FY22 RISK ASSESSMENT REPORT-FINAL.PDF

RISK ASSESSMENT REPORT
Internal Audit Department
May 2021
Internal Audit Analyzes County
Risks to Prioritize Audit Work
Internal Audit defines risk as the possibility of an Perform Analyze Risk
& Prepare
event occurring that will have an adverse impact Follow Up Audit Plan
on the achievement of the County’s objectives.
County management is responsible for managing
Publish Board
risks by implementing strong business processes
Audit Approves
and internal controls. Internal Audit aids in the Reports Audit Plan
assessment of risks by analyzing the operating
environment and identifying conditions that may Conduct
impair the County’s ability to achieve its goals. Audit Work
Internal Audit performs audits to provide
reasonable assurance that the controls designed
to address risks are operating effectively.
This report describes the County’s risk environment and demonstrates how Internal Audit prioritizes
audit areas and develops an annual audit plan for approval by the County Board of Supervisors (Board).
The Board, as the County’s governing body, provides resources to implement and manage internal
controls that provide assurance that the Board’s strategic objectives will be met.
Risk Management is 2
Everyone’s Responsibility
Risks Influence the Audit 3
Plan
Audit Resources Influence 5
the Audit Plan
Fiscal Year 2022 Audit Plan 6
Graphic by macrovector – freepik.com

RISK MANAGEMENT IS EVERYONE’S RESPONSIBILITY
The Board and County leadership establish the direction of County operations through the
development of a four-year strategic plan as a road map for the future. Through the development of
strategic goals and performance measures, County leaders and managers are entrusted to execute the
plan. Risks that threaten the strategic plan can be difficult to manage due to Maricopa County’s
diverse physical, financial, and operational environment.
Roles of Risk Management
Effective risk management requires collaboration by several roles to identify, assess, and respond to
risk.
Managing Risk is an Enterprise-wide Responsibility
Management
Front line operating management that owns and
manages risks and controls
Includes: Department Management
Oversight Functions
Advisors that monitor risk in
support of management
Includes: Finance, Budget, Risk
Management, Procurement, etc.
Internal Audit
Independent
evaluator that
provides
assurance
to the
Board
Management is responsible for identifying, assessing, controlling, and monitoring risk on a day-to-
day basis. Without management support, employees may not be effective in controlling the risk they
encounter. In a perfect world, this would be the only role needed; however, in the real world, internal
controls do not operate perfectly.
Oversight functions such as finance, budget, risk management, procurement, information technology,
and human resources play an important role in managing risk. They are the advisors who monitor
countywide risk management practices. Some County agencies also have internal functions that serve
this purpose. These activities range from quality control reporting to inspecting and reconciling
County records.
2

Internal Audit has an oversight role in monitoring risk. Internal Audit provides reasonable assurance
on the effectiveness of governance, risk management, and internal controls, including the manner in
which the other roles achieve risk management and control objectives. Internal Audit reviews a small
number of County operations each year to ensure that management is identifying, assessing,
controlling, and monitoring risks. Internal Audit also serves as a resource to managers and supervisors
in identifying areas for improvement.
In addition to the roles discussed above, the County is subject to external reviews and audits from
various regulators and independent parties. All these parties leverage their efforts when evaluating
County operations to ensure the best use of County resources.
Ethics and Fraud
Risk management is further reinforced by fraud prevention efforts. Fraud is an act of intentional
deception to secure unfair or unlawful gain at the expense of an organization or individual. While
fraud risk cannot be eliminated, it can be mitigated through a strong ethical framework, effective
controls, and education. Awareness is fundamental to fraud mitigation, and is enhanced through
effective use of the following tools:
County Policies Training & Employee Internal Audit
Outlines appropriate and Orientation Evaluates County operations
ethical behavior Reinforces high expectations and issues recommendations
Addresses current issues for ethical behavior that may deter fraud
through regular updates Provides tools and resources
to County leadership
RISKS INFLUENCE THE AUDIT PLAN
Internal Audit uses a risk-based approach to develop its annual audit plan, as required by professional
audit standards.
Continuous Risk Assessment and Agile Auditing
Internal Audit continues to adapt our continuous risk assessment and agile audit practices to improve
our responsiveness to the ever-changing County environment. In addition to preparing an annual audit
plan, we also review process level risks for many agencies throughout the year to identify audit areas.
3

Internal Audit considers seven factors, in addition to auditor judgement, when determining overall risk
for each agency and countywide activity:
Factors that Influence Risk Level
Financial
Impact
Public
IT Risk Health and
Safety
Audit
Risk
Time Since Level Citizen
Last Audit Impact
New Leadership
Challenges Input
COVID-19
The County deploys strategies for managing risks related to the COVID-19 pandemic. The following
were considered during our analysis and will be incorporated into our audit planning process as
applicable:
• Employee Health – Protecting employees as much as possible from the virus, including
masking and social distancing requirements and building capacity restrictions. Although the
County has offered vaccines to all its employees, there continues to be virus variants and not
all employees have chosen to be vaccinated.
• Workforce Effectiveness & Service Delivery – Supporting employee productivity and the
continuation of services to County residents.
• Data and System Security – Ensuring data, systems, and applications are secure as employees
continue to telework, and the county provides electronic services to citizens.
• Financial – Assessing the economic effect on the County’s financial health. While the
situation appears stable for the foreseeable future, uncertainty continues that may lead to
financial impact on the horizon.
• Reputational – Administering vaccine services, managing federal resources, and effectively
communicating available services must be handled in ways that do not damage the County’s
reputation.
4

Finalizing the Audit Plan
Once risk levels are evaluated, we develop a draft audit plan for the upcoming year by:
• Evaluating the length of time since the most recent audit of each area; the longer the audit
interval, the greater chance that processes, people, and risks have changed.
• Considering requirements for audits on a defined schedule and for mandated audits.
• Analyzing audit resources needed to complete the work.
• Discussing the draft audit plan with the Citizens’ Audit Advisory Committee and County
leadership.
After the draft audit plan has been prepared and reviewed, we seek formal approval for the audit plan
from the Board prior to the start of the new fiscal year. The FY2022 Board-approved audit plan is on
page six.
AUDIT RESOURCES INFLUENCE THE AUDIT PLAN
The Board establishes our staffing level, balancing risk and budgetary requirements. A well-staffed
internal audit function that regularly audits high-risk areas can identify costly activities such as fraud,
waste, and non-compliance, and assist management in the decision to avoid, share, reduce, or accept
risks. Our body of work provides meaningful assurance, advice, and insight to the Board on key risks
so they can make informed decisions. We apply professional judgement and experience to prioritize
high-risk areas and maximize limited resources using internal staff and external specialists (subject-
matter experts).
5

FISCAL YEAR 2022 AUDIT PLAN
Agency Audits
Adult Probation Department (carried over from FY2021)
Enterprise Technology – Service Delivery (carried over from FY2021)
Sheriff’s Office – Detention (carried over from FY2021)
Countywide Audits
Outsourced IT Services – Internal Control Reports (SOC 2 Reports)
Vendor Setup & Maintenance
Accounts Payable Controls
Licenses & Certifications
Remote Access Management & Security
Information Technology Risk Assessment Refresh
Electronic Data Management and Loss Prevention (carried over from FY2021)
Single Audit Reporting Compliance – Grant Subrecipients
Contracts/Grants/IGAs
Other Audits Upon Request
Continuous Monitoring
Capital Improvement Projects
Cellular Device Management
P-Cards
Other Areas as Determined
Accounting Reviews
Adult Probation
9 Justice Courts
Non-Audit Reports
Audit Recommendations Status Report
Citizens’ Financial Condition Report
Countywide Risk Assessment
Internal Audit Department Performance Report
6