The County fails to meet several critical aspects of a robust internal audit function, namely:

• The internal auditor is not independent
• Audits, other than mandated audits, are conducted only at the request of County departments
• Some tax revenues are not currently audited
• None of the County's outside contracts are currently audited
• The audit process often takes too long and the follow-up on recommendations is not done in a timely manner
  

The integrity and strength of systems that prevent fraud, identify cost reduction opportunities, and monitor income under the $1.1 billion San Mateo County budget are dependent on a robust internal audit function. The Grand Jury's recommendations, when implemented, will allow the Board of Supervisors to be confident of the County's fiscal controls.

Issue: Does San Mateo County's internal audit process effectively provide timely information to independently assure that revenues are maximized and expenses controlled consistent with the public trust?

Recent economic conditions demand that governmental bodies reevaluate their revenue and expense controls, and operations efficiency. The audit function should play a major role in meeting this demand.

Audit Function
The audit function provides independent evaluation of the controls that: safeguard assets, assure the County meets mandatory reporting and auditing requirements, and assist management to improve efficiency and effectiveness.

• Using audit findings, County leadership should be able to:
• Maximize County revenues
• Improve utilization of public funds, personnel, property and equipment
• Identify causes of inefficiencies or uneconomical practices
• Detect unauthorized transactions or use of County assets
• Ensure compliance with laws, regulations, policies, and documented procedures
• Verify compliance with organization objectives

Audit Independence
Public focus on auditor credibility has a great deal to do with auditor independence. The test of independence is the clear separation of the relationship between the organization audited and the auditor.

Recommendations of the American Institute of Certified Public Accountants (AICPA), The Institute of Internal Auditors (IIA), National Association of Local Government Auditors (NALGA), and the Government Finance Officers Association (GFOA) encourage auditor independence.

Many governmental bodies have separated the internal audit function from operating management. In these instances, the internal audit function is accountable directly to the governing board. These bodies are closely involved with design of the audit plans and follow up of recommendations resulting from the audits.

San Mateo County Auditing
The County charter specifically assigns the internal audit responsibility to the Controller, who meets this responsibility through the Internal Audit Division (IAD). The Controller is an elected official who has overall responsibility for financial reporting. The IAD's focus is on specific departments or divisions of the County.

The external auditors who perform the annual audit of the County financial statements are Certified Public Accountants (CPA) selected by the County Manager, subject to approval by the Board of Supervisors and the Grand Jury. The external CPA's focus is on the overall fair presentation of the County's financial position.

Agencies that fund or contract services with the County may mandate audit requirements as part of their agreement. These agencies may report their findings to meet related agency requirements, as well as the department or division audited.

For special projects, external audits may be performed under contract for the Grand Jury or for County departments. A recent example of such a special project audit is one conducted under the direction of the Sheriff's Department to verify telephone commission payments received from pay telephone vendors at the County Jail Facility.

Grand Jury's Review
The Grand Jury interviewed the San Mateo County Controller and several staff members, including those responsible for supervising internal County audits. The partner in charge and members of the staff of the external auditors, Macias, Gini & Company, were also interviewed.

The Grand Jury reviewed copies of audit reports and related recommendations provided by the external auditors and the IAD.

The Grand Jury reviewed published Grand Jury reports from San Mateo, Santa Clara, Los Angeles, and Placer Counties related to internal auditing.

The Grand Jury compared internal auditing organization and responsibility in other governmental organizations. The Grand Jury interviewed the San Jose City Auditor and collected pertinent information from its website (www.ci.san-jose.ca.us). Research was conducted through the publications and websites of professional organizations: American Institute of Certified Public Accountants (AICPA), the Institute of Internal Auditors (IIA), the National Association of Local Government Auditors (NALGA) and the Government Finance Officers Association (GFOA).

There were no audits of vendor, partner, or tax collection matters in recent years, except for one transient occupancy tax matter in which no tax return was filed.

Internal Audit Division Responsibilities
To meet the Charter obligations assigned to the Controller, the IAD has audit responsibility for the following:

• 126 County budget units totaling $1.1 billion
• Numerous partner agencies (e.g. Peninsula Humane Society, ART Share) for which the County may have oversight responsibility
• 20 special districts, upon their request or if an external audit is not performed
• 24 school districts, upon their request or if an external audit is not performed
• Collection of taxes and other revenues
• Receipts and payments for vendors in accordance with contracts with the County

To perform its responsibilities, IAD staff performs audits and special projects, follows up on prior audit and project recommendations, and carries out some regular reporting functions. Special auditing projects are studies that cover a specified scope other than the full operations of a department or agency.

The 2002-2003 fiscal year IAD stated target is to review internal controls representing 10% of the $1.1 billion County budget. At the rate of 10% per year, it would take 10 years to cover the review of controls of the full County budget. The majority of audits are mandatory, so only a small number of discretionary audits or special project reviews are performed in any given year. As a result, any given agency not subject to a mandatory audit may not be audited for decades under the current selection procedures.

IAD does not set audit goals related to special district audits or County revenues. A special district is audited only if it fails to conduct an independent external audit of its financial records. IAD only performs revenue audits if invited by the County department responsible for the revenue collection.
For more than 20 years, the San Mateo County Grand Jury has suggested greater participation by the Board of Supervisors in the internal audit function.

Internal Audit Division Performance
During the investigation, the Grand Jury reviewed reports and recommendations recently produced by the Controller's Internal Audit Division. Findings regarding the reports and recommendations are that:

• Some reports took excessive time to prepare and release. In one instance, the audit was not completed until almost 11 months after the audit period, and was not released until 3½ months later.
• Recommendations are not followed up until 12-18 months after audit report release
• The audit scope was not expanded when significant deficiencies were disclosed during an audit
• Responses to recommendations made by the Internal Audit Division did not include a specific action, a timeline for correction, or responsibility for taking the corrective action outlined in the Internal Audit Division report.
  
• There is no established procedure to follow up on inadequate responses to audit reports.

The IAD plans to conduct 29 audits and special projects during the fiscal year 2002-2003. The Division is authorized 8.8 full time equivalent employees and was operating one person short of the authorized level at the time of the interview with IAD management.

Mandated audits are not selected on any criteria provided by the Controller. Of the 29 audits and special studies planned, 19 (73%) of the audits are mandated by law or a funding source. These same audits are generally performed annually.

Special projects are performed in response to department requests. In general, these special projects are operational audits. Such audits are considered by the Controller to add value. The Controller states that the willing objects of such audits and projects are most likely to cooperate in the process, in implementing the recommendations, and to benefit from the results of such audits. These audits are not selected based on a risk assessment by the Controller. Seven special projects are scheduled for the current fiscal year.

The remaining audits (3 for the current year) are discretionary and are chosen by the Controller primarily based on an evaluation of the risk, size, and time since the last audit.

Benchmarking
The city of San Jose has a budget and functions approximating that of San Mateo County. The City Auditor is fully independent of the operating departments, reporting directly to the City Council. Numerous other cities and counties have structures incorporating auditors reporting to their respective legislative body.
The San Jose City Auditor regularly updates the Council on the status of the annual work plan; activities and findings; recommendations; status of responses; and implementation of prior recommendations.

A principal objective of the San Jose City Auditor is "to identify $4 in increased revenues and savings for every $1 of audit cost". The City Auditor's website reports a payback ratio from May 1985 through June 2001 of $7 for every $1 of audit cost, or $139M against $20.3M in audit costs. The City Auditor staff is 20 employees, over twice the size of San Mateo's IAD.

The Benchmarking and Best Practices Survey of the National Association of Local Government Auditors (NALGA) for the year 2000 determined that internal auditing activities returned savings averaging $3.36 per $1.00 spent in internal auditing efforts for government organizations of similar size to San Mateo County.

The current San Mateo County IAD budget performance measures do not include any goals for revenue increases or cost savings resulting from internal audit efforts.

Public Participation
The annual budgets and annual reports of the County are available on the its website. Only one report of the IAD is available. No other reports of the IAD or any of the other organizations that audit County activities are readily available to the public.

Many jurisdictions, including the State of California, have long provided a procedure for individuals to anonymously identify inefficiencies and waste in government operations. San Mateo County does not have such a "whistleblower" process.

• Seek a minimum percentage of new revenues or cost savings over the cost of the auditing function comparable to benchmark organizations
  
• Establish programs to determine that monies contributed to fund programs outside of direct County control (i.e., with partner agencies) are subjected to the same high level of control and scrutiny as if they were spend directly by the County
  
• Complete all IAD reports in a timely manner
  
• Create a system to more effectively follow up on IAD and other audit recommendations for timely implementation
  
• Distribute all IAD reports to the Board of Supervisors
  
• Maximize communication to the public through publication on the County's website of all audit reports and the responses to the reports' recommendations
  

• Direct that an amendment creating this position be presented to the electorate at the earliest possible regularly scheduled election
  
• Design the Independent County Auditor's organization consistent with the sample charter and ordinance published by the National Association of Local Government Auditors for a Legislative/Appointed Auditor