MEMORANDUM Risk Assessment, 2015 Audit Plan, and 2014 Audit Plan

Transcription

1 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: January 21, 2015 TO: FROM: SUBJECT: s of the Audit Committee David James, Director of Internal Audit 2015 Risk Assessment, 2015 Audit Plan, and 2014 Audit Plan Recommendations Receive and file the 2015 Risk Assessment. Review and approve the 2015 Audit Plan. Receive and file the 2014 Audit Plan. Background We have completed the annual risk assessment process and the 2015 Audit Plan. Attached are: The 2015 risk assessment The proposed 2015 Audit Plan The 2014 Audit Plan with final actual hours. Risk Assessment Process It is the responsibility of OCERS management to identify, assess, and manage risk. Risks are events, actions, or inactions that could cause key business objectives to not be achieved. To mitigate and manage these risks, OCERS management implements internal controls, plans for disruptions, develops risk management programs, and engages in risk mitigation programs. It is Internal Audit s responsibility to facilitate management s identification and assessment of risk, and to monitor and report on how well risks are being managed. We used the objectives the Board approved as part of the Strategic Plan as guidance in assessing risks to OCERS programs and processes. These objectives are: Excellent customer service Timely and accurate benefits Secure and reliable data Efficient investment program Professional plan administration. Audit Plan Memo Page 1 of 3 Audit Committee Meeting January 26, 2015

2 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM Risk Assessment Methodology Internal Audit established the structure of the risk assessment by identifying key programs, projects, and processes (auditable entities). We then identified the following categories of risk: 1. Materiality / Financial Impact / Compliance The magnitude of financial exposure, the degree of regulatory oversight, possible financial penalties. 2. Strategic / Operational Impact The significance of this process to OCERS strategic success, impact of process disruption. 3. Change / Stability How much the process has been altered and the change of personnel carrying out the process. 4. Complexity of Operations or Regulations The number of individuals, entities, and processes involved, and the degree to which professional judgment or technical expertise is applied. 5. Political / Reputation The degree of public interest and awareness, the visibility of the process to the media. 6. Last Audit: Time and Results The length of time since the last audit or review was conducted and the results of that audit or review. Internal Audit then developed the following rankings for risk: High High to Medium Medium to Low Medium Low Internal Audit Plan Development Recognizing the extent of OCERS activities and the constraints of Internal Audit s resources, Internal Audit sought to maximize its effectiveness by engaging in a risk assessment process to establish its priorities for We found that the highest risk area for 2015 is the implementation and go-live of the V3 pension administration system, so most of our Audit Plan is dedicated to that risk area. When we have completed payroll transmittal audits for OCFA and IHSS this year, we will have performed this type of audit for all plan sponsors prior to V3 golive. Although a primary factor in the development of the Audit Plan, risk assessment was not the sole factor used in the selection of audit projects for We considered the resources required to perform certain audits (e.g., consultants for the V3 data conversion audit) and the available audit staff in our audit selections to maximize the effective usage of available resources. An audit of business continuity / disaster recovery will be performed when OCERS staff have had sufficient time to fully implement this program, given the current dedication of resources to the V3 project. The risks of OCERS data security are to some extent mitigated by the system penetration testing performed by a consultant. Additional audits of high risk Investments processes will be performed in the future as time permits. Audit Plan Memo Page 2 of 3 Audit Committee Meeting January 26, 2015

3 Prepared by: ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM David James Director of Internal Audit Audit Plan Memo Page 3 of 3 Audit Committee Meeting January 26, 2015

4 Internal Audit Risk Assessment Matrix for 2015 Risk Rankings High High to Medium Medium Medium to Low Low Definitions Division Auditable Entity Materiality / Financial Impact / Compliance Strategic / Operational Impact Change / Stability Complexity of Operations or Regulations Political / Reputation Last Audit - Time and Results Average Risk Ranking Information Technology Pension administration system (V3) implementation, data conversion Investments Due diligence Enterprise Business continuity / disaster recovery Investments Private equity - fees and expenses Information Technology Data security Investments Risk management Investments Investment consultant review Investments Hedge fund / alternative manager Investments Direct lending Board Ethics Board Governance Investments Absolute return Investments Asset allocation Investments Operations of investment managers Information Technology Web-based network vulnerabilities, penetration test Enterprise Expenses Plan Sponsors Contribution transmittals Investments Real estate Page 1 of 4

5 Internal Audit Risk Assessment Matrix for 2015 Materiality / Financial Impact / Compliance Strategic / Operational Impact Change / Stability Complexity of Operations or Regulations Political / Reputation Last Audit - Time and Results Average Risk Ranking Division Auditable Entity Investments Investment manager fees Information Technology IT governance Finance Payroll for retirees Administrative Services Succession Planning Services eligibility Legal Compliance review Investments Public equity Investments Cash overlay Investments Investment process (manager selection, monitoring, reporting, renewal, and termination) Investments Fixed income Investments Securities lending Enterprise Data privacy Administrative Services Hiring Services Interest posting / crediting Services Benefits setup Services Record management and retention Investments Derivatives Investments Investment policy compliance Finance Budgets Page 2 of 4

6 Internal Audit Risk Assessment Matrix for 2015 Materiality / Financial Impact / Compliance Strategic / Operational Impact Change / Stability Complexity of Operations or Regulations Political / Reputation Last Audit - Time and Results Average Risk Ranking Division Auditable Entity Finance Cash management Finance General Ledger Investments Accuracy of costs allocated by external managers to OCERS Finance Investment accounting and valuation Enterprise Vendor contract compliance Disability Disability process Services Pension Spiking (PEPRA) Services Retiree Rehires (PEPRA) Services Dependent eligibility Finance Contributions - member, employer Finance Financial reporting Finance Spreadsheet controls Finance Accounts Payable Enterprise Signature authority Enterprise Procurement Enterprise RFP process Administrative Services HR Processes Services 1099s Services Lump sum payments Page 3 of 4

7 Internal Audit Risk Assessment Matrix for 2015 Materiality / Financial Impact / Compliance Strategic / Operational Impact Change / Stability Complexity of Operations or Regulations Political / Reputation Last Audit - Time and Results Average Risk Ranking Division Auditable Entity Services refunds Legal Contract administration Investments Personal Trading Policy compliance Actuary Acturial extract Investments Investment reconciliations Services Survivor claims Services Death comparison process Services Reciprocity Services Service purchases Legal Domestic Relations Orders Services COLA Finance Travel expenses Page 4 of 4

8 Orange County Employees Retirement System Internal Audit Division 2015 Internal Audit Plan Audit Activity Internal Audits V3 Data Conversion Audit Description Review of certain key data used in system conversion from PensionGold to V3. Priority (A, B, or C) Planned Hours - Original Budget Actual Hours as of 1/16/15 Hours Estimated to Complete A Comments Investments Due Diligence OCFA Payroll Transmittal IHSS Payroll Transmittal Benefit payments to OCERS retirees Review Investments due diligence process. Review payroll transmittals and employee data of selected plan sponsor. Review payroll transmittals and employee data of selected plan sponsor. Audit of benefit payment setups for OCERS retirees (Board member request) A A A B Internal Audits Subtotal 1, ,908 Page 1 of 3

9 Orange County Employees Retirement System Internal Audit Division 2015 Internal Audit Plan Planned Hours - Original Budget Hours Estimated to Complete Audit Activity Description Priority (A, B, or C) Actual Hours as of 1/16/15 Comments Non-Audit Projects Miscellaneous Use of hotline reporting system. B Investigations Risk and Control Matrix Review and update Risk and Control A Matrix. Risk Assessment and Annual preparation of the Audit Plan, A Completed Audit Plan updates to the current Audit Plan. Non-Audit Projects Subtotal Administration Board and Committee Meetings Board meetings, Audit Committee, Investment Committee, Governance Committee. A Includes preparation time for meetings General Administration Attending staff and other meetings, B 1, ,122 Includes various ad hoc projects administrative duties. Administration Subtotal 1, ,395 Grand Total Hours 3, ,405 Page 2 of 3

10 Orange County Employees Retirement System Internal Audit Division 2015 Internal Audit Plan Audit Activity Description Priority (A, B, or C) Planned Hours - Original Budget Actual Hours as of 1/16/15 Assumptions Two auditors 4, Hours Estimated to Complete Comments Miscellaneous Leave Holidays, Sick Leave, Time off, etc Training / Conferences Required to maintain CPA certification. 168 SACRS, APPFA. Total Hours off Total Hours Available for Two Auditors 3, Page 3 of 3

11 Orange County Employees Retirement System Internal Audit Division 2014 Internal Audit Plan Audit Activity Internal Audits Derivatives Description Determine compliance with Policy and sufficiency of information on derivatives provided to the Board. Assess accuracy of member data given to actuary. Review transmittals and employee data of selected plan sponsor. Review Plan Sponsors, organizational structure, revenue sources. Review transmittals and employee data of selected plan sponsor. Priority (A, B, or C) Planned Hours Original Budget Actual Hours as of Variance Comments A Completed Actuarial Extract Data Follow up A Completed Employer County of A Completed Orange Plan Sponsor Review A Completed added at Board request Employer Sanitation A Completed (awaiting District management responses) Due Diligence Review due diligence process. B Continued to 2015 Pension Spiking Analysis Pension Administration System (PG & V3) Develop pension spiking analytics with ACL consultants Review of certain key data used in system conversion from PensionGold to V3. A Completed added with Committee approval A Continued to 2015 Internal Audits Subtotal 2,184 1, Page 1 of 3

12 Orange County Employees Retirement System Internal Audit Division 2014 Internal Audit Plan Audit Activity Non Audit Projects Miscellaneous Investigations Internal Control Review, Risk Assessment and 2014 Audit Plan Fraud and Internal Control Presentations Description Priority (A, B, or C) Planned Hours Original Budget Actual Hours as of Variance Comments Use of hotline reporting system. B Four investigations for 2014 Review and update Risk and Control Matrix. Annual preparation of the Audit Plan, updates to the current Audit Plan. Increase awareness of internal controls and fraud risk at OCERS. A Completed B Completed Administration Board and Committee Meetings Non Audit Projects Subtotal Board meetings, Audit Committee, Investment Committee, Governance Committee. A Includes preparation time for meetings General Administration Attending staff and other meetings, B 800 1, Includes various ad hoc projects administrative duties. Administration Subtotal 1,050 1, Grand Total Hours 3,584 3, Page 2 of 3

13 Orange County Employees Retirement System Internal Audit Division 2014 Internal Audit Plan Audit Activity Description Priority (A, B, or C) Planned Hours Original Budget Assumptions Two auditors 4,160 4,160 Actual Hours as of Variance Comments Miscellaneous Leave Holidays, Sick Leave, Time off, etc Training / Conferences Required to maintain CPA certification SACRS, APPFA. Total Hours off Total Hours Available for Two Auditors 3,584 3, Page 3 of 3