Ad Hoc Audit Committee

AGENDA Ad Hoc Audit Committee October 28, 2024 at 4:00 PM Lansing City Hall, City Council Conference Room 124 W. Michigan Avenue, 10th Floor To provide input or ask questions on any item that is listed on the agenda, members of the public may contact the City Council at city.council@lansingmi.gov or (517) 483-4177 prior to the meeting. To participate in public comment and view the meeting live: https://www.lansingmi.gov/1212/Council-Committee-Meetings Councilmember Peter Spadafore, Chairperson Councilmember Tamera Carter, Vice Chairperson Councilmember Trini Pehlivanoglu, Member 1. Call to Order 2. Roll Call 3. Minutes A. October 7, 2024 4. Public Comment on Agenda Items (Up to 3 Minutes) 5. Discussion/Action: B. DISCUSSION - Annual Audit Plan as Proposed by Internal Auditor C. DISCUSSION - Internal Auditor Audit Schedule 6. Other 7. Adjourn Persons with disabilities who need an accommodation to fully participate in these meetings should contact the City Council Office at 517-483-4177 (TTY 711) 24 hour notice may be needed for certain accommodations. An attempt will be made to grant all reasonable accommodation requests. Page 1 of 13  DRAFT MINUTES Ad Hoc Audit Committee Monday, October 7, 2024 @ 3:00 p.m. City Council Conference Room CALL TO ORDER Council Member Spadafore called the meeting to order at 3:00 p.m. PRESENT Council Member Peter Spadafore, Chair Council Member Tamera Carter, Vice Chair Council Member Trini Pehlivanoglu, Member OTHERS PRESENT Sherrie Boak, Council Office Manager Charles Randall, Internal Auditor Greg Venker, OCA Lisa Hagen- Lawrence, OCA Public Comment No public comment at this time. Discussion/Action: Council Member Spadafore acknowledged the Committee and the experiences they will bring to the Ad Hoc. DISCUSSION – Committee Charge Council Member Spadafore noted this will be for the auditor to provide oversight to the Council and also to evaluate if this should be a standing Committee. There needs to be an annual audit plan by December 16, 2024, so there should be a brief housekeeping then work towards that goal. DISCUSSION – Internal Auditor Duties The Charter speaks to the Internal Auditor, and the only position the Council is required to hire. The Charter lists 9 duties of power, and he read them to the group 3-402 Powers and duties of Internal Auditor. This Committee role is to help set an audit schedule and see course of action. This would be to take the information and suggest policy changes if needed. There has been a change to allow the Internal Auditor have access, but there has been issue with annual audits, so this Committee can look into that. Regarding .4, it was not done at the end of the fiscal year, but it should be as item 1 on the list. Mr. Randall noted that the external audit has not been completed yet so it might not be done immediately. It was confirmed that should be discussed for a timeline. Regarding .6 will be addressed as soon as other items are accomplished. Page 2 of 13  DRAFT Regarding .9, regarding the budget of the Internal Auditor it might need to be looked into, and if work is not able to be done on an annul basis this would address that. DISCUSSION – Review of Previous Work of Audit Committee Council Member Spadafore referred to the detailed audit plan from former auditor Eric Brewer, looking at where there were risks and something for the Committee to evaluate. Page 13 of the packet outlines risk of irregularities. It is not a suggestion to go through all of it, but for the files and public record. OTHER Mr. Randall spoke on the work in the packet, noting the review was a good background, and they should be aware that it identifies all the auditable units. Part of that he can break down and get a scope how large and small they are, what different risks are between them, and different criteria of each agency. Page 19 brings it together on where to focus on, which ones are high risk. Mr. Randall noted he had the same methodology; interview people to see what they think are high risk. Depending on defining what is an agency, but to look at each agency at a minimum level so they are aware he is looking at everyone. As far as his budget, different memberships he would want could total $1,000 let alone continued education certifications. Council Member Spadafore asked to set a schedule when to meet. He proposed once a month before Committee of the Whole, 4th Monday October 28th at 4 pm; November 18th at 4 pm; December 9th at 4 pm, then regroup for 2025. Council Member Spadafore asked Mr. Randall to look at the packet items and put together a schedule for the Ad Hoc for their three set meetings; audit all departments, external audit, Capital Improvement Plan. In addition, the internal auditor would have meetings with others in the organization that might also bring up other things that come across the desk of the audit. Mr. Randall noted there is a normal review of the budget as well. Council Member Spadafore acknowledged that historically the auditor works with Council for their budget, and then during the budget season the auditor works with Council to delve deeper into the budget during the budget season. There will be a learning period over the next 6 months. ADJOURN Adjourned at 3:20 p.m. Submitted by, Sherrie Boak, Recording Secretary, Lansing City Council Approved by the Committee on Page 3 of 13  CITY OF LANSING INTERNAL AUDITOR 124 W MICHIGAN AVE FL 10 LANSING MI 48933-1605 (517) 483-4159 Fax (517) 483-7630 INTERNAL AUDIT – Crash Course Why is there Internal Audit? City Charter 401.1 - Staffed by qualified person. 401.2 - Organizationally independent. 402 – Powers & Duties: .1 Evaluate planning and budgeting. .2 Audit financial transactions. Allowed Access to Records .3 Reports Independently following items to City Council, Mayor, City Clerk (a) Testing criteria - Examine finance items. Assess compliance with laws regulations (b) Process Efficiency - Use of resources (c) Meeting management expectations .4 Report annual analysis of financial position to public record .5 Report review of effective administration and performance of agencies to City Council, Mayor, City Clerk .6 Report any irregularities or errors to City Council & Mayor, Mayor respond w/n 30 days w/ action plan .7 Evaluate Capital Improvement Plan .8 Not audit BWL .9 Have adequate resources to perform audits 403 - Independent in fact 404 - External audit report on internal audit activities / spending – not exempt from external audit. Internal Audit Association (IIA) – Purpose Statement Internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. Internal auditing is most effective when: • It is performed by competent professionals… • The internal audit function is independently positioned with direct accountability to the board. • Internal auditors are free from undue influence and committed to making objective assessments. Internal audit functions in the public sector are often required to focus on: • Compliance with laws and/or regulations. • Improve the efficiency, effectiveness, and economy of government processes and programs. • Determining whether public resources are adequately safeguarded and used appropriately… Page 4 of 13 • Assessing whether an organization’s performance aligns with its strategic objectives and goals Page 5 of 13  What is the Ad-Hoc Audit Committee’s role? City Resolution Provide guidance and oversight to internal auditor as they: Perform responsibilities Create and review audit plans Evaluate financial position of the City Make recommendation to implement permanent Audit Committee Report Annual audit plan & status of previous audit findings by December 16, 2024 Internal Audit Association (IIA) – Committee Charter Provides independent oversight of organization’s governance, risk management and internal control practices. Where does all this fit into an organization? Organizations are generally comprised of a governing body and an executive / management body. Here, City Council is the governing body while Mayor’s Office is executive / management body. The governing body ensures structures and processes are in place for accountability of organization objectives to stakeholders (citizens) and enable actions by management to achieve these organizational objectives. Colloquially, governing bodies should keep their “noses in, fingers out”. Management achieves organizational objectives by using a risk-based decision-making approach in the application of resources. Management has two roles to achieve these objectives: 1) direct delivery of products and/or services to clients and, 2) active management of risk. Each role group has internal controls to mitigate the occurrence of risks. Internal audit adds a third role to the organization through independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. The term ‘risk’ is generally described as the possibility of something bad happening. Consider that some bad things are worse than other bad things. Also consider that regardless of what is done to prevent or detect (control) this bad thing from happening, it still might occur. And just in case, if it’s a really bad thing, then the effect of it occurring might be minimize or mitigated. An example is house insurance. Preventative building standards (controls) are set and inspectors verify (audit) their implementation. Homeowners install fire alarms (controls) to detect fires. The fire department will try to contain the fire (mitigate). But loss can be offset (mitigated) by insurance. These roles are traditionally defined as ‘lines’. However, they are not intended to denote structural elements of the organization but a useful differentiation of roles. Here is a visual representation from IIA. Page 6 of 13 Page 7 of 13  How does this Internal Audit happen? What do they do? Auditing provides independent, risk-based, and objective assurance, advice, insight, and foresight. This is done through a process that aligns audit project objective(s) with the work performed that supports meaningful reports….the audit process. The testing or auditing methodology are based upon the objective of the audit. • Internal controls testing evaluates effectiveness of risk management. • Substantive procedures test defined objectives (compliance with laws and regulations, detect material misstatement of a reported number). Page 8 of 13  CITY OF LANSING INTERNAL AUDITOR 124 W MICHIGAN AVE FL 10 LANSING MI 48933-1605 (517) 483-4159 Fax (517) 483-7630 2024 / 2025 - INTERNAL AUDIT PLAN - DRAFT 1) Prescribed Internal Auditor Activities a. Evaluate Planning and Budgeting (3-402.1) – Priorities, department budget review, CIP budget review, carryforward requests, adoption resolution. Ways & Means resolutions. b. Evaluate Capital Improvement Plan (3-402.7) – Project management, reporting and monitoring controls. c. Analysis of Financial Condition (3-402.4) i. Annual Comprehensive Finance Report (ACFR) ii. Long-term debt binder iii. BWL annual financial report 2) Position Inherent Activities a. Council department budget proposal & spend status b. Claims review committee – Member c. LEPFA Board - Member Page 1 of 3 October 24, 2024 Page 9 of 13 3) Planned Audit Activities (3-402.2 & .3) a. Internal Control audits of processes, procedures and documentation with a focus on prior audit findings, key activity controls and management monitoring controls. i. Processes: Expense / Disbursements focus while learning new accounting system 1. Payroll – Examination of recurring payroll transactions (hourly and salary) and consideration for prior audit findings. 2. Purchase To Pay – Examination of on-going invoice processing. 3. Expense Report – Review of on-going expense report processing. ii. Scope: Determined based upon standardization of internal controls / sub-processes. 1. If timesheets are both paper and electronic; then sampling and testing of each population is done separately as they are different sub-processes. 2. Department / auditable unit agnostic. A department / group with more transactions has a statistically higher chance of having a sample tested, but samples will not have a pro-rata type allocation. E.g. 100 total: 10 for Department X, 25 for Department Y, 65 for Department Z. iii. Timeline: Monthly sampling to begin when audit plan is approved and continue until new audit plan is approved. iv. Reporting: Monthly status reporting with updating of samples tested, errors / irregularities found and sampling plans for subsequent month. Final summary report to be submitted the month before new audit plan is submitted. b. Monitor material changes to people, processes and systems, or material activities. (3-401.5) i. BS&A Implementation for Finance / Accounting – Project management, key application controls (access segregation of duties, power users / administration accounts), and reporting. ii. External audit (3-401.3(a) & .6) – Opening and reporting meeting with council member. Page 2 of 3 October 24, 2024 Page 10 of 13  c. Monitoring of audit issue remediation in accordance with management corrective action plan. FYE 2022 and 2023 external auditor findings. (3-401.3(a) & .5 & .6) i. Internal controls of financial reporting 1. Material weakness regarding the untimely recording of year-end close journal entries. Condition Criteria Multiple material journal entries were needed after Closing of the books follow prescribed procedures year-end close and during the external audit, (checklist) to ensure expected AJE topics are resulting in revised trial balances and financial analyzed and recorded. Procedures include timing statements. and data requirements to enable management of reconciliations and entries. 2. Significant deficiency in the processing of payroll. Condition Criteria Payroll isn't approved at the department level prior Department level payroll review before to disbursement. disbursement. Detect unusual, fraudulent or expected changes in transactions. ii. Compliance with laws and regulations Expenditures exceeding approved budgets (Public Act 621 of 1978, as amend) Condition Criteria Expenditures exceeded approved budget for areas When overage becomes apparent, budget must be of General Fund and certain Special Revenue Funds. amended to approve additional appropriations. 4) Ad-Hoc Activities Respond to council requests through ad-hoc committee. Page 3 of 3 October 24, 2024 Page 11 of 13 Page 12 of 13 Page 13 of 13