Internal Audit Committee of Brevard County, Florida. Risk Assessment and Proposed Audit Plan Working Draft 2013/2014

Transcription

1 Internal Audit Committee of Brevard County, Florida Risk Assessment and Proposed Audit Plan Working Draft 2013/2014 Prepared By: Internal Auditors of Brevard County Presented on August 7, 2013

2 Table of Contents Transmittal Letter... 1 Proposed Audit Plan... 2 Follow Up... 3 Cycle-Audits... 4 County-Wide... 5 Financial Condition Reviews... 6 Individual Functions Special Projects... 9

3 August 7, 2013 The Audit Committee of Brevard County, Florida Viera, Florida We hereby submit the risk assessment and proposed audit plan for Brevard County for fiscal year ending We conducted a Risk Assessment for Brevard County by applying a broad-based, business view of risk, linked to the annual budget and operations of Brevard County. We conducted interviews with County Commissioners to gain a high-level understanding of their perspective of risk at the County, and narrowed in on their objectives and identified areas of focus. We conducted interviews with County Management and other personnel within the County to identify opportunities and vulnerabilities. We reviewed the proposed budget, County Commission meetings and drilled down into department and/or functional areas to understand risk from the perspective of the individuals responsible for controlling such risks. As in the past, when we talk about risk we focus on: Financial, Compliance and Public Perception. The risk assessment process was conducted using an industry accepted methodology which focuses on the following risk factors: Control Environment -- describes the overall tone and control consciousness of the subentity/function. It involves the integrity, ethical values and competence of personnel as well as management philosophy and operating style. Change -- addresses the extent to which change has impacted or is expected (in the near term) to impact the sub-entity/function, including changes in key personnel, the organization, its products, services, systems or processes. Process Risk -- addresses the inherent risk of the activities performed by the subentity/function, including the assets managed or in the custody of the sub-entity/function. Process risk addresses the extent of support the sub-entity/function provides to vital business functions, including the threat to continuity of the business caused by failures or errors; the probability of failure due to the amount of judgment, academic or technical skill required to manage the unit or perform key activities. External Factors -- describes the environment in which the sub-entity operates, and the type and amount of external interaction in which the sub-entity engages. Factors to consider include overall County and regulatory environment, the level of interaction with users and success in satisfying user requirements, the financial reporting environment and results of regulatory compliance audits. Revenue Source -- describes resources available to the sub-entity/function. Factors to consider include maximizing revenues, obtaining additional revenue sources and producing revenues outside of the standardize tax base. The objective of this assessment is to provide Brevard County with sufficient and continuous internal audit coverage of those areas judged as having a relatively high risk profile or that otherwise require internal audit attention for various reasons. We have included the objectives and an overview of the objectives for each of the functions in the proposed audit plan in this report. We would like to thank the various departments and all those involved in assisting with the risk assessment process. Respectfully Submitted, INTERNAL AUDITORS 1

4 Proposed Audit Plan

5 Brevard County Working Draft - Internal Audit Plan - as of August 7, 2013 FY 2013 / 2014 AUDIT UNIVERSE Pre in Last Audit Follow Up Overall Audit Functions Risk Assessment Update Risk Assessment Follow-up Procedures Quality Control Cycle-Audits Accounts Payable Asset Management Cash Reconciliations Self-Insurance Claims Review Timekeeping County-Wide Accounts Payable 2010 Accounts Receivable 2013 Asset Management 2009 Cash Management/Investments 2003 Central Cashier 2002 Central Fleet Services 2013 Contract Compliance Reviews 2010 Financial Position Review 2007 Financial Reporting 2008 Human Resources 2009 Information Technology 2008 Local Option Gas Tax 2007 Payroll/Timekeeping 2011 Purchasing and Contract Management 2012 Purchasing Card 2010 Year End Financial Close 2008 Financial Conditions Reviews Fire Rescue 2008 Housing and Human Services 2011 Library Services 2011 Parks and Recreation 2011 Public Works 2009 Storm Water 2012 Utility Services 2012 Financial Condition Reviews - Update 2013 Individual Functions 800 Mega / E Ambulance Billing 2003 Animal Services 2010 CDBG 2002 Criminal Justice Services 2006 Economic Development Commission 2002 Environmentally Endangered Lands (EEL) 2007 Facilities Construction 2003 Facilities Maintenance 2006 Fire Rescue 2012 Golf Operations 2005 Land Development 2006 Mosquito Control 2011 Building Permitting - "One Stop" 2005 Parks and Recreation 2008 Public Works 2004 SHIP, HOME & HHRP Program 2007 Solid Waste - Billing 2003 Solid Waste - Landfill Operations 2004 Space Coast Area Transit (SCAT) 2009 Storm water 2005 Tourism Development Office 2003 Utilities - Billing and Collection 2007 Valkaria Airport N/A Special Projects or Requests Clerk Traffic 2002 FEMA 2006 Fund Fire Rescue 2006 Impact Fees for Schools N/A IT Advisory Services 2011 MIRA 2007 Parks & Recs Referendum 2007 Legend Ongoing Function Audit Closed Action Deferred due to Resources Follow-up in Progress Audit Report Issued Audit in Progress Proposed for upcoming year 2

6 Follow-Up Procedures

7 Follow-up Procedures As required by the Institute of Internal Auditors Standards for the Professional Practice of Internal Auditing (Performance Standard #2500), internal auditors should establish a follow-up process to ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action. While this Standard applies specifically to the internal audit function, the fundamental due diligence should apply to all audit findings or reported observations by any agency. Included within Management Response in the previously issued internal audit reports is the targeted implementation date for remediation. We will perform procedures for those issues where the target dates have been reached, and ample time has passed under the new control (generally six months) to verify and report the implementation status of the recommendations to the previously reported findings. As of 08/07/2013, the following previously issued internal audit reports have remaining open items and items on Action Deferred due to budgetary constraints: 800 MHz / E-911 Animal Services CAFR Comments Facilities Maintenance Fire Rescue Revenue Billing and Collection Human Resources Mosquito Control Parks and Recreation Referendum Space Coast Area Transit Objectives Objectives of the overall follow up procedures will be to determine if open issues from previous audit reports have been properly remediated. Follow up is meant to validate, on a sample basis, the effectiveness of the remediate controls of the previously reported open issues. 3

8 Cycle Audits

9 Cycle Audits Asset Management Cycle Audit Overview The County owns more than $967 million in assets, including land, buildings, construction in progress, and operating machinery and equipment. Machinery and equipment makes up 6.5% of the balance, with $63 million net book value at September 30, Our audit will focus on machinery and equipment, rather than real property, such as land and buildings, as the risk of loss occurs at this level due to the portability of those assets. Further, Asset Management is an inherently high risk function due to each department being responsible for safeguarding of their assigned property. Objectives Our last audit report covering the County s Asset Management process at a global level was issued in Objectives of the cycle audit of Asset Management are to determine existence, completeness and compliance with policies and procedures with respect to tangible personal property inventories conducted at the County through representative audits for a sample of high risk cost centers. A property control cycle audit is meant to validate, on a sample basis, the inventory results submitted to the District office by the various cost centers and identify potential control deficiencies and improvement opportunities based on observations made during the site visits. Although identified issues may be researched and corrected as a result of the procedures performed, a cycle audit is not meant to resolve inventory issues related to missing, retired, or otherwise unaccounted for assets. Self-Insurance Claims Review Bi-annually, a review of health insurance claims is performed to ensure compliance with contracts by the third-party administrators (TPA). During our last internal audit of these claims, issued October 2010, it was determined that, the Health Reimbursement Account HRA plan contained the most risk since this type of plan is new to the insurance market and it was specifically designed by the TPA to meet Brevard County s unique criteria. The purpose of this review is to ensure that claims are processed accurately, timely, and in compliance with contract terms. In order to test a sample of claims from FY2012/2013 and provide timely, relevant data, we will conduct this agreed-upon procedures audit during the summer of 2013, to allow 2013 claims to cycle through the process for testing. Objectives Each member s HRA account was correctly established by TPA. Deductibles and coinsurance had been calculated appropriately. Deductibles and coinsurance had been appropriately accounted for in each member s annual Deductible and Out of Pocket Maximum limits. If there was a balance in the corresponding member s HRA account, that applicable deductibles and coinsurance had been forwarded to the member for them to pay the medical provider. Each member s HRA account had been adjusted appropriately for deductibles and coinsurance. Medical providers were appropriately paid by TPA. This project began during FY13 and will be complete during FY14. 4

10 County-Wide

11 County-Wide Audits Information Technology Backup and Recovery Monitoring Phase II A backup and recovery plan establishes guidelines and procedures to prevent problems that might cause data loss or interruptions to the County s operations, and to allow recovery as quickly as possible if such events do occur. The County s backup plan defines procedures for: Backing up baseline configurations so a computer can quickly be restored to its prior state, if needed; Backing up servers; Backing up the most recent system and user data before system changes are made; Testing the restore process for each of the above processes using the backup files. In addition, the backup plan identifies who is responsible for performing backups, and should include the schedule for all periodic backups and periodic testing of backups, as well as instructions for labeling and storing all backup files. The process is decentralized and the responsibility of several stakeholders within the County. Objectives The IT Backup and Recovery Cycle Audit would monitor compliance by responsible parties with the County s Backup and Recovery plan. Information Technology Backup and Recovery Monitoring Phase I was issued to the Audit Committee during May, The purpose of that internal audit was to assist management with the development and update of a Standard Operating Procedure (SOP) for monitoring backup and recovery across the County. Phase II of the internal audit will evaluate whether the new SOP has been implemented effectively and is being followed. 5

12 Financial Condition Reviews

13 Financial Condition Reviews - Update Beginning in April 2008, seven (7) departments have been included as part of one or more Financial Condition Reviews, with the primary objective of providing an independent analysis of the department s ability to maintain its Board directed service level within its current revenue structure. These departments were considered high risk for various reasons, and are as follows: Fire Rescue Housing and Human Services Library Services Parks and Recreation Public Works Stormwater Management Utility Services Updates have been performed on each of these, with the exception of Stormwater Management, which is proposed for FY 2013/2014. The original Financial Condition Review for Stormwater Management was issued in June Objectives The primary objective of a financial condition review is to provide an independent analysis of the department s ability to maintain its Board directed service level within its current revenue structure. For each of the reports issued above, we will present an update on the changes that have occurred and the status and progress of the department to-date on any items discussed in our initial reports, as well as new challenges to be addressed. The focus of the update will be on cash flows, use of existing fund balances, and trends that may need to be addressed going forward. Consistent with previously issued Financial Condition Reviews, the following activities will be considered to achieve the stated objective: Comparison of budget to actual revenues and expenditures. Evaluation of cash flow for the year and anticipated cash flow projections. Perform an analysis of fund balance (reserves) for the most recent fiscal year. Analysis of revenues and expenditures. 6

14 Individual Functions

15 Public Works Prior to 2008, the County operated two separate departments - Transportation Engineering and Road & Bridge. During 2008, the two departments were combined to form the Brevard County Public Works department. The Public Works department is primarily responsible for the design, construction and maintenance of County roadways. The majority of funding for the Public Works department is derived from restricted revenue sources. Accordingly, once received, these revenue sources must be spent on specific projects and cannot be diverted to meet other unrelated County needs. However, the Public Works department also receives a significant amount of funding from General Fund transfers, which is allocated annually by the Board of County Commissioners. The Public Works department includes five programs and services: Traffic Operations Surveying and Mapping Road & Bridge Transportation Construction Management Engineering According to the adopted budget for FY2012/2013, 75% of the department s budget falls into the Transportation Construction Management program, which includes construction services, contract management and land acquisition. The program reported more than $650 million in unfunded transportation projects. Objectives The objectives of the internal audit of Public Works have yet to be determined. The internal auditors, in combination with County management and the Board of County Commissioners, recognize the department is high risk due to the number of unfunded projects, decreasing funding trends and the number of current projects that are being outsourced to vendors. Because a Financial Condition Review and an update have been performed for Public Works, we want to ensure that duplication of efforts does not occur in order to maximize the County s internal audit resources. A planning meeting with the department director will be scheduled after the proposed internal audit plan is approved, with the scope and objectives of the internal audit to follow. 7

16 Valkaria Airport An internal audit of the Valkaria Airport has not been performed since the inception of the internal audit function. The airport s annual budget for FY2013 is $6.34 million. According to their budget document for FY2013: The Valkaria Airport provides operational oversight of two active runways, associated taxiways, parking areas, tie downs and seventy-one (71) T-hangar units. The Airport provides Unicom & Common Traffic Advisory Frequency (CTAF), Universal Communications, Airport Radio Advisories, including weather data and supports an Airport Weather Observation System (AWOS-II). Valkaria Airport provides routine maintenance of runways and taxiways and other facilities funded through grants received from the Federal Aviation Administration (FAA) and the Florida Department of Transportation (FDOT) with matching funds generated from airport revenues. The Airport continues to implement Capital Improvement Projects as approved by the Board of County Commissioners, funded through grants with matching funds generated from airport revenues. During FY2012, the airport was awarded an Airport Improvement Grant from the Federal Aviation Authority, which is being used to expand the airport as approved in the Airport Master Plan. The grant program is subject to various audits, including audits by the FAA as well as being subject to Federal Single Audit, which is performed annual by the County s external auditor. This program was audited as of 9/30/2012, when $2.3 million had been expended. Objective The objective will be to evaluate whether the system of internal controls is adequate to absorb and facilitate the additional needs and requirements of the airport once the expansion is complete and operations begin to grow. We will determine the scope upon an initial meeting with the agency staff, however we anticipate that will review hangar lease management, fuel inventory, and general policies and procedures, as well as perform high level benchmarking of FTE and organizational trends with like-sized agencies. 8

17 Special Projects

18 Educational Facilities Impact Fees In 2004, County Ordinance 04-34, the Brevard County Educational Facilities Impact Fee Ordinance, was approved in order to provide funding to the School Board of Brevard County for the development of primary and secondary educational facilities. An interlocal agreement was drafted and agreed upon by both parties, and was amended in There are multiple provisions in the interlocal agreement as it relates to compliance and allowable expenditures. These include, but are not limited to the following: Establishment of Benefit District Accounts Expenditures of Educational Facilities Impact Fees Expenditures Limited to Impact Fee Benefit District Fund Utilized for Debt Service Impact Fee Advisory Committee Conflict of Interest Section 4.3 of the interlocal agreement allows for the right to review the records as to receipt, allocation and expenditure of the impact fees. Objectives The objectives of the internal audit of Educational Facilities Impact Fees will focus on compliance by the parties to adhere to the provisions of the interlocal agreement, as well as ensuring the proper use of the impact fees in accordance with other relevant state and local requirements. The objectives will also include an evaluation of the internal controls for monitoring compliance and tracking of revenue and expenses in accordance with the agreement and County Ordinance. 9

19