Do the Right Things Right! County Auditor’s Annual Performance Report Fiscal Year 2005 Maricopa County, Arizona From the County Auditor’s Desk — FY 2005 To: Max W. Wilson, Chairman, Board of Supervisors Fulton Brock, Supervisor, District I Don Stapley, Supervisor, District II Andrew Kunasek, Supervisor, District III Mary Rose Wilcox, Supervisor, District V From: Ross L. Tate, County Auditor Date: October 31, 2005 Audit Plan FY 2005 was a very productive year for Internal Audit. At the Board of Supervisors’ direction, we focused our resources on critical tasks related to the transition of the County’s health system to a Special Health Care District. Our office resumed its Audit Plan work in mid FY 2005. We released 51 deliverables, which included reports, five workshops, and two major risk assessments. I am proud to note that during the last ten years Internal Audit has passed all of its peer reviews conducted by an external firm, identified potential savings and recoveries totaling $55 million, and developed a reputation for excellence. Thanks to a strong team of professionals, we have achieved sixteen awards in the last five years from six different national associations. We look forward to our FY 2006 Audit Plan, and join with the County in aligning our future work with the Board of Supervisors’ strategic priorities. Internal Auditors: A Good Investment When the cost savings derived from fraud and error detection are combined with internal audit’s deterrent effect, the value of auditing activities is evident. Internal Audit Cost vs Savings Produced $6 $5 Millions Investing in an internal audit function is an investment in operational improvement and fraud deterrence. The presence of internal auditors can deter employees from committing fraud because of the perceived danger of getting caught. Health System Transition Issues $4 $3 $2 $1 Savings produced by Internal Audit Audit Budget $0 FY97 FY98 FY99 FY00 FY01 FY02 FY03 FY04 FY05 i Maricopa County Leaders Recognize Value Maricopa County leaders have long recognized the value of internal controls, accountability, and transparency in government. They have wisely invested in an independent internal audit function that reports directly to the Board of Supervisors. Internal Audit also has an advisory reporting relationship to a Citizen’s Audit Advisory Committee, which the Board established in 1997. Chairman Wilson and Internal Audit celebrate national recognition for fiscal year 2005: A NACo award for a program Internal Audit recommended, “Jurors Helping Jurors.” See pages v—vi for award details. Internal Audit is Active in Regional Leadership Aligning its strategic goals with those of the Board of Supervisors, Internal Audit takes an active role in local, regional, and national events. Below are examples of our FY2005 involvement. Audit Manager Joe Seratte Ross Tate helped lead a Directors’ was invited to present Roundtable at the Western “Countywide Travel Audits” Intergovernmental Audit Forum at national association of held in Phoenix. Ross was also government auditors quoted in a recent national audit meeting held in Milwaukee. publication Richard Chard presented Tom Fraser presented “ACL “Health Care Transition” at High Impact Auditing” at the the Arizona Local Arizona Local Government Government Auditors Auditors Association held in Association held in Phoenix. Phoenix. ii Organizational Independence The Maricopa County Internal Audit Department is effectively organized, reporting directly to the Board of Supervisors, with an advisory reporting relationship to a Citizen’s Audit Advisory Committee. Board of Supervisors Andrew Kunasek District III Don Stapley District II Max W. Wilson District IV Mary Rose Wilcox District V Fulton Brock District I Citizen’s Audit Advisory Committee Internal Audit County Management iii Citizen’s Audit Advisory Committee FY 2005 Ralph Lamoreaux (seated, far left) is a CPA with a BA degree (accounting emphasis) from Southern Utah University and an MBA from the University of Utah. He worked 33 years with the U.S. General Accounting Office: 5 years at the Denver regional office and 28 years at Washington D.C. headquarters. He retired in July 2000. District I Supervisor Fulton Brock appointed him on August 8, 2001. Jill Rissi (seated, 2nd from left) is an RN with degrees in psychology and nursing and an MPA from ASU. She has 18 years of auditing, budgeting, financial administration, program and policy development, and healthcare experience. Ms. Rissi has overseen various clinics and programs and is currently the Associate Finance and Administration Director at St. Luke’s Charitable Health Trust. Appointed by District II Supervisor Don Stapley on April 5, 2000. Victoria Prins (seated, 3rd from left), is a CPA and a Certified Government Financial Manager. She has an accounting degree and an MPA from ASU. Ms. Prins has accounting and management experience in city, county, and state government. She is the Arizona Supreme Court Chief Financial Officer. Appointed by District III Supervisor Andrew Kunasek on April 2, 2003. Ryan Brownsberger, Chairperson (seated, 2nd from right), is a CPA with an Iowa State University accounting degree and an MBA from ASU. He has 8 years of experience in auditing, accounting, budgeting, and business management. He is an independent contractor for Citigroup through Primerica Financial Services. Appointed by District IV Supervisor Max Wilson on June 1, 2003. Richard Lozar (seated, far right), has extensive experience in accounting and management. He worked as a Controller and General Manager in the hospitality industry and as an Accounting and Financial Consultant. Mr. Lozar is currently the Director of Business Affairs for Cook College & Theological School in Tempe (a school for Native Americans). Appointed by District V Supervisor Mary Rose Wilcox on May 14, 1997. Tom Manos, County Chief Financial Officer (standing, far left), has been Maricopa County’s CFO since 1997. Dennis Levine, Office of the Auditor General (standing, 2nd from left), is a CPA and a Certified Government Financial Manager. He has degrees in accounting and psychology from ASU and has been with the State of Arizona, Office of the Auditor General since 1979. Mr. Levine has been a Financial Audit Manager with the Office's Financial Audit Division since 1986 and has overseen audits of state agencies, universities, counties, community colleges, and school districts. He has been the audit manager on the Maricopa County audit since 1998. Ross Tate, County Auditor (standing, 2nd from right), see page 9 for his biography. William S. Knopf, Office of County Counsel (standing, far right), has been an attorney with the Maricopa County Attorney’s Office since 1979. iv National Awards Received 2004 Achievement Award National Association of Counties Jurors Helping Jurors - The Juror Improvement Fund Superior Court, in concurrence with the Maricopa County Internal Audit Department’s recommendation, developed a program that allows jurors to donate juror fees and mileage reimbursements to help other jurors have a good court experience. Max Wilson, Board of Supervisors Chairman Bob James, Judicial Services Administrator Christina Black, Internal Audit David Smith, County Manager Program funds provide: Juror shuttle bus Jury assembly room satellite television Post-trauma counseling for jurors Christina Black, Internal Audit Marcus Reinkensmeyer, Superior Court Administrator GASB Visit On January 2005 the Maricopa County Internal Audit Department hosted James “Jay” Fountain, a representative from the Government Accounting Standards Board (GASB). Mr. Fountain co-authored GASB’s Reporting Performance Information: Suggested Criteria for Effective Communication and Government Service Efforts and Accomplishments Performance Reports: A Guide to Understanding. Maricopa County Internal Audit is one of the “best practice” government entities featured in the publication. During his visit, Mr. Fountain and Internal Audit exchanged ideas and information on performance measure auditing and the use of performance measures in managing operations. Kimmie Wong, Toni Sage, Richard Chard, Eve Murillo, Jay Fountain, Ross Tate, John Schulz, Christina Black v Previous awards . . . Association of Government Accountants Awards for Publication Excellence 2004 Certificate of Recognition Service Efforts & Accomplishments Program Charter Participant 2004 Award of Excellence Investment & Financial Materials Category 2003 Distinguished Local Government Leadership Award Financial Condition Report Ross Tate, County Auditor National Association of Counties 2004 Achievement Award National Association of Local Government Auditors Performance Reporting for Citizens 2004 Achievement Award Continuous Monitoring 2003 Honorable Mention Knighton Award Countywide Fixed Assets 2002 Achievement Award Performance Measure Certification 2002 Special Project Award Performance Measure Certification 2001 Achievement Award Financial Condition Report 2001 Special Project Award Financial Condition Report 2001 Achievement Award 2000 Special Project Award “Got Controls” Management Bulletin Cash Handling Workshop 2000 Achievement Award Cash Handling Workshop Government Finance Officers Association Institute of Internal Auditors 2002 Award of Excellence 2002-2005 Commitment to Quality Improvement Award Performance Measure Certification Program vi Table of Contents Page Award Winning Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Information Technology Services . . . . . . . . . . . . . . . . . . . . . . 2 Best Practices in Auditing Recognition . . . . . . . . . . . . . . . . . 3 Performance Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Recoveries and Cost Avoidance . . . . . . . . . . . . . . . . . . . 6 Customer Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Inputs, Resources and Outputs . . . . . . . . . . . . . . . . . . . . . . . 9 Appendices: A ~ Professional Staff Biographies . . . . . . . . . . . . . . . . 12 B ~ Project Summaries . . . . . . . . . . . . . . . . . . . . . . . . . 16 C ~ Other Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 D ~ Single Audit Reviews . . . . . . . . . . . . . . . . . . . . . . . 28 E ~ Internal Audit Department Profile . . . . . . . . . . . . . . 29 F ~ Citizen’s Audit Advisory Committee Charter . . . . . . 32 G ~ Internal Audit Department Charter . . . . . . . . . . . 34 Internal Audit’s Mission To provide objective, accurate, and meaningful information about County operations so the Board of Supervisors can make informed decisions to better serve County citizens “Do the right things right!” Award Winning Products Control Bulletins Our one-page “Got Control” bulletins communicate important control issues to County executives, managers, and employees. National Association of Counties Achievement Award (2001) Control Self Assessment These workshops help employees determine their department’s control weaknesses and risks. Entertaining videos feature County management and elected officials demonstrating the right and wrong way to handle cash, monitor contracts, and process payables. National Association of Local Government Auditors Special Project Award (2000) National Association of Counties Achievement Award (2000) Financial Condition Report We annually assess and report on Maricopa County's financial condition in a highly visual, user-friendly, annual Financial Condition Report. This report displays key financial trends and compares Maricopa's performance with those of 10 western US counties. APEX (Awards for Publication Excellence) Award of Excellence (2004) National Association of Local Government Auditors Special Project Award (2001) National Association of Counties Achievement Award (2001) Performance Measure Certification In response to Maricopa County’s adoption of a performance management system, Managing for Results, we review inputs, outputs, efficiency, and progress toward outcome goals. We assign and report certification ratings to County leaders and top management. National Association of Counties Achievement Award (2002) Government Finance Officers Association Award for Excellence (2002) National Association of Local Government Auditors Special Project Award (2002) Citizens’ Report The Citizens’ Report provides citizens, the Board of Supervisors, and County administration with a new tool for evaluating public policy and reporting government accountability. National Association of Counties Achievement Award (2004) Association of Government Accountants Certificate of Recognition (2004) National Center for Civic Innovation $30,000 Grant (Alfred P. Sloan Foundation) (2004) 1 Information Information Technology Technology Services Services The County’s increasing reliance on Information Technology (IT) can increase productivity but can also increase the risk of unauthorized changes, data destruction, errors, unauthorized access to confidential data, downtime, and fraud. Because of these risks, we developed an IT audit function staffed by dedicated, experienced IT auditors who perform the following activities: Continuous Monitoring IT audit staff continuously monitor certain types of County transactions to ensure that County resources are used appropriately. These monitoring efforts focus on high-risk areas, such as routinely checking vendor payments and monitoring and assessing p-card (credit card) payments. Utilizing ACL, a powerful audit software, we are able to rapidly analyze transactional data in files of any size to ensure 100 percent coverage. The IT audit function also assists with ACL support for other Internal Audit projects. National Association of Counties Achievement Award (2004) IT General Controls and Application Audits IT General Controls and Application audits focus on reviewing the adequacy of each department’s computer system controls to ensure County data integrity, confidentiality, and availability. Audit examples are: payroll application, financial application, and data center operations. Virus Detection / Vulnerability Assessments Viruses and other types of computer attacks can be a serious threat to County operations. The County can deter these dangerous attacks by using aggressive virus protection systems and appropriate security measures. IT audit staff regularly reviews computer virus detection efforts and system vulnerability to ensure that proper controls are in place to reduce the risk of attack. An attack could cost the County a productivity loss up to $136,850 each hour. System Development Assessments We encourage County departments to use approved systems development methodologies when they develop new systems or enhance existing systems. These methodologies include: project management controls, logical access controls, test and training controls, and project implementation controls. IT audit staff is currently involved with monitoring the PeopleSoft development project. Web Page Management We designed our Internal Audit web page to provide useful information to County management, employees, citizens, and peers. Our website contains copies of our reports plus some tools we use for effective auditing. viii 2 Best Practices in Auditing Maricopa County Internal Audit received national best practices recognition in the following areas by the National Association of Local Government Auditors in its recent survey of 81 audit offices. Maricopa County Internal Audit Receives Best Practices Recognition Ranked in Top Third by National Survey in Following Categories • Contract auditing • Planning for the future • Automated audit tools • Audit report follow-up • Control self assessments • Marketing the audit function • External quality control reviews • Customer satisfaction surveys • Audit effectiveness questionnaire • Audit department planning process • Automated information systems auditing • High percentage of performance/operations audits • Audit report resolution and corrective action taken by management • Working with audit committee and/or senior management to identify major issues 3 Performance Results Internal Audit’s Four Primary Goals for FY 2005 Assist the County in its mission to provide fiscally responsible public services by: ♦ Goal 1: Completing 90% of the Board of Supervisors' approved annual Audit Plan and reporting objective, accurate, and meaningful information to the Board in a timely manner; no later than 90 days after the fiscal year-end. ♦ Goal 2: Providing objective, accurate, and meaningful information in a way that earns a 90% customer satisfaction rating each year from our primary customers, namely, the Board of Supervisors and the County Manager. ♦ Goal 3: Working with clients to ensure that 90% of audit report recommendations are implemented within three years of being reported. This goal will also assist Internal Audit in its vision to facilitate positive change throughout the County. ♦ Goal 4: Becoming a regional leader. Create and produce innovative, effective audit products and methodologies and share these on a regional and national level through publications, presentations, and award programs. Programs Internal Audit is participating in Managing for Results (MfR) through two programs: Audit Services and Management Services. (MfR is Maricopa County’s performance management system.) Internal Audit Audit Services Program Management Services Program Provide independent assessments and recommendations to the BOS and County management so they can make informed and fiscally prudent decisions. Provide strategic information and education to County officials and employees so that they can perform their jobs more effectively. Consulting Education & Training Information & Reporting 4 Key Performance Measures Internal Audit has seven key performance measures (with FY 2005 results): Audit Services Program ♦ 99% of IA recommendations were concurred with by clients ♦ 98% of IA recommendations were implemented within three years ♦ 100% satisfaction rating was received from Board and County Management for audit reports ♦ $3,178,783 economic impact was achieved Management Services Program ♦ 100% satisfaction rating received from customers indicating consulting services delivered by Internal Audit helped them do their job ♦ 91% satisfaction rating received from customers indicating educational efforts (newsletters, courses, etc.) help them do their job more effectively ♦ 100% overall approval rating achieved for Internal Audit’s strategic information reports by Board of Supervisors and key County management The following pages illustrate Internal Audit’s results. Economic Impact Although the amounts vary each year, Internal Audit’s economic impact (savings) continues to exceed its cost by a comfortable margin, as shown below. A well run internal audit function is an investment that benefits County management and citizens. Internal Audit has identified/recovered 3 times its budget in cumulative savings over the past 9 years. (Note: Budget shown in graph below includes co-source dollars.) Internal Audit Cost vs Savings Produced During FY 2004 and early FY 2005, Internal Audit deferred the Audit Plan to assist County management with issues affiliated with the County’s health system transition to a special health care district. $6 Millions $5 Health System Transition Issues $4 $3 $2 Savings produced by Internal Audit $1 $0 FY97 Audit Budget FY98 FY99 FY00 FY01 FY02 5 FY03 FY04 FY05 Audit Dollar Recoveries The table below shows FY 2005 audit project recommendations that could result in significant recoveries, savings, cost avoidance, or other economic impact. Audit Impact MIHS Contracts — Long Term Care, ValueOptions, & Share of Cost $ 1,515,210 Uncollected Share of Cost contributions; potential Share of Cost overpayments to providers based on test sample overpayment error rate of 8.3% Nursing Home Roster Billing 714,242 Overpayment estimate based on test sample error rate Countywide Travel 574,183 Countywide impact of errors on non-local travel claims; reduction in extradition trip expenditures; mileage reimbursement error corrections; redistribution of existing departmental fleet resources MIHS Capital & Operating Leases and Sales & Use Tax 238,000 Lease versus buy analysis to determine most effective way to acquire capital assets; Sales & Use Tax overcharges MIHS Contracts — ValueOptions Discharges 54,000 Erroneous invoice billings and payments (MIHS paid for discharge transportation that ValueOptions should have paid) Justice Courts 45,580 Summary of violations in which surcharges were sent to the State in error Countywide Contracts 22,420 Computer support and related services overcharges; vendor overpayments for sales taxes and registration fees on leased trucks Solid Waste P-Card Transactions 11,812 Identification of personal purchases on P-card MIHS Contracts — Patient Medical Transportation Assessor Entrance/Exit $ Recovery & Cost Avoidance Total: 3,200 136 $ 3,178,783 6 Description Duplicate payments Recoup 10 hours of PTO (Personal Time Off) FY05 Audit with Estimated Cost Avoidance Internal Audit’s work is not always measurable; for example, improved internal controls may result in cost savings. The table below shows an audit project that resulted in potential cost avoidance. Audit Internet Usage Review Impact Description $ 6,500,000 If the County is able to reduce its non-productive Internet use by at least 10 minutes a day on average for each of the County’s 9,000 Internet users, the County could save $6.5 million per year in personnel costs. Non-productive use is defined as personal use believed to be conducted on “company” time. Internal Audit is now conducting continuous unannounced monitoring of internet use. This type of monitoring historically decreases the amount of non-productive Internet usage in organizations. Potential Cost Avoidance Total: $ 6,500,000 Our Cost vs. The Cost to Outsource the Audit Function FY 2005 audit work would have cost the County twice as much if external auditors had been used instead of internal audit staff. (Note: “Internal Audit Budget” bar includes co-source budget dollars.) FY05 Cost Comparison (Millions) Internal Audit Budget Projected Cost to Outsource Internal Audit's Work 0 1 2 3 4 FY05 Average Hourly Cost Com parison Internal Audit $51 Outsourced Vendors $- 7 $153 $50 $100 $150 $200 What Did Our Customers Say? Quotes below are taken from FY 2005 customer surveys: “Extremely helpful and beneficial...” “The auditors are professional, courteous, and always pleasant to work with. Thank you for your assistance with this and our other projects.” “Ask for help and they respond instantly. We appreciate that level of support.” “Very professionally conducted and the results were very helpful to this department.” “This report is fantastic!! I don’t think I’m going to find a report better than Internal Audits.” “Thanks for working in Internal Audit. I really appreciate the work all of you do.” 94% of Maricopa County Department Directors reported they were satisfied with Internal Audit’s mission fulfillment. 100% were satisfied with the professionalism demonstrated by the County Auditor and the Internal Audit staff. — Maricopa County Research & Reporting, FY05 Note: Excludes “Don’t know/No opinion” responses “I wanted to thank you and your staff for your excellent and prompt response when we asked for help...” “The in-charge auditor conducted the audit team in a complete professional manner. A good deal of ‘up-front’ work was done to ensure timely communications and the opportunity to voice concerns prior to the audit. Communications continued throughout the audit process, we always knew where we were in the process.” “Thank you to the County Internal Audit team that helped the Claims Department get on track with auditing.” “Very helpful report.” 8 Inputs / Resources & Outputs Department Budget The County’s internal audit costs remain very low compared to other counties, as shown below. The benchmark average annual cost for an audit department is $1.8 million (comparing Maricopa with six benchmark counties). Internal Audit Budget Size Comparisons FY 2004-05 (Millions) $3 $2 $1 $0 Multnomah Maricopa King Clark San Diego FY05 IA Budget Average Harris Orange Internal Audit has produced good results with minimal resources (our staff investment is equal to or more economical than our benchmark counties). 0.12% What % is Internal Audit of the Total County Budget? (All are less than 1%) FY 2004-05 0.10% 0.08% 0.06% 0.04% 0.02% 0.00% San Diego King Clark Maricopa Audit Budget % 9 Orange Average Multnomah Harris Cost Per Audit Employee Our investment cost of $92,000 per audit staff member (includes auditors and administrative staff) is low compared to our benchmark counties (average: $115,000) Cost per Internal Audit Employee FY 2004-05 (Thousands) $140 $120 $100 $80 $60 $40 $20 $0 Maricopa Clark Harris Multnomah Budget per Employee Staff Size Maricopa County is almost at the benchmark average of staff size (# of auditors). Orange San Diego King Average Number of Auditors Comparison FY 2004-05 20 18 16 14 12 10 8 6 4 2 0 Multnomah King Maricopa Clark # of Auditors Outputs Audit Services Program: Internal Audit’s FY 2005 outputs consist of the number of audit reports issued, consulting engagements, educational classes taught, and strategic information reports issued. Management Services Program: San Diego Orange Harris Average 18 Consulting Activities 14 Educational Activities 11 Strategic Information & Reporting Activities TOTAL: 8 51 10 Appendices 11 Appendix A: Professional Staff Biographies Internal Audit employed the following individuals during FY 2004-2005. Ross L. Tate, County Auditor Mr. Tate is a Certified Internal Auditor, Certified Management Accountant, and Certified Government Financial Manager. He has a bachelor’s degree from Brigham Young University in business operations & systems analysis and 19 years of professional internal auditing experience. Mr. Tate joined the Maricopa County Internal Audit Department in 1989 and has been County Auditor since 1994. He is a committee chair and board member of the National Association of Local Government Auditors, and an active member of the Institute of Internal Auditor’s Phoenix Chapter and the Arizona Local Government Auditors Association. Joan Simpson, Office Manager Ms. Simpson has a bachelor’s degree in social science with a major in political science from Milton Keynes University in the United Kingdom. She has professional experience in both the private sector and in government. She also has developed her technical skills in the use of software programs to further enhance her productivity within the office. D. Eve Murillo, Audit Manager Ms. Murillo is a Certified Public Accountant and a Certified Fraud Examiner. She has a bachelor's degree in liberal arts from the University of Illinois, a masters in business administration from Florida Institute of Technology, and 16 years of accounting and internal auditing experience. Ms. Murillo is a member of the National and Arizona Chapter of the Association of Certified Fraud Examiners and the Arizona Local Government Auditors Association. Joe M. Seratte, Audit Manager Mr. Seratte is a Certified Public Accountant, Certified Internal Auditor, and has a certification in Control Self-Assessment. He holds an accounting degree from Oklahoma State University and a master's degree from the American Graduate School of International Management (Thunderbird) in Glendale, Arizona. He has 23 years experience in auditing, finance, and accounting and is a member of the American Institute of Certified Public Accountants and is current President of the Arizona Local Government Auditors Association. 12 Susan Adams, Senior Information Technology Auditor Ms. Adams is a Certified Information Systems Auditor. She has a bachelor's degree in accounting from Utah State University and an MBA from the University of Utah. She has 13 years professional experience in accounting and audit with 7 years as an Information Systems auditor. Ms. Adams is currently serving as Vice President for the Information Systems Audit and Control Association's Phoenix Chapter and is a member of the Arizona Local Government Auditors Association. Richard L. Chard, Senior Auditor Mr. Chard is a Certified Public Accountant and has a history degree from the University of Redlands and postgraduate work in accounting and public administration through Arizona State University and Western International University. Before joining Internal Audit eight years ago, he worked five years in Maricopa County's Department of Finance and Health Systems Finance. John Schulz, Senior Auditor Mr. Schulz has 25 years of experience in program evaluation, budgeting, and financial administration within healthcare, law enforcement and government. He holds a degree in government from University of Maryland and a masters of public administration from Arizona State University. He is a Certified Fraud Examiner and is a member of the Association of Certified Fraud Examiners and the Arizona Local Government Auditors Association. Cathleen L. Galassi - Senior Auditor Ms. Galassi has a bachelor’s degree in philosophy from Loyola Marymount University, California, and post-graduate work in organizational psychology. She has extensive experience, including audit management at financial institutions, along with accounting and budgeting at healthcare and non-profit institutions. Ms. Galassi’s experience includes participation on merger and acquisition teams and system conversion projects. Ms. Galassi is a member of The Institute of Internal Auditors. Patra E. Carroll, Senior Auditor Ms. Carroll is a Certified Public Accountant with over 10 years of financial, performance, compliance, and tax auditing experience within the public sector. She has a bachelor's degree in accounting and postgraduate work in public administration from Arizona State University and is a member of the Arizona Local Government Auditors Association. 13 Thomas L. Fraser, Information Technology Auditor Mr. Fraser is a Certified Fraud Examiner who holds degrees in business administration and business management. He has 14 years of accounting and professional internal audit experience. Mr. Fraser is a member of the Institute of Internal Auditors, Arizona Chapter of the Association of Certified Fraud Examiners, Information Systems Audit and Control Association, and serves as a committee member for the Arizona Local Government Auditors Association. Mr. Fraser left the County in September 2005 to work for Wells Fargo. Kimmie Wong, Associate Auditor Ms. Wong has a bachelor's degree in business administrative services from Arizona State University and a masters in public administration from Western International University. She has over 7 years of experience reviewing grant audits and 9 years of professional internal auditing experience. Ms. Wong is a member of the Arizona Local Government Auditors Association and the Association of Certified Fraud Examiners' Arizona Chapter. Christina Black, Associate Auditor Ms. Black is a Certified Government Audit Professional with over 10 years of professional internal audit experience and 10 years of accounting and revenue auditing experience. She has a bachelor's degree in accounting from Missouri Western State College and is a member of the Arizona Chapter of the Association of Certified Fraud Examiners, Arizona Local Government Auditors Association, and the Institute of Internal Auditor’s Phoenix Chapter, where she serves as Chair on the Meetings Committee. Lisa Cave, Associate Auditor Ms. Cave has a bachelor’s degree in accounting from Arizona State University West and is currently working towards her masters in business administration. She has over 7 years of professional experience in accounting and business. Ms. Cave is a member of the Arizona Local Government Auditors Association, Association of Certified Fraud Examiners’ Arizona Chapter, and the Institute of Internal Auditors. Louise Wild, Associate Auditor Ms. Wild is a Certified Internal Auditor and a Certified Public Accountant with 3 years of combined internal audit and public accounting experience. She is a member of the Institute of Internal Auditors and the Arizona Local Government Auditor’s Association. Ms. Wild graduated Suma cum laude from Arizona State University West/Barrett Honors College with a bachelor’s degree in Accounting. Ms. Wild left the County in August 2005 to work for Pinnacle West. 14 Laurie Aquino, Staff Auditor Mrs. Aquino has a bachelor’s degree in accounting from Arizona State University West. She has five years of professional experience in accounting and business. Mrs. Aquino is a member of the Arizona Local Government Auditors Association and the Arizona Chapter of the Association of Certified Fraud Examiners. Ms. Aquino left the County in September 2005 to move to Iowa. Trisa Cole, Staff Auditor Ms. Cole graduated Arizona State University West with a bachelor’s degree in global business / finance and a post baccalaureate certificate in accountancy. She is a member of the Arizona Local Government Auditors Association, Arizona Chapter of the Association of Certified Fraud Examiners, and the American Institute of Certified Public Accountants. Internal Audit staff members participate in a variety of professional and service organizations, as shown below. For Internal Audit’s educational requirements, please see Appendix E, page 31. American Institute of Certified Public Accountants (AICPA) Arizona Local Government Auditors Association (ALGAA) Arizona Chapter of the Association of Certified Fraud Examiners (CFE) Association of Government Accountants (AGA) Information Systems Audit and Control Association (ISACA) Institute of Internal Auditors Phoenix Chapter (IIA) Maricopa County Adjunct Faculty Maricopa County Blood Drive National Association of Certified Fraud Examiners (CFE) National Association of Local Government Auditors (NALGA) Toastmasters International 15 Appendix B: Project Summaries Report Title Page ♦ Advantage Application Review 17 ♦ Assessor’s Entrance/Exit 17 ♦ Citizens’ Report 17 ♦ Continuous Monitoring 18 ♦ Countywide Contracts 18 ♦ Countywide Records Retention 18 ♦ Countywide Travel 19 ♦ Financial Condition ♦ Report Title ♦ MIHS Contracts ~ Patient Transportation Page 22 ♦ MIHS External Network Vulnerability Assessment 23 ♦ MIHS Transition ~ Fixed Assets 23 ♦ MIHS Transition ~ IGA’s 23 ♦ MIHS Transition ~ Internal Audit Staffing Analysis 24 19 ♦ MIHS Transition ~ Inventories 24 Grant Funded Single Audit 19 ♦ MIHS Transition ~ Leases and Sales & Use Tax 24 ♦ ICJIS Review 20 ♦ ♦ 20 MIHS Transition ~ OAO Third Party Administrator 25 Internet Usage Monitoring ♦ Justice Courts MAS 20 ♦ MIHS Nursing Home Roster Billing 25 ♦ Juvenile Probation MAS 21 ♦ Performance Measure Certification 25 ♦ Managed Care OAO Claims Quality Assessment 21 ♦ Program Evaluation ~ Tuition Reimbursement 26 ♦ MIHS Cash Monitoring 21 ♦ MIHS Contracts ~ Behavioral Health Discharges Random Cash Counts ~ Solid Waste 26 22 Solid Waste P-Card Transactions 26 MIHS Contracts ~ Long Term Care, Behavioral Health, Share of Cost 22 ♦ ♦ ♦ 16 Advantage Application Review ~ May 2005 The Department of Finance (DOF) is the primary owner of the County’s Advantage financial application. DOF processes invoices for all County entities including the Maricopa Managed Care System as of January 1, 2005. The Office of the Chief Information Officer (OCIO) provides technology support for the Advantage system. The OCIO supports the base system, inventory, fixed assets, and the extended purchasing applications that are run in the mainframe environment. Materials Management is a key user of the Advantage financial application and utilizes the Advantage system to manage the County’s procurement activities, manage established vendor accounts, and track approved contract expenditures. Significant Issues ♦ Segregation of duties conflicts and excessive user-access permissions ♦ Control deficiencies identified with the vendor’s management of outsourced data center operations ♦ Control weaknesses exist within procedures related to data extraction, data validity, and annual financial reporting Assessor’s Entrance/Exit Review ~ July 2005 Entrance/Exit reviews of newly elected officials are limited scope engagements, which are offered to newly elected officials to assist a smooth transition. The objectives of these reviews are established based on risk assessment. The newly elected Assessor, Keith Russell, took office in January 2005. Significant Issues ♦ Weak user access controls resulted in users with inappropriate levels of access within the Assessor’s information system ♦ Remote access controls appear to be established and functioning properly; access has been granted to appropriate staff based on their duties ♦ Failure to follow established pricing policies resulted in a $9,500 data set being provided to a customer without charge Citizens’ Report ~ September 2004 The Citizens’ Report provides citizens, the Board of Supervisors, and County administration with a communication tool designed to report government accountability and inform citizens about County government . Report Highlights ♦ Examples of department expenditures compared with service accomplishments and public benefits ♦ Illustrations of performance trends over two-to-five year periods ♦ A demonstration of how this type of report would contribute to the County’s Managing for Results cycle by reporting performance measures to the Board and Maricopa County citizens 17 Continuous Monitoring ~ September 2005 Internal Audit uses a powerful software program called Audit Command Language to analyze 100 percent of targeted transactions in order to identify inaccurate or inappropriate transactions. We developed trend data for comparison purposes by collecting and analyzing data for a 12-month period. This data assists with identifying large, and therefore suspect, variances. Monitoring of electronic merchant transactions allows Internal Audit to identify and investigate instances where credit or charge back transactions are not appropriate. During calendar year 2004 Internal Audit considered three areas for continuous monitoring: procurement cards (P-cards), vendor/employee conflicts of interest, and merchant terminal credit transactions. Countywide Contracts ~ August 2005 Internal Audit annually reviews controls and transactions for a selected group of County contracts. The County’s Materials Management Department (MMD) negotiates, executes, and oversees approximately 920 contracts with authorization over $1 billion. While MMD is responsible for procurement and oversight of County contracts, each user department is required to monitor vendor performance and contract usage. This year we reviewed seven contracts: PC maintenance, support, & related services; PC equipment & related devices; truck & trailer leases; traffic sign materials; HVAC service & repair; landscaping supplies & chemicals; and telecommunications cabling. Significant Issues ♦ Lack of effective contract monitoring exposed the County to $12,069 in overcharges for computer support and related services ♦ Ineffective contract monitoring exposed the County to overcharges for computer support and related services. The County overpaid one vendor $9,000 for sales taxes and registration fees on leased trucks Countywide Records Retention ~ May 2005 Good record keeping is a basic government function. Citizens rely on government to track important public information ranging from property tax information to the development of major programs through legislation. The current Records Management program does not provide clear employee guidelines. The program is fragmented to the point that departments have implemented internal policies and procedures, which may not be aligned with the original goals and objectives of the County’s Records Management Program. The risk to the County is that records could be destroyed prior to their retention period expiration or held in excess of approved retention period, causing both operational and financial challenges. Significant Issues ♦ The Records Management program should be approved by the Board of Supervisors, communicated to staff, and maintained through ongoing training ♦ The Recorder’s Office is mandated by statute to record documents as provided them for recordation, including any personal and/or confidential information contained in the documents ♦ Record destruction services are adequate to prevent unauthorized retrieval of information 18 Countywide Travel ~ August 2005 Our objective was to ensure travel dollars were efficiently and effectively spent. Typically, “travel” expenditures are airline tickets, hotel bills, rental cars, and per diem meals; we found that the County spends the majority of its travel dollars on local transportation. Significant Issues ♦ Retail fuel purchases and County pump fill-ups were frequently completed by employees on vacation days and scheduled days off ♦ One office could have saved $170,000 if extradition trips had not included additional nights ♦ Mileage reimbursement costs could be reduced through closer review of reimbursement requests and better management of department vehicles Financial Condition ~ July 2005 This year we highlighted the financial strength of the County’s General Fund, Transportation Fund, and Flood Control District within the context of exceptional population growth. Maricopa County has accommodated this growth while maintaining very low levels of debt. As noted in previous Financial Condition Report issues, the health delivery system and AHCCCS health plans pose significant offsets to otherwise positive trends in the County. Significant Issues ♦ General Fund Unreserved Balance: $318 Million ♦ Healthy Indicators — General Fund, Transportation Fund, Flood Control Fund ♦ Unhealthy Financial Indicators — Maricopa Health Care System (Medical Center transferred to Special Health Care District; health plans transferred to Special Health Care District or closed) Grant Funded Single Audit ~ June 2005 A Single Audit is an independent audit of non-federal entities that expend $300,000 or more in federal grant funds in years ending on or before December 31, 2003 or $500,000 for years ending thereafter. These audits are performed in compliance with the Federal Office of Management and Budget Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations. We reviewed FY 2003 and FY 2004. Significant Issues ♦ 18 of the audit reports contained 84 findings related to federal grant funds ♦ 84 findings included 58 instances of noncompliance with laws, regulations, contracts, or grant agreements and 52 reportable weaknesses in internal controls (a finding can encompass both compliance and internal control) ♦ Sixteen of the reportable weaknesses in internal controls were considered material weaknesses 19 Integrated Criminal Justice Information System (ICJIS) Review ~ May 2005 Maricopa County voters approved Proposition 400 in 1998 to raise the sales tax by 1/5th of a cent to fund ICJIS projects and data exchanges that benefit Justice and Law Enforcement agencies. Considering its magnitude and complexity, the ICJIS project appears to be progressing well. Our 2004 review found the project to be appropriately managed with an effective utilization of resources (personnel, technical expertise, and infrastructure). Significant Issues ♦ Overall, effective controls have been designed and implemented within the project ♦ Areas needing some degree of management control improvement include scope, cost, time, and user requirements Internet Usage Monitoring ~ August 2005 Maricopa County policy identifies acceptable and unacceptable use of County computing resources, and outlines the authority and responsibility of users and management. The policy states that the County can monitor and record computer usage, including Internet use, at any time without prior notice or warning to the user. Internal Audit performs ongoing Internet usage reviews to increase management’s awareness of employee Internet usage, promote acceptable use, and limit potential abuse of County resources. Significant Issues ♦ The County has established suitable policies and controls for proactively monitoring employee Internet usage ♦ Current Internet filters block only adult content-related sites and do not address other types of unacceptable sites, as outlined in County policy ♦ Internet usage reviews are performed quarterly to deter abuse and increase management’s awareness of employee Internet usage Justice Courts MAS ~ May 2005 The 23 Justice Courts in Maricopa County handle criminal traffic, misdemeanor cases, and a variety of civil matters not in excess of $10,000. Internal Audit reviewed seven Maricopa County Justice Courts for compliance with applicable Minimum Accounting Standards (MAS). These audits are to satisfy requirements established by the Administrative Office of the Arizona Supreme Court. The purpose of the engagement is to ensure that County courts maintain effective internal controls over financial accounting and reporting systems. Significant Issues Although we did find some exceptions, none present a significant risk to the courts. We noted that the most common cash receipt exception this year was the distribution of receipts to incorrect account codes. These exceptions are not significant by themselves, however, the distribution error causes the County to receive less money than prescribed by statute, and could have a notable monetary impact if the error is widespread. 20 Juvenile Probation MAS ~ November 2004 Internal Audit completed a Minimum Accounting Standards (MAS) review of the Juvenile Probation Department. The independent review is required every three years by an order of the Administrative Office of the Arizona Supreme Court (AOC); the review is limited to the Juvenile Probation diversion restitution checking account. Significant Issue Our review noted minor exceptions to AOC standards. Managed Care OAO Claims Quality Assessment ~ March 2005 Maricopa Managed Care Systems (MMCS) management requested that Internal Audit review MMCS’ Claims Quality Assessment Audit effectiveness for claims processed against the County’s health plans and make recommendations for improvement. The new health plan management team needed assistance in strengthening the existing Claims Quality Assessment Audit function by setting quality standards and providing more definitive policies, procedures, and processes. Significant Issues Improvements were needed to help the MMCS claims audit team: ♦ Verify that claims were paid in accordance with contractual rates ♦ Detect claim processing errors ♦ Correctly report claim processing error and accuracy ratios ♦ Define a representative sampling methodology for the claims audit MIHS Cash Monitoring ~ FY 2005 (Monthly) On a monthly basis, Internal Audit monitors, researches, and reports major health system cash trends to the Board of Supervisors. These reviews were initiated as a result of precipitous Maricopa Integrated Health System (MIHS) cash balance declines that occurred in 2001. Significant Issues ♦ The combined health plans cash balances declined on average $10M monthly after August 2004. ♦ April 2005 liabilities of the two AHCCCS (Arizona Medicaid program) health plans exceeded cash and other assets by an estimated $51 million (per April 2005 Unaudited Financial Statements). This $51 million net equity deficit falls $69 million short of the required AHCCCS equity reserve of $18 million. ♦ The Maricopa County health system was divested of its medical delivery system (hospital and clinics) in January 2005. The delivery system was transferred to a Special Health Care District (SHCD). The County extended a $15 million credit line to the SHCD. Internal Audit reports monthly on the outstanding balance. ♦ The two Maricopa County AHCCCS health plans will close September 30, 2005. 21 MIHS Contracts — Behavioral Health Discharges ~ November 2004 The Maricopa Integrated Health System (MIHS) owns the Desert Vista Behavioral Health Center, which provides mental health and substance abuse treatment services. ValueOptions, the Regional Behavioral Health Authority in Maricopa County, places their clients in the Desert Vista facility. Upon discharge, ValueOptions clients require transportation to other facilities such as the ValueOptions Crisis Recovery Unit. ValueOptions is responsible to pay for their clients’ transportation. The County’s health system paid a transportation vendor $54,000 for behavioral health transportation costs that should have been paid by ValueOptions. The health system detected this error in February 2003 but took no action to recover the incorrect payments. The health system should seek recovery for the $54,000. MIHS Contracts — Long Term Care, Behavioral Health, Share of Cost ~ November 2004 We reviewed selected Maricopa Integrated Health System (MIHS) contracts with long-term care providers (nursing home and assisted living facilities), and with ValueOptions (the Regional Behavioral Health Authority in Maricopa County). ValueOptions was the County’s behavioral health facility’s largest source of revenue, approximately $15 million in FY 2003. Significant Issues ♦ Contract monitoring activities are not adequate to detect errors in payments to service providers ♦ Errors in payments made to one assisted living facility exceeded 70% ♦ Errors in payments made to nursing homes could be costing the County more than $1 million each year MIHS Contracts — Patient Transportation ~ November 2004 The Maricopa Integrated Health System (MIHS) Patient Transportation Services Department (PTS) arranges transportation for MIHS health plan members and others with health care transportation needs. PTS handles approximately 44,500 transports per year, averaging 123 transports per day. MIHS utilizes its own vans, leased vans and drivers, and outside contractors to fulfill its transportation requirements. Internal Audit reviewed PTS’ contracts with three vendors. Significant Issues ♦ MIHS needs to strengthen contract monitoring procedures ♦ Over 40% of the claims reviewed contained errors — including duplicate payments 22 MIHS External Network Vulnerability Assessment ~ December 2004 The primary objective of the review was to determine if adequate security and controls exist for Maricopa Integrated Health System (MIHS) networks to prevent hacker attacks, or other unauthorized intrusions, that could potentially disrupt, damage, or bring down the networks. MIHS’ technology group develops and maintains the security infrastructure for all MIHS networks. This includes, but is not limited to, the checkpoint firewall, routers, remote access, and web servers. The scope included performing a vulnerability assessment of the MIHS network and web-based applications and assessing security over MIHS dial-up modem connections. Significant Issues: ♦ Five network security exposures exist on the MIHS network — all five are classified as low risk ♦ Four accessible dial-up modem connections were identified MIHS Transition — Fixed Assets ~ November 2004 As part of Internal Audit’s participation in the transition of the County’s health system (MIHS) to the new Special Health Care District, Internal Audit worked with the Real Estate Transition Committee to achieve its objectives. The overall objectives were to ensure fair and accurate presentation of the MIHS balance sheet, and to implement process improvements. Significant Issues: ♦ Tagging fixed assets and recording the same asset number on both the fixed asset system and the warehouse log will significantly improve the accuracy of fixed asset information ♦ Records maintained by the Warehouse and MIHS Finance should include a uniform physical location code - purchase order and capital expenditure request numbers should be included ♦ Assets should be validated on an annual basis and the system adjusted to reflect actual assets on hand ♦ Policies and procedures should be developed as guidance for employees responsible for asset accounting ♦ MIHS should formalize a procedure in which the Warehouse communicates asset disposals to Finance and Finance updates the system with fixed asset disposals MIHS Transition — IGA’s ~ November 2004 As part of Internal Audit’s participation in the transition of the County’s health system (MIHS) to the new Special Health Care District, Internal Audit reviewed Intergovernmental Agreements (IGA’s) in place for the hospital delivery system. Our work was planned to complement the efforts of the County’s Transition Committee. Significant Issues ♦ All IGA’s were accounted for on the MIHS Contract Register ♦ All MIHS IGA’s were approved by the Board of Supervisors 23 MIHS Transition — Internal Audit Staffing Analysis ~ August 2004 Internal Audit was asked to research and report on the structure of the internal audit function that the new health care district would need. We gathered information related to the size and composition of health care internal audit functions around the country to form our recommendations. We provided sample budget, staffing needs, and benchmark data for similar facilities based upon our surveys results. We recommend an internal audit function be established within the new health care district because the value added would be significant, especially in the areas of cost control, revenue enhancement, and compliance. MIHS Transition — Inventories ~ November 2004 As part of Internal Audit’s participation in the transition of the health system (MIHS) to the new Special Health Care District, we, reviewed the health system’s inventory process to ensure that adequate controls were in place, and to identify potential process improvements. Specifically, we reviewed processes in the areas of physical inventory, pharmacy operations, purchase orders, and contracts. In addition, we performed contract reviews for 19 vendors that supply the health system with inventory items. MIHS Transition — Leases and Sales & Use Tax ~ December 2004 As part of Internal Audit’s participation in the health system (MIHS) transition to the Maricopa County Special Health Care District, we reviewed leases in place for the hospital delivery system. Specifically, we reviewed the accuracy of sales and property tax charges, examined how lease versus buy analysis may impact the health system’s capital asset acquisition decisions, reviewed leasehold reimbursements from Centerre Rehabilitation Hospital of Arizona, LLC, validated specialty bed rental fees, and examined the lease expenditure process. We also audited sales tax charges for other health system contracts impacted by the Medical Center’s sales and use tax exemption. Significant Issues: ♦ The health system overpaid at least $100,000 in sales and use taxes ($91,632 has been recovered to date) ♦ $138,000 could be saved by purchasing Auto Syringe IV pumps instead of leasing them ♦ The health system did not enforce provisions of a contract we reviewed, resulting in lost interest and financial exposure from an expired letter of credit 24 MIHS Transition — OAO Third Party Administrator ~ July 2005 In June 2004, the health system (MIHS) transitioned from an outdated claims processing system to a new technology solution provided by a Third-Party Administrator (TPA). To manage the changeover process, the health system created a transition leadership team. Internal Audit contracted in mid-February with an outsourced firm to begin meeting with this transition team on a weekly basis to gain familiarity with the TPA transition process and to identify areas of potential risk. Significant Issues ♦ The health system has focused significant attention to ensure that only clean claims are submitted for processing during the transition period ♦ Relations with providers will have to be carefully managed as health system pre-payment credits are expended MIHS Nursing Home Roster Billing ~ July 2005 The health system (MIHS) pays nursing homes approximately $108 million annually for their claims. In May 2004, MIHS internally developed a nursing home payment system called “Nursing Home Roster Billing” (NHRB). NHRB is a web-based application that allows facilities to review payment data on-line for accuracy and to request adjustments, if needed. Significant Issues ♦ Of the payments selected for review, 13% were not accurate or did not agree with contract rate terms; overpayments to nursing homes could be as much as $714,000 annually ♦ Significant system control weaknesses exist that could affect nursing home payment accuracy Performance Measure Certification ~ July 2005 In FY 2001 the Maricopa County Board of Supervisors adopted a performance measurement initiative called Managing for Results (MfR). The Performance Measure Certification (PMC) program was adopted to validate performance measures for County management, the Board of Supervisors, and the general public. Under the PMC program, Internal Audit reviews MfR results, assigns certification ratings, and reports conclusions. Our certification program enables County leaders to rely upon reported performance measures and make informed decisions concerning government resources. Significant Issues ♦ 75% of the measures reviewed were certified ♦ FY 2005 results improved 24% over the previous year 25 Program Evaluation — Tuition Reimbursement ~ August 2005 Human Resources (HR) implemented a Tuition Reimbursement Program in 1997. Program usage has consistently grown; however, HR has not established specific written program goals or methods to measure if goals are achieved. HR should use available data to measure and report the success of the program. Significant Issues While the program appears to be popular and successful, Internal Audit recommends that, at a minimum, HR should: ♦ Develop and establish clearly defined objectives, goals, and key performance measures ♦ Analyze program data that has been collected in order to assess and improve program effectiveness ♦ Follow up on the exceptions to program rules, such as payments exceeding the annual limit and missing system data Random Cash Counts — Solid Waste ~ July 2005 The Solid Waste department (SW) provides collection sites and tire recycling programs for residents and businesses located within the county. SW also maintains closed landfills, and monitors environmental water and gas emissions in accordance with AZ Department of Environmental Quality rules and regulations. SW operates six transfer stations and one waste tire collection site. The scope of our work included reviewing controls over Solid Waste department cash receipts. This was a limited scope audit, the objectives of which were to perform tests of cash transactions and to determine if controls over cash receipt processes were adequate. Significant Issues ♦ The Solid Waste cash receipt process contains several control weaknesses ♦ Cash receipt testing did not identify any cash discrepancies or missing funds Solid Waste P-Card Transactions ~ June 2005 The Purchase Card (P-Card) Program’s primary goal is to reduce the cost of purchasing goods and services. The program places reliance on cardholder responsibility and requires cardholders to maintain proper purchase documentation. Significant Issues ♦ Employees’ P-Card transactions were not in compliance with County policies and procedures ♦ Cardholders did not maintain receipts and transaction logs ♦ Cardholders made purchases off-contract and for personal use ♦ Expenditures were not allocated appropriately between the Waste Tire Fund and the Landfill Fund 26 Appendix C: Other Projects Board of Supervisors Monthly Progress Reports These reports satisfy Internal Audit’s charter requirements to monthly update Board members. Consulting Activities ~ Throughout the Year We completed the following department-requested consulting projects: Aids Project Arizona County Vehicle Fleet Animal Care & Control HB2344 Legislature Animal Care & Control Cash Receipts Public Health Grant Administration Note: Other consulting activities are featured in Appendix B: Project Summaries. Control Self Assessment Classes ~ Throughout the Year Internal Audit conducted five Control Self Assessment (CSA) workshops attended by a total of 69 County employees. The classes improve employees understanding of good cash handling practices. Electronic Government Council ~ Ongoing Internal Audit participates on a task force that provides the Chief Information Officer (CIO) and Executive Management input on future County direction in EGov applications, website development, and interfacing with state and other jurisdictions. Annual Risk Assessment Internal Audit uses its Countywide risk assessment as a necessary planning tool to help determine high, low, and medium risk areas that should be audited and reviewed. This tool is a precursor to the audit plan. IT Risk Assessment Internal Audit performed an assessment to address the IT audit needs at the county and to help in assessing where IT audit resources should be applied to cover the areas of highest risk. 27 Appendix D: Single Audit Reviews In FY 2002-2003 Maricopa County passed through $15.8 million of federal grant funds to 46 subrecipients; 39 of which are required to undergo a Single Audit. In FY 2003-2004, Maricopa County passed through $14.4 million to 48 subrecipients; 38 were required to undergo a Single Audit. As mandated by OMB Circular A-133, we reviewed their Single Audit Reports and found a combined 18 reports contained a total of 16 material weakness findings; which were reported to the appropriate County department. Internal Audit will follow up on ten overdue Single Audit Reports. The subrecipients are: Pass Through Agency ~ Maricopa County Adult Probation Department Chicanos Por La Causa, Concepts for Change, Family Service Agency, Treatment Assessment Screening Center, Northwest Organization for Voluntary Alternatives Pass Through Agency ~ Maricopa County Emergency Management Department AZ Division of Emergency Management, City of Avondale, City of Chandler, City of Glendale, City of Goodyear, City of Mesa, City of Peoria, City of Phoenix, City of Scottsdale, City of Surprise, City of Tempe, Daisy Mountain FD—New River, Fountain Hills-CERT, Salt River Pima Indian Community FD, Sun Lakes Fire District, Town of Gilbert, Volunteer Center, Pass Through Agency ~ Maricopa County Department of Environmental Services Regional Public Transportation Authority Pass Through Agency ~ Maricopa County Department of Human Services Arizona Call-A-Teen Youth Resources, Catholic Social Services, Chandler Unified School District, City of Avondale, City of El Mirage, City of Glendale, City of Scottsdale, City of Tempe, City of Tolleson, Community Services of Arizona, Foundation for Senior Living, Gilbert Unified School District, Goodwill Industries of AZ, Mesa School District, New Life Center, Save the Family, Tempe Community Action Agency, Town of Buckeye, Town of Gila Bend, Town of Guadalupe Pass Through Agency ~ Maricopa County Juvenile Probation City of Glendale, City of Phoenix Pass Through Agency ~ Maricopa Integrated Health System Aids Project Arizona, Area Agency on Aging, ASU-Community Health Services & Student Health HIV Program, Body Positive, Concilio Latin de Salud, Ebony House, Phoenix Children’s Hospital Pass Through Agency ~ Maricopa County Department of Public Health Aids Project Arizona, Area Agency on Aging, Arizona Department of Health Services, ASUCommunity Health Services & Student Health HIV Program, Banner Health, Body Positive, Catholic Social Services, Central Arizona Shelter Services, Chicanos Por La Causa, Clinic Adelante, Community Legal Services (HIV/AIDS Law Project), Concilio Latino de Salud, Jewish Family & Children’s Services, Mountain Park Health Center, Northwest Organization for Voluntary Alternatives, Phoenix Children’s Hospital, Phoenix Indian Medical Center, Phoenix Shanti Group, Pinal County Health Department, St. Joseph’s Hospital 28 Appendix E: Internal Audit Department Profile Definition Internal auditing is an independent, objective assurance and consulting activity that adds value and improves operations. Internal auditing helps an organization reach objectives by bringing a systematic, disciplined approach to improve the effectiveness of risk management, control, and governance processes. Mission The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board of Supervisors can make informed decisions to better serve County citizens. Vision To facilitate positive change throughout County operations while ensuring that public resources are used for their intended purpose. History The Board of Supervisors appointed the first County Auditor in 1978 and established an internal audit function. In 1994, the Board of Supervisors created a Citizen’s Audit Advisory Committee comprised of private citizens and County officials. (See Appendix F for charter.) In 1997, the Board of Supervisors formalized the County’s internal audit function by adopting a department charter, which was amended in December 2002. (See Appendix G for charter.) Citizen’s Audit Advisory Committee (Audit Committee) The Board Appointed Citizens’ Audit Advisory Committee supports further strengthening of the County’s Internal Audit Department. This committee, comprised of accounting and business professionals, actively engages in analyzing risk throughout the County and making recommendations. This committee is an important link between the Board of Supervisors and the County’s auditors, both internal and external. The Maricopa County Citizen’s Audit Advisory Committee meets regularly to review and comment on audit reports, County financial statements, and other audit information (audit plan, special requests, etc.). Organizational Independence Auditors should be removed from organizational and political pressures to ensure objectivity. As our charter designates, the Maricopa County Internal Audit Department reports directly to an elected Board of Supervisors thereby establishing an effective level of independence from management. This reporting structure provides the Board of Supervisors with a direct line of communication to Internal Audit and provides assurance that County officials cannot influence the nature or scope of audit work performed. Government Auditing Standards support locating internal audit departments’ outside the management function in order to encourage independence. Routine meetings with an independent audit committee further enhance independence. The County Auditor also meets with an oversight committee comprised of the County Administrative Officer and two Board members. 20 29 Reporting Structure of the Internal Audit Department Board of Supervisors Audit Committee County Management Internal Audit Resources A fully staffed, professional internal audit department provides value-added services to the County. Each year Internal Audit analyzes and adapts its resources to meet upcoming County auditing and consulting needs. To provide flexibility, the audit staff has education and experience in various audit areas: finance, performance, information systems, and management services. Each audit is performed by a team that collectively possesses the necessary knowledge and skills to fit the assignment. Government operations are inherently complex; certain functions cannot be properly reviewed without specialized expertise. Hiring a wide variety of staff specialists, however, would not be cost-beneficial. While we have invested in qualified internal staff, we have also reserved resources for specialized contractors; $318,787 was budgeted for this purpose in FY 2004-2005. This partnership (called “co-sourcing”) provides the County with the collective expertise required by Government Auditing Standards at an affordable price. FY 2005 Internal Audit Department Organizational Chart Audit Committee Board of Supervisors Ross Tate County Auditor Joan Simpson Office Manager Eve Murillo Joe Seratte Susan Adams Audit Manager Audit Manager Senior IT Auditor Tom Fraser IT Auditor Richard Chard Patra Carroll Senior Auditor Senior Auditor Cat Galassi Lisa Cave Senior Auditor Associate Auditor John Schulz Louise Wild Senior Auditor Associate Auditor Kimmie Wong Laurie Aquino Associate Auditor Staff Auditor Christina Black Trisa Cole Associate Auditor Staff Auditor 30 The County’s Health System is large (approximately 1/3 of the County’s budget), very complex, and affects many people’s lives. This high level of risk to the County makes the Health System’s activities worthy of increased scrutiny. We began performing health care audits in FY 1997-1998. In FY 19992000, we began outsourcing some of the health system audits due to the highly specialized expertise required. Risk Assessment Effective internal auditing is based on systematically reviewing an organization’s operations at intervals commensurate with associated risks. The annual risk-review process produces an audit plan that maximizes audit coverage and minimizes risk. Auditing every County activity on a regular basis would not be cost efficient; professional judgment ensures resources are focused on high-risk areas. Professional Internal Audit Staff Our auditors have extensive knowledge of auditing methods and techniques plus specialized training in computers and accounting. (See Appendix A for individual biographies.) Each auditor is responsible for maintaining Government Auditing Standards requirements of 80 continuing education hours every two years; 24 of those hours are directly related to government operations. In order to meet this education requirement and share knowledge, Internal Audit staff members conducted four in-house training classes in FY 2005 at a cost savings ranging from $735 to $1,470 (assuming $10 to $20 per credit hour, respectively). Who Audits the Auditors? (Peer Review) An independent audit firm conducts a peer review of Internal Audit every 3 years, as required by national Government Auditing standards. The Maricopa County Citizens’ Audit Advisory Committee oversees these reviews. The FY 2000 and FY 2003 review by a local firm showed no findings. We are scheduled to have our next review in FY 2006. 31 Appendix F: Citizen’s Audit Advisory Committee Charter The committee’s primary function is to assist the board of supervisors in fulfilling its oversight responsibilities. The committee accomplishes this function by reviewing the county’s financial information, the established systems of internal controls, and the audit process. In meeting its responsibilities, the committee shall perform the duties outlined below. 1. Provide an open avenue of communication between the county auditor, the auditor general, and the board of supervisors. 2. Review the committee's charter annually and seek board approval on any recommended changes. 3. Inquire of management, the county auditor, and the auditor general about significant risks or exposures and assess the steps management has taken to minimize such risks to the county. 4. Consider and review the audit scope and plan of the county auditor, and receive regular updates on the auditor general’s county audit activities. 5. Review with the county auditor and the auditor general the coordination of audit efforts to assure completeness of coverage, reduction of redundant efforts, and the effective use of all audit resources including external auditors and consulting activities. 6. Consider and review with the county auditor and the auditor general: 7. 8. a. The adequacy of the county's internal controls including computerized information system controls and security. b. Any related significant findings and recommendations of the auditor general and the county auditor together with management's responses thereto. At the completion of the auditor general’s annual examination, the committee shall review the following: a. The county's annual financial statements and related footnotes. b. The auditor general's audit of the financial statements and report thereon. c. Any serious difficulties or other matters related to the conduct of the audit that need to be communicated to the committee. Consider and review with management and the county auditor: a. Significant audit findings during the year and management's responses thereto. 19 20 32 b. Any difficulties encountered during their audits, including any restrictions on the scope of their work or access to required information. c. Any changes required in the planned scope of their audit plan. d. The internal audit department's budget and staffing. e. The internal audit department's charter. f. The internal audit department's overall performance and its compliance with accepted standards for the professional practice of internal auditing. 9. Report committee actions to the board of supervisors with such recommendations as the committee may deem appropriate. 10. Prepare a letter for inclusion in the annual report that describes the committee's composition and responsibilities, and how they were discharged. 11. The committee shall meet at least four times per year or more frequently as circumstances require. The committee may ask members of management or others to attend the meetings and provide pertinent information as necessary. Committee meetings are subject to the Open Meeting Law (A.R.S. § 38-431). 12. The committee shall perform such other functions as assigned by the board of supervisors. Committee Composition and Terms The membership of the committee shall consist of five voting members and three non-voting members. The voting members shall be board of supervisor appointees from the public and shall serve two-year terms. The non-voting members shall be the county’s chief financial officer, the county attorney, the auditor general, or their designees. The chairman of the board of supervisors shall appoint a committee chairman from the voting members. The committee chairman shall serve a one-year term. Member Qualifications Committee members must have an understanding of financial reporting, accounting, or auditing. This understanding can be demonstrated through educational degrees (BS, MBA, PhD) and professional certifications (CPA, CMA, CIA), or through experience in managing an organization of more than 25 employees or $20M in revenues. Committee members should be familiar with local government operations and should have sufficient time to effectively perform the duties listed herein. Adopted by the Board of Supervisors — 3/26/97 Last Amended — 6/26/02 33 Appendix G: Internal Audit Department Charter Purpose The Maricopa County Board of Supervisors (Board) hereby establishes the Maricopa County Internal Audit Department. The mission of the Internal Audit Department is to provide objective, accurate, and meaningful information about County operations so the Board and management can make informed decisions to better serve County citizens. Responsibility County management has primary responsibility for establishing and maintaining an effective system of internal controls. Internal Audit evaluates the adequacy of the internal control environment, the operating environment, related accounting, financial, and operational policies, and reports the results accordingly. Authority and Access Internal Audit is established by the powers granted to the Board in A.R.S. § 11-251. The Board is authorized to supervise the official conduct of all County officers, to see that such officers faithfully perform their duties, and present their books and accounts for inspection (A.R.S. § 11-251.1). The Board is also authorized to perform all other acts and things necessary to fully discharge its duties (A.R.S. § 11-251.30). Internal Audit will report directly to the Board, with an advisory reporting relationship to the Board-Appointed Citizen’s Audit Advisory Committee. In addition, the County Auditor will meet, as needed, with an oversight committee comprised of the County Administrative Officer and two Board members appointed by the Board Chairman. While conducting approved audit work, Internal Audit will have complete access (except where restricted by legal privilege) to all County property, records, information, and personnel. Premise and Objectives Internal Audit’s basic premise is that County resources are to be applied efficiently, economically, and effectively to achieve the purposes for which the resources were furnished. This premise is incorporated in the following four objectives: A. Compliance with Laws and Regulations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure identification of and compliance with applicable laws and regulations. B. Effective Program Operations Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that programs meet their goals and objectives. 34 C. Validity and Reliability of Data Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that valid and reliable data are obtained, maintained, and fairly disclosed. D. Safeguarding of Resources Those entrusted with County resources are responsible for establishing and maintaining effective controls to ensure that resources are safeguarded against waste, loss, and misuse. Independence The Internal Audit Department will remain outside the control of management. Internal Audit employees will have no direct responsibility for, or authority over, any of the activities, functions, or tasks reviewed by the department. Accordingly, Internal Audit staff should not develop or write policies and procedures that they may later be called upon to evaluate. They may review draft materials developed by management for propriety and completeness. However, ownership of and responsibility for these materials will remain with management. Audit Standards and Ethics Internal Audit will adhere to applicable industry standards and codes of ethics issued by authoritative sources (such as those issued by the Institute of Internal Auditors and the U.S. General Accounting Office). Each member of the department is expected to consistently demonstrate high standards of conduct and ethics as well as appropriate judgment and discretion. Audit Planning The County Auditor will prepare an annual audit plan that will be reviewed by the Citizen’s Audit Advisory Committee and approved by the Board. Additions, deletions, or deferrals to the annual audit plan will also be approved by the Board. Follow-Up Internal Audit will follow up on the status of its report recommendations on a regular basis. Adopted by the Board of Supervisors — 6/11/97 Last Amended — 12/18/02 35 Maricopa County Internal Audit 301 W. Jefferson, Suite 1090 Phoenix, AZ 85003 ~ 2148 Telephone: Facsimile: E-mail: 602 ~ 506 ~ 1585 602 ~ 506 ~ 8957 jsimpson@maricopa.gov Visit our website @ www.maricopa.gov/internal_audit Annual Report Project Members Eve Murillo, Audit Manager Kimmie Wong, Associate Auditor Cover Photo Courtesy of Barbra Hart 36