title
ADOPT THE 2016-17 INTERNAL AUDIT PROGRAM
recommended action
RECOMMENDATION
The Council Audit Committee recommends that by motion action the City Council adopt the Fiscal Year 2016-17 Internal Audit Program. It is also recommended that the Council authorize by motion action the City Manager to execute a one-year extension to the contract with Moss Adams, LLC to provide Internal Audit Services.
body
Summary
In early 2013, the City of Stockton contracted with Moss Adams, LLC to complete a risk assessment and internal control review. The recommendations resulting from this work was compiled in fall 2013 into a two-year Internal Audit Plan designed to strengthen internal controls and processes for the City as well as make improvements to priority programs and initiatives of the City Council. Given the workload of staff during the bankruptcy process, the two-year Internal Audit Plan was extended through the end of the 2015-16 fiscal year.
The initial Internal Audit Plan is essentially complete. While a small number of projects will continue to be wrapped up in Fiscal Year 2016-17, a new audit program has been recommended for the coming year. This audit program was presented to the Council Audit Committee, reviewed with City Management, and is recommended for Council adoption. This one-year plan maintains focus on improvement of citywide policies, processes and controls, while implementing performance management, supporting the enterprise resource planning software project and conducting a performance audit. The proposed plan also provides for continued general internal audit services, controls testing and audit findings validation.
DISCUSSION
Background
Stemming from the City Council Strategic Initiatives adopted in 2011 designed to attain fiscal sustainability and address a multitude of audit findings, the City Council made a determination in 2012 to solicit Internal Audit Services by contract. The successful firm, Moss Adams, LLC, was selected to provide audit services as a pilot project while also conducting a risk assessment and internal control review. This comprehensive assessment was a core task in the restructuring effort of the City’s finances. In summary, the risk assessment gauged the City’s overall risk as being “high.” The risk assessment also identified mitigating actions to provide the City with a path to strengthen performance delivery and reduce risk. The internal control review also found that the condition of internal controls within the City’s accounting and reporting functions had significant opportunities for improvement. The internal control review outlined the work that would be required to strengthen its control processes and procedures. The recommendations included in the internal control review provided a road map for carrying out this work.
In September 2013, the City Council approved a contract with Moss Adams to complete an Internal Audit Plan that would begin implementation of the most critical improvements recommended by the assessment. The City Manager and Moss Adams as the City Auditor brought forward the Internal Audit Plan, which outlined a number of projects to be completed over the course of 24 months. The Internal Audit Plan included two primary types of activities: 1) internal controls improvement and 2) performance improvement. The Plan organized the work based on priority, timing and workload capacity. The work was organized into quarterly segments to address each of the areas of focus identified in the internal control review. The Internal Audit Plan invested $1,215,000 over three fiscal years. The funding for this plan was allocated from the $421,000 annual budget for Internal Audit Services with an approximately $100,000 additional allocation in Fiscal Year 2014-15 to accelerate the improvements of key internal controls.
The Internal Audit Plan was designed to address the issues that staff identified related to fiscal and operational challenges of the City as well as numerous audit findings and recommendations from outside parties assessing City operations. More importantly, the plan represented a comprehensive work plan and detailed road map to eliminate weaknesses in the organization and mitigate areas of risk. Carrying out this plan was a key component of the reform efforts of the City.
Over the past two and a half years, regular progress updates have been provided at monthly Council Audit Committee meetings. Project reports and recommendations from Moss Adams have also been provided to the City Council as informational items in regular City Council agenda packets. It is important to note that at the August 11, 2014 meeting of the Council Audit Committee, Moss Adams provided an overall update on the Internal Audit Plan and recommended a revised schedule for completing the work of the Internal Audit Plan. In consideration of the significant work load that was taking place during bankruptcy proceedings, it was recognized by City staff and Moss Adams that the Internal Audit Plan schedule was aggressive based on the capacity of City staff. Because the 24-month Internal Audit Plan already spanned into the 2015-16 fiscal year, it was recommended that the same projects of the initial plan be spread out over an additional six months with completion of projects by the end of the 2015-16 fiscal year. The Audit Committee supported this adjustment to the Internal Audit Plan schedule. The most recent update on the Internal Audit Plan was presented to the full City Council at your December 8, 2015 meeting.
Present Situation
As of the close of Fiscal Year 2015-16, the initial Internal Audit Plan is essentially complete. There are a small number of projects that are in the final stages of completion, with final reports pending to the Council Audit Committee. The results from the Internal Audit Plan represent high-quality work that is the type of effort that the City has been lacking in the Internal Audit function. These efforts have addressed a majority of the findings and issues identified in recent external financial audits and assessments from outside entities. Without the recommendations and resources of Moss Adams, it would have taken City staff several valuable years to mitigate the high priority risks that have been addressed.
In summary, 9 of 10 internal control audits scheduled have been completed. One internal control audit, Project Management/Capital Project Closeout, recently completed field work, and the final report and recommendations are pending. The tenth audit originally scheduled but not completed was related to third party service providers and was addressed through a distinct initiative in the City and therefore was no longer a priority for auditing. Reports and recommendations related to the other 8 audits were presented to the Council Audit Committee, with management responses for addressing the recommendations. Testing and validation as follow-up to each of the internal control audits took place throughout 2016, with results and recommendations also pending.
In addition to the internal control audit projects, the initial phases of performance related projects scheduled in the initial plan have also been completed. The initial plan included a focus on policy and process development through the Policy Project, consisting of a substantial update of citywide policies. In addition, an initial performance management project is nearing completion and Moss Adams conducted a follow-up risk assessment with the final report pending. Other performance projects included Internal Control Training for the City Council and City executives and Audit Findings Tracking and validation. Moss Adams has also completed work in support of the IT Strategic Planning and governance efforts. Since 2010, the City of Stockton has conducted numerous self-assessment and audits from outside agencies have also taken place. As a result, a significant number of findings were produced. Of the 336 audit findings since 2010, 188 have been completed and 76 have been validated, with on-going completion and validation taking place and being reported to the Council Audit Committee. It is also worth noting that the projects within the Internal Audit Plan have been completed with a savings of more than $100,000 that were returned to General Fund balance.
The work of the Internal Audit Plan represents a tremendous effort in addressing risks in the City of Stockton; it is remarkable what has been accomplished over the past two years. Critical updates to policies and procedures have been made. A streamlined, efficient policy framework is in place. A performance management framework with baseline progress measures has been developed. The work has led to improved operations and organizational capacity. This work has established core fundamentals related to internal controls. The City has in place a strengthened internal audit function from which it can move forward with future audit projects.
To that end, Moss Adams prepared a proposed internal audit program for this fiscal year (Attachment A). The intent was to complete the initial Internal Audit Plan and then begin a cycle of annual audit programs based on Council priorities and continued risk assessment. The proposed audit program was in fact informed by an updated risk assessment conducted by Moss Adams, for which a full report will be presented to the Council Audit Committee this fall. The proposed program was presented to the Council Audit Committee on June 20 and July 11, reviewed with City Management, and is recommended for Council adoption. This one-year plan maintains focus on improvement of citywide policies, processes and controls, while also implementing performance management, supporting the enterprise resource planning software project and conducting a performance audit. The proposed plan also provides for continued general internal audit services, internal controls testing and audit findings validation. At their July 11 meeting, the Audit Committee adopted a motion to approve the Fiscal Year 2016-17 Internal Audit Program, with the opportunity to revisit the performance audit that is conducted pending the results of the Measure A audit.
In addition to the Audit Committee recommendation to approve the Fiscal Year 2016-17 Internal Audit Program, staff recommends that Council authorize the City Manager to execute a one-year extension to the current contract with Moss Adams. The current contract approved by Council has an initial term of three years with two potential one-year extensions. The intent of the contract was to complete the initial Internal Audit Plan and then begin a cycle of annual audit programs based on Council priorities and continued risk assessment. Because the initial plan was extended beyond the initial 24-month period, the initial three-year term for the contract expires in the middle of the proposed Fiscal Year 2016-17 Internal Audit Program. In order to complete the audit program for this fiscal year, staff recommends that the first one-year extension to the Moss Adams contract be executed. As noted above, the work of Moss Adams has been outstanding. Given their expertise, performance and knowledge of the City, it is in the interest of the City to extend the Moss Adams contract to complete the audit program for this fiscal year.
FINANCIAL SUMMARY
The proposed budget of $417,000 for Moss Adams to carry out the Fiscal Year 2016-17 Internal Audit Program is consistent with the 2016-17 $421,000 budget allocation for Internal Audit Services. There are sufficient funds in the 010-1901-510 account for these purposes. The intent is for the annual Internal Audit Program to be the funding plan each year for these budgeted dollars.
Attachment A - Fiscal Year 2016-17 Internal Audit Program