Audit Plan Update. Percentage of Total Budgeted Hours. Adjusted Budgeted Hours. Actual YTD

Transcription

1 AUDIT COMMITTEE UPDATE SEPTEMBER 24, 2014 EXECUTIVE SUMMARY Office f the Internal Auditr Update Since the last Audit Cmmittee meeting, the OIA has fcused n finalizing the executin f the 2014 Audit Plan. Audit Plan Executin OIA prvided an update n key activities cmpleted since the last reprting perid including 2014 audit plan executin and departmental activities. The update als included a review f the 2014 Q3 OIA Dashbard as f September 1. Audit Plan Update Type Original Budget Hurs Adjusted Budgeted Hurs Percentage f Ttal Budgeted Hurs Actual YTD Percentage f Ttal Actual Hurs 2014 Audit Plan Direct Audit Activity 9,650 9,650 46% 7,089 51% 2013 Carry Over 3 Frensic Audit Activity 2,659 2,659 13% 1,387 10% Investigatins % 826 6% External Audit Supprt % 3 0% Client Assistance % 200 1% Cntinuus Auditing 1,180 1,180 6% 288 2% Prfessinal Develpment** % 786 6% Planned 28 Audits & MAS (Unplanned) Cnsulting (Unplanned) Investigatins (Unplanned) Audits & MAS (Cmpleted) Cnsulting (Cmpleted) Investigatins (Cmpleted) General Administratin* 4,100 4,100 19% 3,446 25% Draft Issued 1 TOTAL 21,040 21, % 14, % In Prgress 12 OIA Perfrmance Actual Target *** Cautin Urgent Deferred/Canceled/ Cmbined 10 OIA Prductivity Percentage 70% 70-75% 60-70% < 60% Ttal Remaining 4 * Des nt include travel and sick time. ** Prfessinal Develpment includes 80 hurs f cre training fr the Auditrs n an annual basis. *** Based n Institute f the Internal Auditrs recmmended prductivity ratis (average f gvernment sectr and all ther sectrs) Prgress Against Plan as f September 1, % 26% 63% Cmpleted Draft Issued In Prgress T D 2% 1

2 The OIA presented fur audit and advisry reprts and cmpleted ne investigatin since the last Audit Cmmittee meeting. The OIA further cmpleted fur cnsulting engagements this perid fr which n frmal reprts were issued. CAT Readiness Testing Debt Cntract Perfrmance Cmpliance Premium Refunds IT Disaster Recvery Cre Prject Mnitring Status Update The fllwing represents shrt summaries f reprts and memrandums presented at the Audit Cmmittee meeting. Catastrphe Readiness Testing (Satisfactry) - The bjective f the audit was t bserve the 2014 Claims Catastrphe Exercises fr selected high-risk functins and deliver independent bservatins and recmmendatins t the management team. Based n the infrmatin btained frm bservatins, interviews, and the examinatin f plans, testing results and ther supprting dcumentatin, we determined that the catastrphe readiness testing fr 2014 was successful. Issues were thrughly discussed with management and apprpriate crrective actin agreed t. Debt Cntract Cmpliance (Satisfactry) - The bjective f this audit was t evaluate the effectiveness and adequacy f key business prcesses and cntrl functins and further t ensure cmpliance with related debt cntract cvenants. Our audit wrk cnfirmed that verall the Treasury & Investment Department has effective cntrls in place t adequately address debt cvenant cmpliance. A few minr bservatins were nted that management is practively addressing. Premium Refunds (Needs Imprvement) - The bjective f this audit was t evaluate whether key cntrls related t the refunding f premiums are efficient and effective and t ensure that refunds are accurate, authrized, timely and recrded apprpriately. Results frm the audit cnfirmed that key cntrls arund premium refunds are adequate and ensure that payments prcessed are accurate, authrized, and disbursed in a timely manner. In additin, we nted that management and staff members are very knwledgeable and embdy a strng culture f ethics and cntrl awareness. During the curse f ur audit, we identified specific areas requiring additinal attentin; these included the need t ensure adequate segregatin f system access rles between the initiating and payment prcess, the need t fix system errrs identified in the Service Desk User Prfiling System and the need t apply system access recertificatin prcedures. Management is currently addressing the issues identified during the audit. Disaster Recvery (Mem) - The bjective f the MAS review was t evaluate the adequacy and effectiveness f the prcesses and cntrls that cmprise disaster recvery planning, dcumentatin and test executin. With this review, we bserved the disaster recvery exercise t assess executin in accrdance with the disaster recvery plan (DRP) and hw it aligns with the defined business impact analyses and recvery bjectives and whether the DRP is adequate t successfully supprt the business in the event f a disaster. Overall, we nted that planning meetings and preparatins fr the exercise were cmprehensive and there was excellent cmmunicatin and teamwrk during the event. In ur feedback t management we nted ptential areas f imprvement, including a plan which will ensure annual testing f all relevant applicatins and systems, as well as enhancements and updates t cntent and supprting dcumentatin f the DRP. Management has prvided plans t address the bservatins nted in the review. 2

3 Cre Prject Mnitring Status Update (Mem) - Our primary reasn fr participating in the activities f the Cre prject is t prvide independent assurance and prgram supprt t cnfirm that the Cre prgram bjectives are being achieved. We further cnfirm that adequate prject management techniques and tls are used; issues arising are accurately identified and adequately escalated; and apprpriate cntrls are incrprated int the prcesses and systems when develped and implemented. Our audit wrk cnfirmed that the Cre Prgram cntinues t have adequate gvernance prcesses, cntingency plans and cntrl structures in place t address the activities and challenges f such a significant prject undertaking. Investigatin reprt CPIC / CPIC : Field Adjuster Cnflict f Interest (unsubstantiated) - OIA cmpleted an investigatin fllwing an allegatin f a ptential cnflict f interest as the subject allegedly advised the insured t change the cause f lss f his prperty claim t btain cverage and recmmended a restratin firm t d the wrk. The results frm ur investigatin did nt identify r substantiate any instances f a cnflict f interest r lss manipulatin as alleged in the cmplaint. Based upn the evidence presented, we cncluded that the subject did nt recmmend a specific firm t the insured nr did it appear that he advised the insured t change the cause f lss. The apparent miscmmunicatin regarding the reasn fr denial and cverage explanatin given by the subject appears t be the reasn fr the cause f lss change and misunderstanding between what the subject said and what the insured understd. Wrk In Prcess OIA cnfirmed that it had twelve Audit/MAS prjects in prgress: Cmmercial Underwriting Cmmercial Claims Scial Media Key Accunts Netwrk Assessment Cre Suite Prject IT Service Desk/Prblem Management Claims Billing and Payment (Frensic) Citizens Internal Cntrl Framewrk Prcurement Mnitring (Office Space) GIS Prject Clearing Huse Staffing, Develpment and Training The Chief f Internal Audit presented that since ur previus reprt, the department develped three Senir Auditr vacancies fllwing either internal staff transfer r a resignatin. Our Senir Auditr, based in Tallahassee, Cam Atwell, has jined the Accunting department as Citizens Financial Reprting Manager. At this time, we are recruiting t fill ne f the vacant psitins, in Jacksnville, and are hlding back n filling the ther tw psitins until we finalize the 2015 audit plan and staffing needs assessment. OIA is dedicated t the prfessinal develpment f its staff t ensure cntinuus grwth f knwledge, skills and ther cmpetencies thrughut the year. Fr this purpse, each audit staff member develped an Individual Develpment Plan (IDP), which prvides fcused guidance twards persnal grwth thrugh targeted training. Achievement f individual training needs is peridically reviewed and staff are encuraged t take advantage f available training pprtunities. 3

4 OIA Administratin OIA is cntinuusly refining its audit prcesses and prcedures (standards) in rder t ensure that its wrk prduct aligns t acceptable audit practice and it remains a credible and sustainable internal audit functin fr Citizens. These standards are used t deliver audit engagements efficiently, effectively and in accrdance with prfessinal standards. Our engagement standards align with The Institute f Internal Auditrs (The IIA s) Internatinal Prfessinal Practices Framewrk (IPPF). In rder t test ur alignment with these standards, and in cmpliance with the IIA s IPPF, the OIA cntracted with CliftnLarsnAllen LLP (CLA) an external service prvider specializing in Quality Assurance Reviews (QAR), t cmplete a QAR and Leading Practices Review f OIA activity Quality Assurance Review (QAR) & Leading Practices Review (LPR) CLA cmpleted the QAR and LPR reviews earlier this mnth and presented their findings t The Chief f Internal Audit fr review and cmment. (a cpy f the reprt is included in the material) Quality Assessment Review - The scpe f the QAR cmprised f a review f the IA Activity s risk assessment and audit planning prcesses, audit tls and methdlgies, engagement and staff management prcesses and a representative sample f the IA Activity s wrkpapers and reprts. The scpe als cnsisted f ten interviews with members f Senir and Executive Management, the Audit Cmmittee Chairpersn and 2 fcus grup sessins: ne with members f OIA Management and a separate meeting with Staff. Results frm the review were very psitive with CLA cncluding that the OIA Activity is in general cnfrmance with the Standards, which is the tp rating that can be assigned in a QAR. Specifically, CLA nted specific strengths as well as areas f imprvement. Strengths: Cnfrmance t the Standards Strng Leadership Cllabrative Relatinships Risk-Fcused Apprach Experienced and Knwledgeable Staff Opprtunities fr imprvement: Mre Practive Apprach Cmmunicatin f Cnsulting Engagement Results Cntinuus Mnitring Fcus n Plicy Cmpliance Industry Knwledge In the OIA s respnse, we agreed with CLA s findings and presented actin plans t address. (a cpy f the letter is included in the material) Leading Practices Review - The scpe f the LPR cnsisted f a cmparisn f the OIA s current practices t knwn leading practices and the IIA Standards t determine alignment. This review cmprised three distinct areas including Peple, Rules and 4

5 Tls. The assessment cnclusins were either that the OIA met the leading practice and/r IIA Standard, r included recmmendatins fr imprvement. Fr leading practices assciated with peple (Leading practices and IIA Standards that address persnnel within the IA Activity) CLA assessed that the OIA met 10 f the 11 attributes and recmmended that the OIA: Develp a successin plan fr the Chief f Internal Audit psitin and create a staffing strategy that cnsists f cre cmpetencies linked t the strategic needs f the Organizatin. Fr leading practices assciated with rules (Leading practices and the IIA Standards that address the gverning dcumentatin, such as the internal audit plicy, charter, risk assessment and audit plan) CLA assessed that the OIA met 15 f the 17 attributes and recmmended that the OIA enhance: Existing metrics t include knwn IA Activity leading metrics; and Its quality assurance and imprvement prgram t frmalize its assessment f cnfrmance with the IA Activity Charter, the Standards, Definitin f Internal Auditing, the Cde f Ethics, and the efficiency and effectiveness f the IA Activity in meeting the needs f the Organizatin s stakehlders. Fr leading practices assciated with tls (Leading practices and the IIA Standards that address hw the IA Activity executes its audit plan) CLA assessed that the OIA met 23 f the 28 attributes and recmmended that the OIA: Dcument a lnger-term strategic plan. Currently, the IA Activity has a strategic plan; hwever, it is fr the current year nly. Imprve prject mnitring and track each audit by planning, fieldwrk, review, reprting, and fllw-up and mnitr any trends t determine efficiency f the internal audit prcess. Clarify hw the results f cnsulting engagements are cllated and reprted in the Terms f Engagement letter used by the IA Activity t cmmunicate the scpe f its engagements. Integrate cntinuus mnitring int its audit prcesses and leverage the results within its risk assessment and internal audit prcesses. Enhance its internal assessments t include reprting the results f its custmer surveys, cmpliance with the IA Activity s plicy, prcedures and perfrmance metrics t the Audit Cmmittee and t Management at least annually. The OIA fund the results frm the leading practice assessment very psitive and agreed that it culd, with minr enhancements t current prcesses, meet all 56 leading practice requirements. Cntrl Deficiency Reslutin As f August 31, 2014, there are fifteen pen audit items. It is ntewrthy t mentin that pen issues trended dwn since year-end 2012 and have flattened ver the past few quarters. Overall, pen items generally receive adequate business fcus and implementatin f agreed crrective actin is managed well. Of the issues remaining pen, there are tw high-risk rated items, bth frm the Claims Legal Bill audit cmpleted in June: 5

6 1. The Legal Billing System Reprts (High 2014) Acuity des nt currently prvide regular standard reprting capabilities t Citizens and nly a limited number f prductin reprts are available fr use upn request. Citizens shuld have the capability f generating in-huse reprts. Status: During August 2014, Citizens develped and released an in-huse Cgns tl that prvides ability t mnitr matter-specific budgets, firm billing (dwn t line item level) and vendr billing and is under evaluatin by Management. Implementatin f Acuity Ad Hc reprting is tentatively scheduled fr the end f Sept Overbilling Fllw-up and Recver (High 2014) Out f 70 firms and 1,234 attrneys that prvided services during the audit perid, the audit fcused n fur attrneys in three firms that is cncluded were billing inapprpriately. Status: Fllwing receipt f the audit result Citizens tk immediate actin by terminating the agreements with the three firms and suspending nine additinal firm agreements. In June 25 th BOG a written cmplaint was presented t the Flrida Bar, regarding the fur attrneys cnduct. The Bar respnded t the cmplaint n August 20 th and requested the attrneys t reply t the cmplaint by September 8 th. On June 20 th, three firm agreements were terminated. Recvery f all vercharges nted during the cntract perid is being pursued. On June 20 th, nine additinal firms were suspended. The firms were requested t assess their internal prcedures and address prcedural deficiencies befre reinstatement will be cnsidered. Fr six f the nine firms we fund their assessments t be thrugh and internal actin taken sincere. The six firms were reinstated with the prvisin that all vercharges (made in errr) be agreed and refunded within 30 days f reinstatement. Fr three f the nine firms the suspensin remains in place and further analysis f their billing practices are in prgress. Recvery f all vercharges nted will be pursued. Tw issues are currently past their target cmpletin date: the implementatin f data security prtectin mechanisms that are based n the risk and sensitivity f certain data elements; and the need t create a cmprehensive telecmmuting strategy and supprting plicies and prcedures t prvide cnsistent enterprise authritative guidance. We expect all pen issues will be fully remediated. 6

7 Chief Financial Officer Update Chief Financial Officer, Ms. Mnter presented the 6/30/2014 Unaudited Financial Statements, Quarterly Financial Analysis, and a summary f the Sinkhle results. External Audit Update Jhnsn Lambert presented a GASB 65 update. Enterprise Risk Management Update The Chief Risk Officer, Mr. Rllins, presented an update n ERM activities. Ethics & Cmpliance Officer UPDATE Ms. Kearney the Ethics and Cmpliance Officer prvided an update n Tell Citizens and Cmpliance. 7