FY 2026-2027 Audit Plan

Proposed Audit Plan
Fiscal Year 2026/2027
Mission
The City Auditor’s Office provides audit, consulting, and investigative services to identify and minimize risks,
maximize efficiencies, improve internal controls, and strengthen accountability to Mesa’s citizens.
Audit Plan Purpose and Considerations
The Audit Plan is a Council-approved document which outlines the planned activities of the City Auditor’s Office
for the year. Factors considered when selecting audits may include requests from the City Council or City
Manager, statutory mandates or volume of regulations, prior audit history, activities commonly susceptible to
fraud, complexity or significant changes in operations, impact and likelihood of potential adverse events.
The Audit Plan intentionally exceeds our capacity by approximately 20%, providing flexibility to adjust the timing
of a project to accommodate the needs of the client, while also managing our resources most efficiently.
Audits Planned for FY 2026/2027
Audit Subject Area Initial Objectives
*Water Resources – Annual Review the processes and procedures in place for the Water Resources
Ordering and Reporting Department’s annual water ordering and reporting process to ensure
compliance with applicable policies, statutes, and other requirements;
and identify any potential efficiencies with the ordering and reporting
process.
*Facilities Management – Work Evaluate the effectiveness of the work order management process. This
Order Process includes assessing the lifecycle of a work order from start to finish,
ensuring proper documentation, timely completion, and compliance
with City and department policies and procedures.
*Code Compliance – Case Determine whether effective controls are in place to ensure case
Management management activities are performed consistently in accordance with
applicable policies, statutes, ordinances, and other requirements.
Police Department – Towing Determine whether the Mesa Police Department has appropriate
Services controls in place to monitor the Towing Services contract and ensure
that vendors are complying with contract terms and meeting the City’s
performance expectations.
Information Technology Audit IT audit to be determined after completion of risk assessment noted
below.
* These audits were not completed during the previous audit period and will be carried forward to this year’s
audit plan.
FY 2025/2026 Work in Progress (as of 6/30/2026)
Audit Subject Area Objectives
Police Department – Mental Evaluate the internal controls of the Mental Health Support Team and
Health Support Team determine whether they are operating effectively in accordance with
applicable policies, statutes, and other requirements.
City Clerk – Public Records Evaluate the effectiveness of the public records request process
Request administered by the City Clerk’s Office to comply with applicable
policies, statutes, and other requirements.
Page 1 of 2

Proposed Audit Plan
Fiscal Year 2026/2027
Police Department – Off-Duty Determine whether internal controls over off-duty employment are in
Employment Program place and operating effectively to ensure compliance with applicable
policies and are adequate to monitor the program.
Citywide – Take Home Vehicles Determine whether effective controls are in place to ensure that
employee use of city-owned vehicles is done in accordance with
applicable policies, statutes, and other requirements.
Citywide – Special Pay Programs Determine whether effective controls are in place to ensure that special
pay programs are administered and approved in accordance with
applicable policies, statutes, and other requirements.
Engineering – ASU Facilities at Determine the City’s total cost incurred, and funding sources used, for
Mesa City Center Post- design, construction, and any related capital improvements for the
Construction Arizona State University Facilities as Mesa City Center.
Arts & Culture – Mesa Arts Determine whether effective controls are in place to ensure all due fees
Center Revenues and charges are accurately calculated, recorded, and collected. The
audit may also include other operational and contract performance
objectives.
Follow-up Reviews Due in FY 2026/2027
The objective of follow-up reviews is to ensure that corrective action plans that were agreed to in response to
the audit were implemented as agreed and effective in resolving the underlying audit findings. The following
follow-up reviews are due in FY 2026/2027:
• DoIT – Software/Application Asset Management (2nd Follow-up)
• DoIT – Cybersecurity
• Police Department – Criminal Investigations Case Management
• Transportation Department – Street Maintenance (2nd Follow-up)
• Human Resources – Hiring and Recruitment Practices
Other Activities
In addition to audits, the City Auditor also performs the following activities:
• Biennial Citywide Cash Handling Audits – Unannounced audits of cash handling sites throughout the
year. Report issued every two years.
• Annual Credit Card Security Review – Annual review of payment card acceptance sites for PCI DSS
compliance.
• Fraud & Ethics Hotline Investigations – Monitor the City’s Fraud & Ethics Hotline and conduct
investigations when necessary. Issues can be reported at speakupmesa.com or 1-866-820-7812.
• Consulting Services – Provide independent consulting/advisory services; internal control reviews: risk
analyses; financial statement reviews; etc. as needed.
• Unscheduled Audits – As directed by the City Council or City Manager, conduct unscheduled audits,
which may arise due to unforeseen circumstances.
• Information Technology Risk Assessment – The City Auditor’s Office will perform a Citywide IT risk
assessment to assess audit areas and prioritize IT audits.
Page 2 of 2