Loading...
HomeMy WebLinkAboutMinutes - Minutes - Audit Committee - Meeting Date: 6/7/2023C117 Glendale A R I Z O N A MINUTES AUDIT COMMITTEE CITY HALL, 4th FLOOR CONF. ROOM 5850 W. GLENDALE AVE. GLENDALE, ARIZONA 85301 JUNE 7, 2023 2:00 P.M. 1. CALL TO ORDER Councilmember/Chair Jamie Aldama called the meeting to order at 2:00 p.m. 2. ROLL CALL Present: Jamie Aldama, Councilmember, Chairperson Ian Hugh, Councilmember Raymond Malnar, Councilmember Irene Avalos, Member Kevin Phelps, City Manager Levi Gibson, Budget & Finance Director Absent: Rusty Simmons, Member Also Present: Mike Kingery, Independent Internal Audit Program Manager Nancy Mangone, Deputy City Attorney Vicki Rios, Assistant City Manager Jamsheed Mehta, Assistant City Manager Feroz Merchhiya, Chief Information Officer, Innovation & Technology Arlene Chemello, 3rd Party Contractor, Innovation & Technology Michelle Woytenko, Director, Field Operations Daren Frank, Deputy Director, Field Operations Nicholas DiPiazza, Presiding City Judge, City Court Layne Herber, 3rd Party Contractor, City Court Connie Heimgartner, Supervisor, City Court Celeste Brown, Accountant Senior, City Court Jeff Bratcher, Program Manager, Organizational Performance Office Paul Ashe, President, Securance Consulting (Guest) Christopher Goeman, Audit Manager, Heinfeld Meech (Guest) 3. CITIZEN COMMENTS No members of the public were present. No comments. 4. APPROVAL OF THE MINUTES Councilmember Hugh motioned to approve the Audit Committee minutes of the March 23, 2023, meeting as written; Member Avalos made the second. Motion carried unanimously. AYE: Councilmember, Chairperson Jamie Aldama Councilmember Ian Hugh Councilmember Raymond Malnar Member Irene Avalos Other: Member Rusty Simmons (ABSENT) 5. MOTION TO CALL FOR AND ENTER INTO EXECUTIVE SESSION A motion was made by Councilmember Ian Hugh, Seconded by Member Irene Avalos AYE: Councilmember, Chairperson Jamie Aldama Councilmember Ian Hugh Councilmember Raymond Malnar Member Irene Avalos Other: Member Rusty Simmons (ABSENT) 6. EXECUTIVE SESSION Review and discuss draft audit reports pursuant to Glendale City Code §2-54b and §2-58c (A.R.S. §38-431.03 (A)(2)). Session was held. 7. MOTION TO ADJOURN EXECUTIVE SESSION AND RECONVENE IN OPEN SESSION A motion was made by Councilmember Ian Hugh, Seconded by Member Irene Avalos AYE: Councilmember, Chairperson Jamie Aldama Councilmember Ian Hugh Councilmember Raymond Malnar Member Irene Avalos Other: Member Rusty Simmons (ABSENT) 8. ITEMS FOR DISCUSSION AND POSSIBLE ACTION Councilmember Aldama announced that the committee would review and consider vote to approve the following three audit reports: IT Third -Party Risk Management, Field Operations Facilities Management, and Triennial Courts Agreed Upon Procedures. Councilmember Hugh motioned to approve the audit reports, with amended management response to finding # 3 of the Field Operations Facilities Management report. Member Avalos made the second. Motion carried unanimously. Councilmember Aldama announced that the committee would review and consider vote to approve the proposed FY24 Audit Plan. Councilmember Hugh motioned to approve the audit plan, with amended assignment of two audits from IIAP staff to contracted vendors. Member Avalos made the second. Motion carried unanimously. 9. UPDATE ON COMMITTEE GOALS Mr. Kingery reviewed the goals that were reaffirmed by the Audit Committee during the September 15, 2022 meeting. The goals are: 1) developing a work plan for implementation of an Independent Internal Audit Program (IIAP) quality assurance and improvement program in preparation for a peer review in FY24, and 2) monitoring remediation of outstanding recommendations from prior audits to ensure they are fully implemented by expected/target date. Mr. Kingery noted that goal # 2 will be discussed first. For goal # 2, Mr. Kingery included the updated spreadsheet in the meeting materials, noting that completed action plans were removed, and some new items that have reached their targeted completion date were added. One item related to the Public Records Compliance audit was resolved the day before this meeting, but the materials had already been distributed. Per Councilmember Malnar's request at the previous meeting, Mr. Kingery added a column for new due dates on the items that had yet to be completed. When updating the spreadsheet based on correspondence with the departments responsible for action plan implementation, Mr. Kingery requested new target completion dates. Mr. Kingery noted that while some items had longer gaps between original implementation and currently projected completion dates, departments had reasonable explanations why they were incomplete. The reasons varied based on the department and its action plan(s). Member Avalos asked about the policy of remediating findings within 12 months. Mr. Kingery stated that it is not a policy per se, but more like a guideline. Mr. Kingery noted that there is not an IIAP Policy and Procedures Manual currently in place; he is working on one currently which will be addressed next in reference to goal # 1. In further response to Ms. Avalos' inquiry, Mr. Kingery asked the committee's opinion on consequences for the departments that are not completing their remediation plans timely. He noted that management has the responsibility to hold departments accountable for addressing audit recommendations. Member Avalos asked if responsible parties/departmental directors have these audit items incorporated into their annual performance evaluations. Mr. Phelps said that would be up to the appropriate level of management to decide, but that audit standards don't prescribe a "punishment" aspect for non-compliance. Ms. Avalos mentioned that while she is not necessarily advocating for punishment, she feels it is appropriate for senior management to ensure departmental compliance with their action plans as part of a performance -based assessment measure. Mr. Kingery noted that although he has not yet been with the City long enough to cycle through previous audits again, any repeat findings would bear more weight and likely increase the risk level of that area and potentially lead to more frequent audits. Mr. Phelps indicated that he is less concerned about the timeline to complete action plans than having a schedule that makes sense for each particular finding. A target date that is too far away for an item that can be easily addressed is just as unreasonable as a short time period to resolve a large-scale and/or system -related issue. Mr. Kingery noted that most of the timelines are less than 12 months and initially appear reasonable. Mr. Phelps asked Vicki Rios (Assistant City Manager) to work with Mr. Kingery on developing a framework for addressing audit recommendations and corresponding management action plans, reporting back to the committee on its progress. Ms. Avalos liked that approach and indicated that the committee should have some say on the reasonableness of the timelines that departments offer for action plan implementation. Ms. Avalos indicated she was pleased with the spreadsheet provided each quarter, and that the added column with a new expected completion date helps the committee gain more traction on the current status of outstanding findings. There was no further discussion on goal # 2. For committee goal # 1, Mr. Kingery related how the peer review requirement applies to HAP currently. The way the audit charter (City Administrative Policy 5) reads today indicates that HAP is expected to adhere to both the Yellow Book (standards published by the Government Accounting Office) and the Red Book (standards published by the Institute of Internal Auditors). This makes HAP an "orange shop", which is a huge administrative burden, especially for a one -person department. Based on research of standards and discussions with ALGA (Association of Local Government Auditors) peer review leadership, Mr. Kingery concluded that operating solely as a Red Book shop makes the most sense for HAP. This recommendation comes as the IIA is overhauling its standards for the first time in decades with the publishing of new Global Internal Auditing Standards (GIAS). The GIAS specifically address challenges and unique circumstances addressing small audit shops, as well as those in the public sector. Mr. Phelps agreed that the administrative burden associated with excessive standards compliance can affect the efficiency and productivity within IIAP's limited resources. To benefit the organization the most, Mr. Phelps agreed that it makes sense to adopt the GIAS as our standards and that if necessary, we can require specific engagements to adhere to Yellow Book standards as well when appropriate. Ms. Avalos asked if our contracted vendors have a choice of which standards to follow on each engagement. Mr. Kingery indicated that our current contract for our five qualified vendors ends effective June 30, 2024. As a new Request for Proposal (RFQ) will need to be issued in FY24 to be effective for FY25 and beyond, Mr. Kingery indicated that we can specify contractor adherence to the GIAS in the RFQ, as well as Yellow Book compliance when and if it's warranted. Ms. Avalos supported this approach. Mr. Kingery noted that changes to the standards and IIAP becoming solely a Red Book shop would also require corresponding revisions to our current audit charter. Mr. Kingery shared with the committee copies of the current charter and suggested revisions, along with a clean version with all changes accepted. He indicated that changes to the audit charter, along with authoring an IIAP Policy and Procedures Manual (PPM), can be presented at the next quarterly meeting in September for committee consideration. Ms. Avalos asked if formal approval by the audit committee is required before moving forward with the PPM and revised charter. Mr. Phelps indicated that once presented to the audit committee, they would decide if these changes are the best approach and adopt them, or remanded back to go to a different standard. With respect to the proposed audit charter changes, Ms. Avalos asked about clarification for one of the acronyms included, and Councilmember Malnar noted a typo to fix. Mr. Kingery said that both would be corrected in the version he'll present to committee in September. Ms. Avalos also asked about "periodic" updates to following up on outstanding findings as per the audit charter. Mr. Kingery indicated those would continue on a quarterly basis in the audit committee meetings. Nancy Mangone (Deputy City Attorney) asked for clarification that the audit charter changes are only a change to policy and not a change to the City Charter. Mr. Kingery confirmed it's only an operational policy change, which was confirmed by Mr. Phelps and Ms. Rios. There was no further discussion on this agenda item. 10. UPDATE ON FY23 AUDIT PLAN For the FY23 audit plan, Mr. Kingery noted that all engagements had either been completed (seven), have fieldwork in progress (four), or have been deferred to the FY24 audit plan (only the Payroll audit as work on implementing automated analytics is about to begin). The seven completed audits are: Property Evidence for the Police Department, the Triennial Agreed Upon Procedures for City Courts, City Fees, Field Operations Facilities Management, Glendale Housing Program, IT Third -Party Risk, and the IT Password Security audit. The four in progress are: Airport Compliance, Community Services' Revitalization Program, Fire Department Asset Management, and the Procurement audit. There was no discussion on this agenda item. 11. COMMITTEE COMMENTS AND SUGGESTIONS There were no comments, suggestions, or questions. 12. NEXT MEETING The next regular meeting of the Audit Committee will be held on September 7, 2023, at 2:00 p.m., at a location to be determined. All committee members agreed on that date/time. 13. ADJOURNMENT With no further business, Councilmember Hugh adjourned the meeting at 3:57 p.m. because the Chair (Councilmember Aldama) had to leave the meeting a few minutes prior. The Audit Committee meeting minutes of June 7, 2023, were submitted and approved thisf�th day of September, 2023. Michael Kingery- Internal Audit Program M Hager