Loading...
HomeMy WebLinkAboutMinutes - Minutes - Audit Committee - Meeting Date: 7/16/2019,�;� Glendale A R I Z O N A MINUTES AUDIT COMMITTEE CITY HALL, CONFERENCE ROOM A 5850 W. GLENDALE AVE. GLENDALE, ARIZONA 85301 JULY 16, 2019 9:30 A.M. 1. CALL TO ORDER Absent a sitting Chair, Mr. Bailey called the meeting to order at 9:38 a.m. 2. ROLL CALL Present: Raymond Malnar, Councilmember Ian Hugh, Councilmember Lauren Tolmachoff, Councilmember Kevin Phelps, City Manager Lisette Camacho, Interim Budget and Finance Manager Also Present: Rob Sweeney, Interim Assistant City Manager Jean Moreno, Organizational Performance Director Michael Bailey, City Attorney Jim Gruber, Chief Deputy City Attorney 3. ELECT CHAIRPERSON Councilmember Tolmachoff nominated Councilmember Hugh as Chairperson. Councilmember Malnar made the second. General consensus was reached for Councilmember Hugh to be the Chairperson with no opposition. 4. CITIZEN COMMENTS No comments from the public. 5. RULES OF THE AUDIT COMMITTEE Mr. Sweeney provided an overview of the Audit Committee's roles, responsibilities, powers, and duties as approved by City Ordinance. The Committee was provided with an information packet and the Yellow Book. Mr. Sweeney highlighted the following items from a handout, which summarized the Audit Committee rules as established by Glendale City Codes §2-57(a) through (e) and 2-58(a) through (e): • The Audit Committee can establish its procedural rules and bylaws. • The Audit Committee meetings shall at least be on a quarterly basis should there be business to conduct. The meetings could be held monthly, if necessary, but will be scheduled quarterly initially. • The Audit Committee will complete a periodic risk assessment. This will be discussed during agenda item 9. • The Audit Committee needs to forward an approved Audit Plan to City Council for Council's adoption by June 1 st of every year. • The Audit Committee has a duty to distribute draft Audit Reports to the City Manager and final Audit Reports to the City Council. 6. PUBLIC MEMBERS ON THE AUDIT COMMITTEE Mr. Sweeney announced that Glendale City Code §2-56 (A)(2) defines the prerequisites necessary that members of the public must possess to be qualified to serve on the Audit Committee: • Must have some sense of financial reporting, accounting, auditing, or relevant experience in this regard; and • Must demonstrate independence by not having any current business relations with the City of Glendale. Mr. Sweeney shared the following information: • There has been tremendous interest, in great part due to outreach by the Committee Members and their colleagues. • As of last Friday, the City Clerk has confirmed that there have been ten individuals who have expressed interest in serving on the Committee. • Per the City Clerk, the Government Services Committee (GSC) will evaluate the applications at its August 6th meeting. • The Vice Mayor and Chair of the GSC has indicated that interviews would occur the following week. • Given that timeline, the earliest that public members could be sworn in by Council would be at the August 27th voting meeting. Mr. Sweeney added that, while the Code does define the minimum requirements for members of the Audit Committee, the Audit Committee can establish additional qualifications for the GSC to consider as they evaluate the applications. Councilmember Malnar commented that he has been a proponent in that public members should have a financial background, but also in having a layperson, who has a voice of the community, and not someone who is only highly technical is important. Councilmember Malnar has a person in his district that is not a CPA, but has a financial background. Councilmember Malnar stressed common sense and a sense of community. Mr. Phelps explained that there is an appropriate part for citizen oversight, but for best practices, qualified individuals with relevant experience in the specific world of auditing is needed for this type of committee. Councilmember Tolmachoff relayed that the meetings will be open to the public so any citizen who wants to speak to the Audit Committee will have an opportunity. Mr. Sweeney will forward to the GSC Councilmember Malnars's position regarding a layperson's consideration. 7. AUDIT OVERVIEW Mr. Sweeney announced that staff thought it would be appropriate to provide the Committee with introductory orientation regarding some generally acceptable auditing standards, practices, and terminology on audit practices. Mr. Sweeney explained that the Yellow Book was put together by the federal government's General Accountability Office and it speaks to how to perform an audit, defining the elements of an audit, what is and what is not an audit, and defining work papers. Mr. Sweeney provided general information on the following: • The importance of independence in the audit process. • External versus internal audits and the focus of each. • Qualitative versus compliance elements. • Audits and non -audit engagements and examples of the work that could be involved. Councilmember Tolmachoff wondered if a report of a fraud allegation from the Ethics Hotline would go to the Audit Committee or would only go to the Audit Committee if something was found. Mr. Sweeney replied that a report, and especially findings, would be brought back to the Audit Committee, because the findings would be part of the Risk Assessment and Audit Plan that the Audit Committee is responsible to perform. Councilmember Tolmachoff asked if the Audit Committee would get a quarterly report of all that came in on the Ethics Hotline. Mr. Bailey commented that there is a bi-furcated element, Council and the Audit Committee, and depending on the call, such as if it was an actual allegation of fraud and an initial investigation confirms the fraud, Council will be notified in separate due course even outside of the audit element. Mr. Phelps stated that the Audit Committee could determine how the Ethics Hotline reporting would work and stressed that whoever handles the Ethics Hotline is to provide a confidential vehicle for reporting. Mr. Phelps noted that prior practice had the person manning the Ethics Hotline with the feeling that they had the responsibility to do the investigation. Mr. Phelps explained that now, an allegation of fraudulent or criminal behavior will go directly to the City Attorney's Office who maydirectly engage the Police Department, an outside agency, or the Maricopa County Prosecutor's Office. Mr. Phelps commented that it all depends on the type of allegation. Mr. Phelps stated that over the last couple of years, there have been a handful of calls each year. Mr. Phelps relayed that the role of the firm that will be hired is to conduct intake, to make sure the report is assigned appropriately, and to make the Audit Committee aware that there was an allegation that something took place. Mr. Sweeney continued with his orientation on the following topics: • Types of audits: • Compliance (contracts, policies, regulations) • Performance audits (qualitative, efficiency, effectiveness) • Examples of audit questions and areas of review were shared. Mr. Phelps stressed the role of accountability and compliance and noted that for a mature organization, performance audits provide a great benefit at an elevated level. Mr. Sweeney continued with the following: • Audit Plan and elements included in the plan. Councilmember Tolmachoff asked if cybersecurity was included in the annual audit. Mr. Sweeney indicated that cybersecurity would be included in the external audits on an annual basis in relation to the City's ability to take credit card payments. Ms. Camacho noted that the IT department does have external vendors, who periodically, some quarterly and some annually, try to replicate a breach to see if the City can be breached. Councilmember Tolmachoff commented that there have been some cities over the last few years who have been compromised. Mr. Bailey commented that this would be operational security compliance, not an audit function. Mr. Phelps noted this was an example of audit and non -audit work and provided examples of the difference in regards to the IT department. Ms. Camacho added that as part of the comprehensive annual financial report external audit, Clifton, Larson, and Allen does perform an IT audit as part of the package. Mr. Sweeney continued with the orientation on the following topics: • The Audit Plan — including audit follow-up • Non -audit work: independent consulting and advisory services • Quality Control Review: Who audits the Auditors? • Periodic Peer Review • Mr. Phelps noted that this was the area that the City was most efficient in, however, the Risk Assessment and the Quality Control were the parts whereby standards were not followed, which did not mean the work was incorrect, it was just that standards were not followed. Mr. Phelps assured going forward, staff will ensure that the work going forward is meeting all of the standards and is correct. Mr. Sweeney concluded the orientation. 8. ETHICS HOTLINE Mr. Sweeney announced that during the Budget Workshop, staff had recommended a change to the Ethics Hotline process which was to hire an external firm to handle the direct phone intake and provide a multi -modal aspect for staff members to submit complaints of ethics violations or concerns in an anonymous fashion. Mr. Sweeney reported that staff is currently working with the Procurement Office in regards to obtaining quotes to make this selection and results will be brought back to the Audit Committee for consideration. Mr. Sweeney stated that the Hotline phone number will remain the same, there will be ethics review/training for all employees, and a roll-out of the program. Councilmember Tolmachoff stated that on the previous Hotline, there was no way for the Hotline staff to engage or follow up with the callers for more details. Mr. Sweeney replied that all of the firms offer these services, however, employees must be assured of anonymity if they so choose. Mr. Sweeney noted that the firms do avail themselves to be an intermediary and can make point of contact should the employee provide their information. Mr. Sweeney explained that information is logged in a portal and there is a way in which to obtain more information, even if it is anonymously called in. 9. RISK ASSESSMENT Mr. Sweeney stated that staff would like to start to engage in conversations with department heads regarding risk factors that may be presenting. Mr. Sweeney provided a briefing on the following elements: risk management and how it relates to local government and risk operations, regulatory and legal risks, complexity of operations, reputation risk, the need for proper controls, and the degree of change. Mr. Sweeney shared an example of how to look at risk, including considering levels of inherent risk, residual risk, impact, and control effectiveness. Mr. Sweeney commented that the focus of the risk assessment resources needs to be placed on areas where there is great opportunity to improve or there is great opportunity from a risk perspective. 10. INTERNAL AUDITS PENDING Mr. Sweeney stated that staff proposes to bring the current outstanding draft audit work to the Committee and have further conversation in detail. Some of the audits currently outstanding include physical security, HIPAA compliance, Fire Marshall operations, and a governance audit regarding the employee survey. Mr. Sweeney relayed that staff recommends a future agenda item regarding current status of outstanding audits, and when in draft form and ready to be distributed to City management, that these would be discussed in a confidential manner relative to state law in an executive meeting. Councilmember Tolmachoff asked if there were any audits in progress at the time. Mr. Sweeney stated that there were others: one regarding right-of-way maintenance and one regarding recruitment processes in human resources. Mr. Phelps stated that the human resources audit was the result of a call to the Ethics Hotline. Mr. Phelps asked which audits were internal. Mr. Sweeney replied that the Fire Marshalls audit and right-of-way landscaping were internal audits. Councilmember Tolmachoff asked if there as a pavement management audit. Mr. Sweeney was not familiar with the audit but will follow up. Mr. Bailey thought this was contemplated but might not have been done. Councilmember Malnar asked if staff was going to bring recommendations to the Committee for focus areas for the 2020 audit. Mr. Sweeney explained that staff will bring back to the Committee the risk assessment process that staff is performing this summer and there may be other audit subjects to be discussed that could be included in the Audit Plan. Councilmember Malnar requested an overview of potential audits, such as a matrix for different departments and the types of audits that could be done. Mr. Phelps stated that audit suggestions would still need to be run through the inherent risk and residual risk model, so not to expend resources in an area with a low likelihood of changing the practice or making an improvement. Mr. Phelps felt that there was great opportunity in performance audits. Mr. Phelps suggested possibly a performance audit on right-of-way maintenance. Mr. Sweeney commented that staff will bring back audits that must be complete, such as for state compliance. Mr. Sweeney stated that the Audit Plan would include those that must be done, and also compliance audits and performance audits. Mr. Phelps explained the differences between economy, efficiency, effectiveness, and equity in regards to performance audits, and provided specific examples. Councilmember Malnar asked if there could be crossover of economy, efficiency, effectiveness, and equity. Mr. Phelps replied in the positive and added that at times, one type could lead to another. 11. COMMITTEE COMMENTS AND SUGGESTIONS None. 12. NEXT MEETING Councilmember Hugh requested staff's recommendation on a date for the next Audit Committee meeting. Mr. Sweeney stated that the next meeting could be held after the public members are appointed on August 27th at the Council meeting, such as perhaps in early September. Councilmember Malnar recommended waiting until after the public member appointments to set a date. Councilmember Tolmachoff and Councilmember Hugh agreed. 13. ADJOURNMENT Councilmember Hugh confirmed there were no further comments and adjourned the meeting at 10:39 a.m. The Audit Committee meeting minutes of July 16, 2019 were submitted and approved this 3rd day of October, 2019. Je Moreno Executive Officer J