Okaloosa County BOCC — November 18, 2014 — Action Item Printout — reading text

BOARD OF COUNTY COMMISSIONERS AGENDA REQUEST DATE: November 18, 2014 TO: Honorable Chairman and Members of the Board FROM: Kay Godwin SUBJECT: Update on Risk Assessment DEPARTMENT: Human Resources BCC DISTRICT: STATEMENT OF ISSUE: Staff Update on Risk Assessment BACKGROUND: The following information is provided to update the Board of County Commissioners on action taken by the county in response to recommendations made by Carr, Riggs & Ingram (CRI) in their 2013 review of entity-wide internal controls, fraud risk assessment and overall risk assessment. This report is not intended to outline every change made by the county following a former employee’s fraudulent actions that prompted an agency-wide review of policies, controls and financial activities, but rather to focus on the implementation of specific recommendations made in the CRI report. To aid in the detection and prevention of fraud, the Board of County Commissioners adopted a formal Anti-Fraud policy that addresses investigation protocols and provides guidance on reporting known or suspected fraud to the appropriate authorities. Fraud awareness and ethics training, including warning signs of fraud and what to do if fraud is suspected, has been provided to BCC employees, including executives, managers and employees at all levels. County Commissioners and the County Administrator not only endorsed, but also attended this training, setting a positive tone at the top. In addition, the fraud reporting feature on the county’s web site is currently being updated to further enhance the public’s ability to report tips anonymously. The total number of credit cards issued to BCC employees has been reduced, the card rules have been revised, new controls have been implemented and updated training provided to credit card holders. Further, Purchasing policies and procedures are being reviewed and updated, to include standardized procedures regarding returned materials. As a fraud prevention and detection control, the county is considering an amendment to their annual leave policy that would require key employees to take an annual vacation that lasts at least one week while another employee performs their duties during this time. Further, two additional security cameras have been added to the Water and Sewer inventory building and inventory cycle counts are performed weekly throughout the year. In addition, the Airport has purchased and implemented a software program designed for the tracking and billing of airport fees and leases. Information Technology (IT) is currently implementing upgrades to enhance disaster recovery and redundancy efforts. In addition to internal security measures, systems and networks follows Microsoft best practices on share and file permissions. In order to address additional controls, risks and security recommendations, additional funding for an updated comprehensive IT risk assessment will be required in addition to funding a position responsible for security and networking. These appropriations will be requested in the next budget planning cycle. Some of the recommendations in the CRI report related specifically to the operations of the Clerk’s Office. The Clerk hired Mr. Samuel Scallan as Director of Internal Auditing in January 2014. He recently provided the following information relative to actions taken by the Clerk’s office following the CRI audit recommendations. Mr. Scallan is currently developing a formal risk assessment and work plan, and he has conducted internal audits of BCC functions including both surprise cash counts and routine inventory counts. He advised that policies and procedures for the billing and collection of revenues are being established by the Finance Department. Once finalized, BCC departments will develop or revise operationally specific policies and procedures that are consistent with the overall policies. Mr. Scallan noted that compensating controls had been implemented in the accounts payable section of the Clerk’s office to compensate for insufficient staff levels. While on-going assessment activities and additional monitoring have been recommended in every recent audit of county activities (e.g. Auditor General, Warren Averett, CRI), budgetary appropriations have been insufficient to fully implement the recommendations. Some of these activities are best suited for contracted projects through consultants and outside experts, while others would be best performed by additional in-house staff. CRI recommended selection of an overall coordinator for the fraud risk assessment for the BCC. Many other counties staff this function through a centralized office of management and budget working under the county administrator, or often, an assistant county administrator. A new BCC position of compliance officer, reporting to the County Administrator, was included in the fiscal year 2014 budget appropriations; however, that position was never filled and has since been eliminated from the current budget. Three factors that contributed to the elimination of that position were: 1) the Clerk’s hiring of a new Director of Internal Auditing; 2) the lack of adequate staff to oversee the compliance function; and 3) an overall lack of financial resources, making a vacant administrative position an easy target to help balance the budget. Historically, the county has maintained a lean administrative staffing profile. The CRI report provided a “big-picture” assessment of the county’s financial and structural processes, “a jumping off point for finding solutions to existing problems.” In addition to the changes that have already been made, staff is evaluating the options and costs of engaging an independent third party to conduct an enterprise-wide control risk assessment, a management tool that assists in measuring the effectiveness of controls in place and recommends areas where strengthening of controls are needed. This would include a specialized tool or methodology the county would use moving forward to identify high risk areas and evaluate control risks on an annual and on-going basis, in conjunction with internal reviews and auditing functions of both the clerk and the county. Using an independent third party to conduct this assessment would provide another layer of objectivity, independence and transparency. Meanwhile, BCC staff suggests a modification to the CRI 5-year audit plan as identified on the grid below, and as stated earlier, Mr. Scallan is completing an independent risk assessment for purposes of establishing his annual work plan. Internal audits will be conducted by the Clerk’s internal auditing staff, or may be conducted by an external firm through contract. In summary, 75% of the CRI recommendations have either been completed or are in the process of implementation. The remaining items will require additional funding and assistance of outside consultants/contractors. Review of fraud and control risks should not be a one-time exercise. Enhanced organizational structure and additional resources towards a more centralized focus on financial management and accountability are warranted in order to provide a stronger emphasis on controls and accountability. Suggested 5-Year Audit Plan by Department Department 2014-2015 2015-2016 2016-2017 2017-2018 2018-2019 Airports X X Corrections X County Administrator X Court Services X Extension Services X Facility Maintenance X Fleet Operations X X Growth Management X X Human Resources X Information Systems X X Law Library X Library Co-op X Public Safety X Public Works X X Purchasing X X Risk Management X Tourist Development X Veterans Services X Water & Sewer X X *Elder Services X *Public Transit X *PAWS X *Non-county departments OPTIONS: Provided as an informational update to the Board. RECOMMENDATIONS: Provide direction to staff as desired. RECOMMENDED BY: APPROVED BY: John Hofstad, Interim County Administrator