Loading...
HomeMy WebLinkAboutMinutes - Minutes - Audit Committee - Meeting Date: 1/18/2023C117 Glendale A R 1 T n N A MINUTES AUDIT COMMITTEE MAIN LIBRARY - BOARDROOM 5959 W. BROWN ST. GLENDALE, ARIZONA 85302 JANUARY 18, 2023 1:30 P.M. 1. CALL TO ORDER Councilmember Malnar called the meeting to order at 1:30 p.m. 2. ROLL CALL Present: Ian Hugh, Councilmember Raymond Malnar, Councilmember (presided in Chair's absence) Irene Avalos, Member Kevin Phelps, City Manager Levi Gibson, Budget & Finance Director Absent: Jamie Aldama, Councilmember, Chairperson Rusty Simmons, Member Also Present: Mike Kingery, Independent Internal Audit Program Manager James Gruber, Chief Deputy City Attorney Vicki Rios, Assistant City Manager Jamsheed Mehta, Assistant City Manager Feroz Merchhiya, Chief Information Officer, Innovation & Technology Arlene Chemello, Deputy Chief Information Officer, Innovation & Technology Michelle Woytenko, Director, Field Operations Craig Croner, Deputy Director, Field Operations Jeff Bratcher, Program Manager, Organizational Performance Office Chelsea Ritchie, Consulting Senior Manager, Moss Adams (Guest) Paul Ashe, President, Securance Consulting (Guest) 3. CITIZEN COMMENTS No citizen comments were received/made. 4. APPROVAL OF THE MINUTES Councilmember Hugh motioned to approve the Audit Committee Minutes of the September 15, 2022, meeting as written. Member Avalos made the second. Motion carried unanimously. 5. MOTION TO CALL FOR AND ENTER INTO EXECUTIVE SESSION Councilmember Hugh motioned to call for and enter into Executive Session at 1:32 p.m. Member Avalos made the second. Motion carried unanimously. 6. EXECUTIVE SESSION Review and discuss draft audit reports pursuant to Glendale City Code §2-54b and §2-58c (A.R.S. §38-431.03 (A)(2)). Session was held. 7. MOTION TO ADJOURN EXECUTIVE SESSION AND RECONVENE IN OPEN SESSION Councilmember Hugh motioned to adjourn Executive Session at 2:11 p.m. Member Avalos made the second. Motion carried unanimously and Open Session was reconvened. 8. CONSIDERATION & POSSIBLE VOTE ON EXECUTIVE SESSION ITEMS Councilmember Malnar announced that the committee would review and consider vote to approve the following two audit reports with discussed modifications: Password Security and Fleet Management. Member Avalos motioned to approve the audit reports. Councilmember Hugh made the second. Motion carried unanimously. 9. DISCUSSION ON IIAP POLICY, PROCEDURES, AND AUDIT CHARTER Mr. Kingery explained the background of the City's audit charter. As currently written, the charter indicates that the Independent Internal Audit Program (IIAP) follows standards from two organizations. The Yellow Book includes Generally Accepted Government Auditing Standards (GAGAS) and is published by the Government Accountability Office (GAO). The Red Book is the common name of the International Professional Practices Framework, published by the Institute of Internal Auditors (IIA). By following both sets of standards, the audit charter makes the IIAP an "Orange Book" audit shop. For a one -person audit shop, adhering to two sets of standards is very difficult due to the large amount of administration required by each. Mr. Kingery explained what he learned as a member of the peer review team for the City of Toronto, which is a Yellow Book shop. When he did the peer review in October of 2022, Toronto had a staff of around 33 people, which included one person whose sole duties involved compliance with Yellow Book standards for the entire office. Mr. Kingery added that when he has discussed standards and peer reviews with other auditors, as well as with the leader of the ALGA (Association of Local Government Auditors) peer review program, those parties advised that small audit shops should choose either the Red Book or Yellow Book, but usually not both. Per his research, Mr. Kingery determined that most small audit shops follow the Red Book, but indicated he is willing to follow either one or both sets of standards. Mr. Kingery noted that our audit charter needs to be updated regardless, to reflect some changes in practice and correct some errors. He offered to present the pros and cons of Yellow vs. Red vs. Orange Book shops, along with a revised charter and a proposed Policies and Procedures manual to the June audit committee meeting for their consideration. He added that he was about to lead a peer review team of an Orange Book shop in Florida, which would also provide additional insight and experience. Member Avalos thought this was a good approach and asked if we're okay with any approach as long as we adhere to the corresponding standards. IIAP staff (Mr. Kingery) confirmed that was correct, and added that ALGA recommends at least one full year of operating under newly adopted standards before requesting a peer review. Member Avalos asked that if we changed nothing, when is IIAP due for our peer review. IIAP staff responded that currently we would request one for FY24, but that we have options on how to write the charter/policies/procedures to account for timeline changes if necessary. Mr. Kingery indicated that Yellow Book standards call for a peer review every three years, while Red Book is every five years. He added that ALGA wants the requesting audit shop to know its operations are up and running successfully prior to getting on the peer review schedule. Member Avalos noted a concern that if we repeatedly change the type of shop we are (Yellow, Red, or Orange Book), would that reset the clock of when peer reviews are due and lead to us never having one completed. She wants IIAP to ensure that the updated charter reflects that we will adhere to the peer review standard based on which type of audit shop we ultimately decide upon. Member Malnar asked for clarity as to if IIAP is recommending one type of audit shop over another. Mr. Kingery noted that ALGA generally leans towards Red book for small shops, but that he wasn't recommending one over the other. Rather, presenting the info at the June audit committee meeting to consider member feedback would help shape the revised charter, which is an internal departmental change and does not require City Council action. There was no additional discussion on this item. 10. UPDATE ON COMMITTEE GOALS Mr. Kingery reviewed the goals that were reaffirmed by the Audit Committee during the September 15, 2022 meeting. The goals are: 1) developing a work plan for implementation of an Independent Internal Audit Program (IIAP) quality assurance and improvement program in preparation for a peer review in FY24, and 2) monitoring remediation of outstanding recommendations from prior audits to ensure they are fully implemented by expected/target date. As the first goal was just thoroughly discussed in the last topic, I IAP staff addressed the second goal. Mr. Kingery noted that he did not include the spreadsheet of outstanding findings in the audit packet to give the audited departments as much time as possible to provide updates prior to this meeting. Of the findings reviewed with the committee in the September 2022 meeting, only minor updates to five of them have occurred. Two are closed, two more are essentially closed but being further evaluated by IIAP, and one was erroneously omitted by IIAP from the last meeting's spreadsheet. The latter item pertained to revision of the City Clerk's policies and procedures and was still under consideration by the City Manager's Office prior to publishing an official revised version. Mr. Kingery said he would email the spreadsheet of outstanding findings to the committee and offered to include it with the pre -meeting materials moving forward. Member Avalos agreed with that approach and asked for confirmation of when IIAP considers a finding to be closed. Mr. Kingery stated that it depends on the nature of the finding and items could be considered closed for different reasons, but that ultimately items are closed when the audited department has adequately addressed the recommendations as confirmed by IIAP. There was no further discussion. 11. UPDATE ON FY23 AUDIT PLAN For the FY23 audit plan, Mr. Kingery noted there were four assigned to staff (Property Evidence for the Police Department, the Triennial Agreed Upon Procedures for City Courts, an Airport Compliance audit, and another Purchase Card audit). He noted that following consultation with Police leadership and the City Manager's Office, and per IIAP recommendation, the Property Evidence engagement would be a limited scope audit for a number of reasons. These reasons include internal controls already in place as part of annual Police accreditation standards and thorough analysis of requirements for the proposed new Property Evidence facility during its initial design stages. Mr. Kingery stated that he has completed the fieldwork phase of the audit and will present the report at the next audit committee meeting. IIAP staff noted that fieldwork for the Courts audit is just underway and the report for that engagement will also be presented at the next meeting. He added that the Airport Compliance audit had not yet begun and will likely start in the fourth quarter of FY23. In addition, Mr. Kingery indicated that the p-card audit will probably be replaced by the Payroll audit deferred from FY22 if some automated analytics can be successfully and timely implemented. Mr. Kingery stated that he has worked with the vendor for our audit software (Diligent/HighBond) and the IT department to see about installing some robotics/analytics related to payroll. This is currently going through the procurement process. Therefore, the timing of this audit will be dependent upon contract terms and system integration/implementation. Mr. Kingery indicated that with Moss Adams' presentation today of the Fleet Management audit, the FY22 audit plan is complete. For the contracted audits in FY23, one of our qualified vendors (Heinfeld Meech) is wrapping up fieldwork on the first (Field Operations Asset Management) of two audits under our current structure. The second audit by Heinfeld Meech is Fire Asset Management, which will begin after the Super Bowl. Another vendor, Securance Consulting, presented the Password Security audit today, and their second audit (Third Party Risk) has a kick-off meeting scheduled for mid -February. The remaining four contracted audits will be done by Moss Adams. The Housing (compliance) audit fieldwork is nearing completion and will be presented in either the next committee meeting or the following. A second audit in Community Services of the Revitalization Program will likely begin in the final quarter of FY23. The third audit by Moss Adams is a City Fees engagement; fieldwork is nearly complete, with a meeting on preliminary findings later this week. The fourth and final audit is a review of the Procurement Process; IIAP is working with Budget & Finance to schedule an opening conference soon. Mr. Kingery added that he is in the midst of a city-wide risk assessment exercise. He is gathering results and meeting with each department's leadership team to discuss them. Compiled results will shape the FY24 audit plan, which he hopes to present at the next audit committee meeting. As the next meeting is only two months away due to the postponement of today's meeting, IIAP staff asked committee members if they wanted to stay on the regular schedule or maybe combine the remaining two meetings into one, possibly in May. The committee members indicated their preference was to stay on the regular schedule. There were no other comments or questions. 12. COMMITTEE COMMENTS AND SUGGESTIONS Member Avalos thanked IIAP staff for continuing to work simultaneously on many projects, recognizing the difficulty for a one -person audit shop to tackle so much. There were no further comments, suggestions, or questions. 13. NEXT MEETING The next regularly scheduled meeting of the Audit Committee will be on Thursday, March 23, 2023, at 2:00 p.m. All committee members agreed on that date/time. 14. ADJOURNMENT With no further business, Councilmember Malnar adjourned the meeting at 2:34 p.m. The Audit Committee meeting minutes of January 18, 2023, were submitted and approved this 23rd day of March, 2023. Mike Kingery Indpendent Intern I dit Program Manager