February 20, 2017
A: click to change text to default font size A: click to change text to medium font size A: click to change text to large font size
San Mateo County's Internal Auditing
San Mateo County's Internal Auditing
The County fails to meet several critical aspects of a robust internal audit function, namely:
The integrity and strength of systems that prevent fraud, identify cost reduction opportunities, and monitor income under the $1.1 billion San Mateo County budget are dependent on a robust internal audit function. The Grand Jury's recommendations, when implemented, will allow the Board of Supervisors to be confident of the County's fiscal controls.
Issue: Does San Mateo County's internal audit process effectively provide timely information to independently assure that revenues are maximized and expenses controlled consistent with the public trust?
Recent economic conditions demand that governmental bodies reevaluate their revenue and expense controls, and operations efficiency. The audit function should play a major role in meeting this demand.
the American Institute of Certified Public Accountants (AICPA), The Institute
of Internal Auditors (IIA), National Association of Local Government Auditors
(NALGA), and the Government Finance Officers Association (GFOA) encourage
bodies have separated the internal audit function from operating management.
In these instances, the internal audit function is accountable directly
to the governing board. These bodies are closely involved with design
of the audit plans and follow up of recommendations resulting from the
San Mateo County
The external auditors
who perform the annual audit of the County financial statements are Certified
Public Accountants (CPA) selected by the County Manager, subject to approval
by the Board of Supervisors and the Grand Jury. The external CPA's focus
is on the overall fair presentation of the County's financial position.
Agencies that fund
or contract services with the County may mandate audit requirements as
part of their agreement. These agencies may report their findings to meet
related agency requirements, as well as the department or division audited.
For special projects,
external audits may be performed under contract for the Grand Jury or
for County departments. A recent example of such a special project audit
is one conducted under the direction of the Sheriff's Department to verify
telephone commission payments received from pay telephone vendors at the
County Jail Facility.
Grand Jury's Review
The Grand Jury reviewed copies of audit reports and related recommendations provided by the external auditors and the IAD.
The Grand Jury reviewed published Grand Jury reports from San Mateo, Santa Clara, Los Angeles, and Placer Counties related to internal auditing.
The Grand Jury compared internal auditing organization and responsibility in other governmental organizations. The Grand Jury interviewed the San Jose City Auditor and collected pertinent information from its website (www.ci.san-jose.ca.us). Research was conducted through the publications and websites of professional organizations: American Institute of Certified Public Accountants (AICPA), the Institute of Internal Auditors (IIA), the National Association of Local Government Auditors (NALGA) and the Government Finance Officers Association (GFOA).
There were no audits
of vendor, partner, or tax collection matters in recent years, except
for one transient occupancy tax matter in which no tax return was filed.
Audit Division Responsibilities
To perform its responsibilities, IAD staff performs audits and special projects, follows up on prior audit and project recommendations, and carries out some regular reporting functions. Special auditing projects are studies that cover a specified scope other than the full operations of a department or agency.
The 2002-2003 fiscal year IAD stated target is to review internal controls representing 10% of the $1.1 billion County budget. At the rate of 10% per year, it would take 10 years to cover the review of controls of the full County budget. The majority of audits are mandatory, so only a small number of discretionary audits or special project reviews are performed in any given year. As a result, any given agency not subject to a mandatory audit may not be audited for decades under the current selection procedures.
IAD does not set audit
goals related to special district audits or County revenues. A special
district is audited only if it fails to conduct an independent external
audit of its financial records. IAD only performs revenue audits if invited
by the County department responsible for the revenue collection.
The IAD plans to conduct 29 audits and special projects during the fiscal year 2002-2003. The Division is authorized 8.8 full time equivalent employees and was operating one person short of the authorized level at the time of the interview with IAD management.
Mandated audits are not selected on any criteria provided by the Controller. Of the 29 audits and special studies planned, 19 (73%) of the audits are mandated by law or a funding source. These same audits are generally performed annually.
Special projects are performed in response to department requests. In general, these special projects are operational audits. Such audits are considered by the Controller to add value. The Controller states that the willing objects of such audits and projects are most likely to cooperate in the process, in implementing the recommendations, and to benefit from the results of such audits. These audits are not selected based on a risk assessment by the Controller. Seven special projects are scheduled for the current fiscal year.
The remaining audits (3 for the current year) are discretionary and are chosen by the Controller primarily based on an evaluation of the risk, size, and time since the last audit.
A principal objective of the San Jose City Auditor is "to identify $4 in increased revenues and savings for every $1 of audit cost". The City Auditor's website reports a payback ratio from May 1985 through June 2001 of $7 for every $1 of audit cost, or $139M against $20.3M in audit costs. The City Auditor staff is 20 employees, over twice the size of San Mateo's IAD.
The Benchmarking and Best Practices Survey of the National Association of Local Government Auditors (NALGA) for the year 2000 determined that internal auditing activities returned savings averaging $3.36 per $1.00 spent in internal auditing efforts for government organizations of similar size to San Mateo County.
The current San Mateo
County IAD budget performance measures do not include any goals for revenue
increases or cost savings resulting from internal audit efforts.
Many jurisdictions, including the State of California, have long provided a procedure for individuals to anonymously identify inefficiencies and waste in government operations. San Mateo County does not have such a "whistleblower" process.
of the external auditors for the last 2 years reflected a consistent
pattern of deficiencies in record keeping by certain County departments.
Such record keeping deficiencies could potentially result in loss of
funding from outside agencies if not corrected in a timely manner.
The audit performance
standards currently in effect are not adequate. The volume, scope, and
coverage of audits need to be expanded to assure that revenues are maximized
and expenses controlled consistent with the public trust.
No evaluation has
been made to determine if the IAD staff is adequate to meet the audit
responsibilities assigned to the Controller.
The Charter assigns
responsibility for recordkeeping and internal audit to the Controller,
which creates an inherent conflict of interest. While the Controller
is legally independent as an elected official, from an audit perspective,
he is not independent because of his dual responsibilities. This seriously
undermines the faith that citizens can have in the quality and validity
of audit reports, despite the good intentions of those who carry them
out or how well they may be accomplished. The internal audit function
must be severed from the controller function to meet the test of audit
practice of auditing by invitation cannot assure that all high risk
or inefficient budget units are regularly audited.
The County budget
units are not held accountable for timely corrective actions based on
external or internal report recommendations.
of IAD reports inhibits ability of the Board of Supervisors to provide
effective leadership of the County.
1. The Controller
should immediately modify the goals of the Internal Audit Division to
assure that revenues are maximized and expenses controlled consistent
with the public trust (see full report for suggested action steps).
2. The Board of
Supervisors should seek to amend the County Charter to create an Independent
County Auditor reporting directly to the Board.
3. Pending voter
approval of the Charter amendment, the Board of Supervisors should immediately
establish a liaison (independent of the Controller's Office and County
management) between it and the Internal Audit Division to monitor implementation
of Recommendation 1 above.
4. The Board of
Supervisors should commission a study to determine the optimum audit
staff level for maximum return for audit dollars spent.
5. The Board of
Supervisors should immediately establish a "whistleblower"
process. Until such time as the Independent County Auditor position
is established, all whistleblower reports and responses should be reported
monthly to the Board of Supervisors, with appropriate procedures for