. While we have invested in qualified internal staff, we have also reserved resources for specialized contractors; $320,000 was budgeted for this purpose in FY2003-2004. This partnership (called “co-sourcing”) provides the County with the collective expertise required by Government Auditing Standards at an affordable price. FY 2004 Internal Audit Department Organizational Chart Audit Committee Board of Supervisors Ross Tate County Auditor Joan Simpson Office Manager Eve Murillo Joe Seratte Audit Manager Audit Manager Cat Galassi Richard Chard Senior Auditor Senior Auditor Patra Carroll John Schulz Susan Adams Senior IT Auditor Tom Fraser Senior Auditor Senior Auditor Susan Huntley Christina Black Associate Auditor Associate Auditor Kimmie Wong Lisa Cave Associate Auditor Associate Auditor Laurie Aquino Trisa Cole Staff Auditor Staff Auditor 31 IT Auditor The County’s Health System is large (approximately 1/3 of the County’s budget), very complex, and affects many people’s lives. This high level of risk to the County makes the Health System’s activities worthy of increased scrutiny. We began performing health care audits in fiscal year 1997-1998. In fiscal year 1999-2000, we began outsourcing some of the health system audits due to the highly specialized expertise required. Risk Assessment Effective internal auditing is based on systematically reviewing an organization’s operations at intervals commensurate with associated risks. The annual risk-review process produces an audit plan that maximizes audit coverage and minimizes risk. Auditing every County activity on a regular basis would not be cost efficient; professional judgment ensures resources are focused on high-risk areas. Professional Internal Audit Staff Our auditors have extensive knowledge of auditing methods and techniques plus specialized training in computers and accounting. (See Appendix A for individual biographies.) Each auditor is responsible for maintaining Government Auditing Standards requirements of 80 continuing education hours every two years; 24 of those hours are directly related to government operations. In order to meet this education requirement and share knowledge, Internal Audit staff members conducted four in-house training classes in FY04 at a cost savings ranging from $705 to $1,410 (assuming $10 to $20 per credit hour, respectively). Who Audits the Auditors? (Peer Review) An independent audit firm conducts a peer review of Internal Audit every 3 years, as required by national Government Auditing standards. The Maricopa County Citizens’ Audit Advisory Committee oversees these reviews. The FY 2000 and FY 2003 review by a local firm showed no findings. 32 Appendix F: Citizen’s Audit Advisory Committee Charter The committee’s primary function is to assist the board of supervisors in fulfilling its oversight responsibilities. The committee accomplishes this function by reviewing the county’s financial information, the established systems of internal controls, and the audit process. In meeting its responsibilities, the committee shall perform the duties outlined below. 1. Provide an open avenue of communication between the county auditor, the auditor general, and the board of supervisors. 2. Review the committee's charter annually and seek board approval on any recommended changes. 3. Inquire of management, the county auditor, and the auditor general about significant risks or exposures and assess the steps management has taken to minimize such risks to the county. 4. Consider and review the audit scope and plan of the county auditor, and receive regular updates on the auditor general’s county audit activities. 5. Review with the county auditor and the auditor general the coordination of audit efforts to assure completeness of coverage, reduction of redundant efforts, and the effective use of all audit resources including external auditors and consulting activities. 6. Consider and review with the county auditor and the auditor general: 7. 8. a. The adequacy of the county's internal controls including computerized information system controls and security. b. Any related significant findings and recommendations of the auditor general and the county auditor together with management's responses thereto. At the completion of the auditor general’s annual examination, the committee shall review the following: a. The county's annual financial statements and related footnotes. b. The auditor general's audit of the financial statements and report thereon. c. Any serious difficulties or other matters related to the conduct of the audit that need to be communicated to the committee. Consider and review with management and the county auditor: a. Significant audit findings during the year and management's responses thereto. 19 20 33 b. Any difficulties encountered during their audits, including any restrictions on the scope of their work or access to required information. c. Any changes required in the planned scope of their audit plan. d. The internal audit department's budget and staffing. e. The internal audit department's charter. f. The internal audit department's overall performance and its compliance with accepted standards for the professional practice of internal auditing. 9. Report committee actions to the board of supervisors with such recommendations as the committee may deem appropriate. 10. Prepare a letter for inclusion in the annual report that describes the committee's composition and responsibilities, and how they were discharged. 11. The committee shall meet at least four times per year or more frequently as circumstances require. The committee may ask members of management or others to attend the meetings and provide pertinent information as necessary. Committee meetings are subject to the Open Meeting Law (A.R.S. § 38-431). 12. The committee shall perform such other functions as assigned by the board of supervisors. Committee Composition and Terms The membership of the committee shall consist of five voting members and three non-voting members. The voting members shall be board of supervisor appointees from the public and shall serve two-year terms. The non-voting members shall be the county’s chief financial officer, the county attorney, the auditor general, or their designees. The chairman of the board of supervisors shall appoint a committee chairman from the voting members. The committee chairman shall serve a one-year term. Member Qualifications Committee members must have an understanding of financial reporting, accounting, or auditing. This understanding can be demonstrated through educational degrees (BS, MBA, PhD) and professional certifications (CPA, CMA, CIA), or through experience in managing an organization of more than 25 employees or $20M in revenues. Committee members should be familiar with local government operations and should have sufficient time to effectively perform the duties listed herein. Adopted by the Board of Supervisors — 3/26/97 Last Amended — 6/26/02 34 Appendix G: Internal Audit Department Charter Purpose The Maricopa County Board of Supervisors (Board) hereby establishes the Maricopa County Internal Audit Department. The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board and management can make informed decisions to better serve County citizens. Responsibility County management has primary responsibility for establishing and maintaining an effective system of internal controls. Internal Audit evaluates the adequacy of the internal control environment, the operating environment, related accounting, financial, and operational policies, and reports the results accordingly. Authority and Access Internal Audit is established by the powers granted to the Board in A.R.S. § 11-251. The Board is authorized to supervise the official conduct of all County officers, to see that such officers faithfully perform their duties, and present their books and accounts for inspection (A.R.S. § 11-251.1). The Board is also authorized to perform all other acts and things necessary to fully discharge its duties (A.R.S. § 11-251.30). Internal Audit will report directly to the Board, with an advisory reporting relationship to the Board-Appointed Citizen’s Audit Advisory Committee. In addition, the County Auditor will meet, as needed, with an oversight committee comprised of the County Administrative Officer and two Board members appointed by the Board Chairman. While conducting approved audit work, Internal Audit will have complete access (except where restricted by legal privilege) to all County property, records, information, and personnel. Premise and Objectives Internal Audit’s basic premise is that County resources are to be applied efficiently, economically, and effectively to achieve the purposes for which the resources were furnished. This premise is incorporated in the following four objectives: A. Compliance with Laws and Regulations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure identification of and compliance with applicable laws and regulations. B. Effective Program Operations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that programs meet their goals and objectives. 35 C. Validity and Reliability of Data Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that valid and reliable data are obtained, maintained, and fairly disclosed. D. Safeguarding of Resources Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that resources are safeguarded against waste, loss, and misuse. Independence The Internal Audit Department will remain outside the control of management. Internal Audit employees will have no direct responsibility for, or authority over, any of the activities, functions, or tasks reviewed by the department. Accordingly, Internal Audit staff should not develop or write policies and procedures that they may later be called upon to evaluate. They may review draft materials developed by management for propriety and completeness. However, ownership of and responsibility for these materials will remain with management. Audit Standards and Ethics Internal Audit will adhere to applicable industry standards and codes of ethics issued by authoritative sources (such as those issued by the Institute of Internal Auditors and the U.S. General Accounting Office). Each member of the department is expected to consistently demonstrate high standards of conduct and ethics as well as appropriate judgment and discretion. Audit Planning The County Auditor will prepare an annual audit plan that will be reviewed by the Citizen’s Audit Advisory Committee and approved by the Board. Additions, deletions, or deferrals to the annual audit plan will also be approved by the Board. Follow-Up Internal Audit will follow up on the status of its report recommendations on a regular basis. Adopted by the Board of Supervisors — 6/11/97 Last Amended — 12/18/02 36 Maricopa County Internal Audit 301 W. Jefferson, Suite 1090 Phoenix, AZ 85003 ~ 2148 Telephone: Facsimile: E-mail: 602 ~ 506 ~ 1585 602 ~ 506 ~ 8957 jsimpson@maricopa.gov Visit our website @ www.maricopa.gov/internal_audit Annual Report Project Members Eve Murillo, Audit Manager Kimmie Wong, Associate Auditor Christina Black, Associate Auditor Richard Chard, Senior Auditor 37