Internal Audit. Orange County Auditor-Controller QUARTERLY INTERNAL AUDIT ACTIVITY STATUS REPORT: JANUARY THROUGH MARCH Project Number

Transcription

1 Attachment A Orange County Auditor-Controller Internal Audit QUARTERLY INTERNAL AUDIT ACTIVITY STATUS REPORT: JANUARY THROUGH MARCH 2017 Project Number Board Date: May 9, 2017

2 Board Date: May 9, 2017 Attachment A, Page 2 of 15 O R A N G E C O U N T Y AUDITOR CONTROLLER I N T E R N A L A U D I T Eric H. Woolery, CPA Orange County Auditor Controller Assistance in assembling this report provided by: Toni Smart, CPA Scott Suzuki, CPA, CIA, CISA Nancy Ishida, CPA, CIA, CISA Carol Swe, CPA, CIA, CISA Betty Stallworth, MBA, CISA, CRISC Director, Internal Audit Assistant Director Senior Audit Manager III Senior Audit Manager II Senior IT Audit Manager III 12 Civic Center Plaza, Room 200 Santa Ana, CA Auditor Controller Web Site

3 ERIC H. WOOLERY, CPA AUDITOR-CONTROLLER May 9, 2017 Project No TO: Honorable Board of Supervisors SUBJECT: Quarterly Internal Audit Activity Status Report for Third Quarter FY It is my pleasure to submit to you the Quarterly Internal Audit Activity Status Report for the third quarter of FY For each internal audit report, we provide an overview and a detailed briefing for your review. I am available at your convenience to discuss any of these items. Respectfully Submitted, Toni Smart, CPA, Director Auditor-Controller Internal Audit Division Board Date: May 9, 2017 Attachment A, Page 3 of 15

4 QUARTERLY INTERNAL AUDIT ACTIVITY STATUS REPORT Audit Projects: Executive Summary B. OCCR/OC Parks Vintage Marina Partners, LP for the Period April 1, 2015 through March 31, We completed a Revenue Generating Operating Agreement audit of the agreement (Agreement) between the County of Orange and Vintage Marina Partners, LP (Vintage Marina) for the period April 1, 2015 through March 31, We identified three (3) Significant Control Weaknesses regarding the reporting of gross receipts, other financial requirements, and oversight and management of Vintage Marina. We also identified 11 Control Findings concerning controls over gross receipts, records supporting operating expenses, and other provisions of the Agreement. C. Report on Review of the Schedule of Assets Held by the County Treasury as of September 30, We reviewed the Schedule of Assets Held by the County Treasury as of September 30, Based on our review, we are not aware of any material modifications that should be made to the financial schedule in order for it to be in accordance with the modified cash-basis of accounting. D. Compliance Monitoring of the Treasurer s Investment Portfolio for the Quarter Ended December 31, At the request of the Treasury Oversight Committee, we performed the Continuous Compliance Monitoring of the Treasurer s Investment Portfolio for the quarter ended December 31, 2016 to determine whether the Office of the Treasurer-Tax Collector complied with specified provisions of the Investment Policy Statement (IPS). No compliance deficiencies were identified. E. Audit of Unearned Revenue: Health Care Agency. We completed an audit of internal controls over the recording of unearned revenue by the Health Care Agency (HCA) for the year ended June 30, There were no findings in this report. F. Audit of Unearned Revenue: Social Services Agency. We completed an audit of internal controls over the recording of unearned revenue by the Social Services Agency (SSA) for the year ended June 30, There were no findings in this report. G. Audit of Unearned Revenue: OC Public Works. We completed an audit of internal controls over the recording of unearned revenue by OC Public Works (OCPW) for the year ended June 30, There were no findings in this report. H. First Follow-Up Countywide Audit of Fiduciary Funds: Clerk-Recorder. We completed a First Follow-Up Countywide Audit of Fiduciary Funds: Clerk-Recorder. Our audit was limited to reviewing actions taken as of October 31, 2016, to implement the four (4) recommendations from our original audit dated April 21, Our first follow-up audit found that the Clerk-Recorder implemented three (3) recommendations and is in the process of implementing the remaining recommendation from the original audit. I. First and Final Close-Out Follow-Up Countywide Audit of Fiduciary Funds: Health Care Agency/Public Guardian. We completed a First and Final Close-Out Follow-Up Countywide Audit of Fiduciary Funds: Health Care Agency/Public Guardian. Our audit was limited to reviewing actions taken as of February 28, 2017, to implement the two (2) recommendations from our original audit dated May 6, Our first follow-up audit found that the Health Care Agency/Public Guardian implemented the two (2) recommendations from the original audit. Board Date: May 9, 2017 Attachment A, Page 4 of 15

5 J. First and Final Close-Out Follow-Up Revenue Generating Lease Audit: JWA/The Asfour Family Corporation dba Subway. We completed a First and Final Close-Out Follow-Up Audit of Revenue Generating Lease Audit: John Wayne Airport Asfour Family Corporation dba Subway. Our audit was limited to reviewing actions taken as of November 10, 2016, to implement two (2) recommendations from our original audit dated April 29, Our first follow-up audit found that John Wayne Airport implemented the two (2) recommendations from the original audit. Board Date: May 9, 2017 Attachment A, Page 5 of 15

6 New Audit Findings & Recommendations by Risk Category Description Critical Control Weaknesses These are audit findings or a combination of audit findings that represent critical exceptions to the audit objective(s) and/or business goals. Management is expected to address Critical Control Weaknesses brought to their attention immediately. No Critical Control Weaknesses issued during January through March No Material Weaknesses issued during January through March Three (3) Audit Recommendations issued for FY Material Weaknesses is the terminology used for critical control weaknesses identified in audits conducted under AICPA Attestation Standards. Significant Control Weaknesses These are audit findings or a combination of audit findings that represent a significant deficiency in the design or operation of internal controls. Significant Control Weaknesses generally will require prompt corrective actions. Three (3) Significant Control Weaknesses issued during January through March Ten (10) Audit Recommendations issued for FY Control Findings These are audit findings concerning internal controls, compliance issues, or efficiency/effectiveness issues that require management s corrective action to implement or enhance processes and internal controls. Control Findings are expected to be addressed within our followup process of six months, but no later than twelve months. Eleven (11) Control Findings/Efficiency & Effectiveness Findings issued during January through March Audit Recommendations issued for FY Total Audit Recommendations for FY : 54 Board Date: May 9, 2017 Attachment A, Page 6 of 15

7 Description B. DEPT: OC Community Resources TITLE: Revenue Generating Operating Agreement Audit: OC Community Resources/OC Parks Vintage Marina Partners, LP HA78H AUDIT NO: 1531 ISSUED: March 2, 2017 Scope: We performed a Revenue Generating Operating Agreement Audit of the agreement (Agreement) between the County of Orange (County) and Vintage Marina Partners, LP (Vintage Marina), for the period April 1, 2015 through March 31, 2016, for the operation and management of facilities and services located in six (6) parcels and the Federal Anchorage Area of the Dana Point Marina. Our objectives were to determine whether Vintage Marina s records adequately supported the gross receipts reported to the County as well as the reimbursed monthly operating expenses, and whether Vintage Marina complied with certain provisions of the Agreement. Conclusion: Our audit found that Vintage Marina s records, in general, adequately supported reported gross receipts and operating expenses, and Vintage Marina complied with certain financial and other provisions of the agreement. We identified three (3) Significant Control Weaknesses and 11 Control Findings. Background: The County of Orange and Vintage Marina entered into a 20-year operating agreement on February 6, 2001 to manage and operate certain facilities and services located in Dana Point Harbor within the City of Dana Point. During the 12-month audit period ended March 31, 2016, Vintage Marina reported approximately $42.1 million in gross receipts and remitted to the County approximately $6 million in rent. The County reimbursed Vintage Marina for operating expenses of approximately $2.2 million and paid Vintage Marina a management fee of $1.3 million. Recommendations: We recommended that: Roles and responsibilities be defined for the oversight and management of Vintage Marina, tenants gross receipts be validated and reconciled, an annual tenant audit plan be developed and approved, rent payments be accurately calculated, personal property inventories be performed, dry boat storage security deposits be reconciled, audited financial statements be submitted timely, internal controls over the annual operating budget process be strengthened, OCCR/OC Parks consult with County Counsel on whether parent company administrative fees are allowed, controls over cash receipts be improved, policies and procedures for the procurement of goods be established, Vintage Marina use serially pre-numbered documents for temporary dry storage, Vintage Marina require tenant to use approved cashiering devices, tenants provide receipts to customers, and lease agreements be properly executed. Board Date: May 9, 2017 Attachment A, Page 7 of 15

8 Description C. DEPT: Treasurer-Tax Collector TITLE: Report on Review of the Schedule of Assets Held by the County Treasury as of September 30, 2016 AUDIT NO: 1612 ISSUED: February 24, 2017 Scope: We reviewed the Schedule of Assets Held by the County Treasury as of September 30, All information included in this financial schedule is the representation of the management of the Office of the Treasurer-Tax Collector. The Schedule of Assets was prepared by the Treasurer to meet the requirements of Government Code Section 26920(a) and was prepared on the modified cash basis of accounting, which is a basis of accounting other than accounting principles generally accepted in the United States of America. Accordingly, receipts are recognized when received by the Treasurer; disbursements are recognized when paid by the bank; and the value of investments is stated at fair value. Conclusion: Based on our review, we are not aware of any material modifications that should be made to the financial schedule referred to above in order for it to be in accordance with the modified cash-basis of accounting. Background: We conducted our review in accordance with Statements on Standards for Accounting and Review Services (SSARS) promulgated by the Accounting and Review Services Committee of the AICPA (American Institute of Certified Public Accountants). A review is substantially less in scope than an audit, the objective of which is the expression of an opinion regarding the financial schedule as a whole and, accordingly, we do not express such an opinion. A review consists primarily of applying analytical procedures to management s financial data and making inquiries of department management. The Treasurer prepared a schedule showing the amount and type of assets held in the County Treasury as of September 30, Our review included counting cash in the County Treasury and confirming cash and investments held on behalf of the Office of the Treasurer-Tax Collector. Total assets (cash and investments) reported as of September 30, 2016 totaled $7.6 billion. Recommendations: None. Board Date: May 9, 2017 Attachment A, Page 8 of 15

9 Description D. DEPT: Treasurer-Tax Collector TITLE: Compliance Monitoring of the Treasurer s Investment Portfolio for the Quarter Ended December 31, 2016 AUDIT NO: 1616 ISSUED: March 13, 2017 Scope: We completed the Compliance Monitoring of the Treasurer s Investment Portfolio for the quarter ended December 31, The purpose of our engagement was to determine whether the Office of the Treasurer-Tax Collector complied with specified provisions of the Investment Policy Statement (IPS). Conclusion: Based on our compliance monitoring for the selected dates, no compliance deficiencies were identified. Background: We conduct our Compliance Monitoring of the Treasurer s Investment Portfolio at the request of the Treasury Oversight Committee. This engagement is intended to provide assurance to the Board of Supervisors, the County Executive Officer, Treasury Oversight Committee, and other stakeholders that the Treasurer s investment portfolio complies with specific provisions of the IPS and that non-compliance deficiencies or technical incidents and required disclosures are properly reported. Our procedures included selecting five business days per month for validating whether investment purchases complied with the IPS by reviewing and testing supporting documentation. Recommendations: None. Board Date: May 9, 2017 Attachment A, Page 9 of 15

10 Description E. DEPT: Health Care Agency TITLE: Audit of Unearned Revenue: Health Care Agency AUDIT NO: 1619-A ISSUED: March 31, 2017 Scope: Our audit was for the year ended June 30, 2016 and included the following objectives: (1) evaluate if internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assist the external auditor with its evaluation of unearned revenue; and (3) determine if the County s procedures for recording unearned revenue are efficient and effective, e.g., no backlogs, duplication of work, or manual processes that could benefit from automation. Conclusion: Our audit: (1) found internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assisted the external auditor with its evaluation of unearned revenue; and (3) did not disclose any instances concerning backlogs, duplication of work, or manual processes needing automation. Accordingly, there were no findings. Background: A basis of accounting for governmental funds exists where revenue is recognized when amounts are measurable and available. Known as the modified accrual basis of accounting, receiving alone is not sufficient to recognize revenue (cash basis accounting) and revenue recognition can occur before amounts are actually received (accrual basis of accounting). Revenues received in advance of meeting all the earning requirements are a liability and require an entry to balance sheet account Unearned Revenue. It is a liability of resources obtained prior to revenue recognition. As of June 30, 2016, unearned revenue was $18,804,221. Recommendations: None. Board Date: May 9, 2017 Attachment A, Page 10 of 15

11 Description F. DEPT: Social Services Agency TITLE: Audit of Unearned Revenue: Social Services Agency AUDIT NO: 1619-C ISSUED: March 30, 2017 Scope: Our audit was for the year ended June 30, 2016 and included the following objectives: (1) evaluate if internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assist the external auditor with its evaluation of unearned revenue; and (3) determine if the County s procedures for recording unearned revenue are efficient and effective, e.g., no backlogs, duplication of work, or manual processes that could benefit from automation. Conclusion: Our audit: (1) found internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assisted the external auditor with its evaluation of unearned revenue; and (3) did not disclose any instances concerning backlogs, duplication of work, or manual processes needing automation. Accordingly, there were no findings. Background: A basis of accounting for governmental funds exists where revenue is recognized when amounts are measurable and available. Known as the modified accrual basis of accounting, receiving alone is not sufficient to recognize revenue (cash basis accounting) and revenue recognition can occur before amounts are actually received (accrual basis of accounting). Revenues received in advance of meeting all the earning requirements are a liability and require an entry to balance sheet account Unearned Revenue. It is a liability of resources obtained prior to revenue recognition. As of June 30, 2016, unearned revenue was $12,623,063. Recommendations: None. Board Date: May 9, 2017 Attachment A, Page 11 of 15

12 Description G. DEPT: OC Public Works TITLE: Audit of Unearned Revenue: OC Public Works AUDIT NO: 1619-D ISSUED: March 30, 2017 Scope: Our audit was for the year ended June 30, 2016 and included the following objectives: (1) evaluate if internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assist the external auditor with its evaluation of unearned revenue; and (3) determine if the County s procedures for recording unearned revenue are efficient and effective, e.g., no backlogs, duplication of work, or manual processes that could benefit from automation. Conclusion: Our audit: (1) found internal controls over recording of unearned revenue in the County s financial system are adequate to ensure transactions are complete, accurate, valid, and processed timely; (2) assisted the external auditor with its evaluation of unearned revenue; and (3) did not disclose any instances concerning backlogs, duplication of work, or manual processes needing automation. Accordingly, there were no findings. Background: A basis of accounting for governmental funds exists where revenue is recognized when amounts are measurable and available. Known as the modified accrual basis of accounting, receiving alone is not sufficient to recognize revenue (cash basis accounting) and revenue recognition can occur before amounts are actually received (accrual basis of accounting). Revenues received in advance of meeting all the earning requirements are a liability and require an entry to balance sheet account Unearned Revenue. It is a liability of resources obtained prior to revenue recognition. As of June 30, 2016, unearned revenue for OCPW was $14,783,395. Recommendations: None. Board Date: May 9, 2017 Attachment A, Page 12 of 15

13 H. DEPT: Clerk-Recorder TITLE: First Follow-Up Countywide Audit of Fiduciary Funds: Clerk- Recorder AUDIT NO: 1519-F1 (Reference 1634-F) ISSUED: March 14, 2017 Scope: Our audit was limited to reviewing actions taken, as of October 31, 2016, to implement the four (4) recommendations from our original audit dated April 21, Conclusion: Our first follow-up audit found that Clerk-Recorder (C-R) implemented three (3) recommendations and is in the process of implementing the remaining recommendation from the original audit. Background: We found that C-R had four fiduciary funds. Our audit of internal controls over the fiduciary funds administered by C-R was performed to ensure the fund was properly administered, safeguarded, and maintained in compliance with County policy, procedures, and specific fund requirements for the period from July 1, 2014 through June 30, Recommendations: Our recommendation that the C-R take measures to formally reconcile Fund 356 Refund Account to the General Ledger, including identifying and resolving the outstanding balance in compliance with County policy, remains open. Board Date: May 9, 2017 Attachment A, Page 13 of 15

14 I. DEPT: Health Care Agency/Public Guardian TITLE: First and Final Close-Out Follow-Up Countywide Audit of Fiduciary Funds: Health Care Agency/Public Guardian AUDIT NO: 1519-F1 (Reference 1634-H) ISSUED: March 22, 2017 Scope: Our audit was limited to reviewing actions taken, as of February 28, 2017, to implement the two (2) recommendations from our original audit dated May 6, Conclusion: Our first follow-up audit found that Health Care Agency/Public Guardian (HCA/PG) implemented the two (2) recommendations from the original audit. Background: We found that HCA/PG had six fiduciary funds. Our audit of internal controls over the fiduciary funds administered by HCA/PG was performed to ensure the fund was properly administered, safeguarded, and maintained in compliance with County policy, procedures, and specific fund requirements for the period from July 1, 2014 through June 30, Recommendations: Because the recommendations were implemented, this report represents the final close-out of the original audit. Board Date: May 9, 2017 Attachment A, Page 14 of 15

15 Description J. DEPT: John Wayne Airport TITLE: First and Final Close-Out Follow-Up Revenue Generating Lease Audit: John Wayne Airport Asfour Family Corporation dba Subway AUDIT NO: 1580-F1 (Reference 1642-H) ISSUED DATE: January 4, 2017 Scope: Our audit was limited to reviewing actions taken, as of November 10, 2016, to implement the two (2) recommendations from the original audit dated April 29, Conclusion: Our First Follow-Up Audit found that John Wayne Airport implemented the two (2) recommendations from the original audit. Background: The County of Orange (County) and Asfour Family Corporation dba Subway (Subway) have a five-year lease agreement for the operation of a Subway restaurant at John Wayne Airport. The original audit reviewed pertinent records and documents in order to determine whether Subway s records adequately supported its monthly gross receipts reported to the County and whether Subway complied with certain other financial provisions of the lease agreement. Recommendations: Because the two (2) recommendations were implemented, this report represents the final close-out of the original audit. Board Date: May 9, 2017 Attachment A, Page 15 of 15