AGENDA ITEM ATTACHMENT - AUDIT RISK ASSESSMENT REPORT.PDF

RISK ASSESSMENT REPORT
Internal Audit Department
May 2019
Internal Audit Analyzes County
Risks to Prioritize Audit Work
Internal Audit defines risk as the possibility of an Analyze Risk
Perform
event occurring that will have an impact on the Follow Up & Prepare
Plan
achievement of an organization’s objectives.
County management is responsible for managing
risks by implementing strong business processes Publish Board
and internal controls. Internal Audit aids in the Audit Approves
Reports Audit Plan
assessment of risks by analyzing the operating
environment and identifying conditions that may
impair the County’s ability to achieve its goals. Conduct
Audit Work
Internal Audit performs audits to provide
reasonable assurance that the controls designed
to address risks are operating effectively.
This report describes the County’s risk environment and demonstrates how the County Auditor
prioritizes audit areas and develops an annual audit plan for approval by the County Board of
Supervisors (Board). The Board, as the County’s governing body, determines whether resources are
sufficient to implement and maintain internal controls that provide assurance the Board’s strategic
objectives will be met.
Managing Risk is Everyone’s 2
Responsibility
How Risks Influence the 4
Audit Plan
How Audit Resources 5
Influence the Audit Plan
FY 2020 Board-Approved 6
Audit Plan

MANAGING RISK IS EVERYONE’S RESPONSIBILITY
The Board of Supervisors establishes a five-year strategic
plan to provide a road map for the future and entrusts
execution of that plan to County leaders and managers.
Management regularly assesses risks that can threaten
accomplishment of the strategic plan and takes measures to
ensure those risks are mitigated and managed. While this is
conceptually simple, it is difficult and less precise in
practice due to Maricopa County’s diverse physical,
financial, and operational environment.
Three Lines of Defense
To assist County leadership in its risk response, the County has three lines of defense that collaborate
to assess and respond to risk.
Controlling Risk is an Enterprise-wide Responsibility
Management
Front line operating management that owns 1st
and manages risks and controls Line of
Defense
Department Management
Oversight Functions
Advisors that monitor risk in
support of management 2nd
Line of
Defense
Internal Audit
Independent evaluator Management, Finance, Procurement, Budget, Risk etc.
that provides
assurance to the
Board 3rd
Line of
Defense
Maricopa County
Internal Audit Department
Source: Institute of Internal Auditors January 2013 Position Paper
Management is the first line of defense against risk. They are the risk owners responsible for
identifying, assessing, controlling, and monitoring risk on a day-to-day basis. Without management
support, employees may not be effective in controlling the risk they encounter. In a perfect world, this
would be the only line of defense needed; however, in the real world, internal controls do not operate
perfectly.
2

Oversight functions such as finance, budget, risk management, procurement, information technology,
and human resources, are the second line of defense. They are the advisors who monitor countywide
risk management practices. Several County agencies also have internal functions that serve this
purpose. These activities range from quality control reporting to inspecting and reconciling County
records.
Internal Audit is the third line of defense. Internal Audit provides reasonable assurance on the
effectiveness of governance, risk management, and internal controls, including the manner in which
the first and second lines of defense achieve risk management and control objectives. Internal Audit
reviews a small number of County operations each year to ensure that management is assessing,
identifying, controlling, and monitoring risks. Internal Audit also serves as a resource to managers
and supervisors in identifying areas for improvement.
In addition to the three internal lines of defense discussed above, the County is subject to external
reviews and audits from various regulators and independent parties. All of these parties leverage their
efforts when evaluating County operations to ensure the best use of County resources.
Ethics and Fraud
The lines of defense explained previously are reinforced by fraud prevention efforts. Fraud is an act of
intentional deception to secure unfair or unlawful gain at an organization’s or individual’s expense.
While fraud risk cannot be eliminated, it can be mitigated. The term fraud mitigation refers to tools or
techniques used to reduce the frequency or severity of fraud.
Awareness is fundamental to fraud mitigation. Maricopa County mitigates fraud risk by encouraging
strong ethical behavior and using the following tools and resources:
County Policies Training and New County Hotline Internal Audit
▪outline appropriate and Employee Orientation ▪an anonymous tip line ▪evaluates County
ethical behavior ▪reinforces high for County employees to operations and issues
▪address current issues expectations for ethical report fraud, waste, and recommendations that
through regular updates behavior abuse may deter fraud
▪provides tools and
resources to County
managers
3

HOW RISKS INFLUENCE THE AUDIT PLAN
Internal Audit uses a risk-based approach to develop its annual audit plan, as required by professional
audit standards. The risk assessment process involves asking and answering three questions:
1. What can go wrong?
2. How likely is it to go wrong?
3. What are the consequences of it going wrong?
The risk assessment is a collaborative process involving 55 agencies and 83 countywide activities that
encompass as many as 500 potential auditable areas. Internal Audit assigns an overall risk level (high,
medium, or low) to each agency and countywide activity based on several factors, including financial
and citizen impacts, and leadership input.
Factors that Influence Risk Level
Leadership
Input New
Citizen Impact Challenges
Public Health Time Since
& Safety Last Audit
Impact
Audit
Financial Risk IT Risks
Impact
Level
In addition to auditor judgment,
Internal Audit considers seven factors to determine overall risk level.
Input provided by County leaders through discussion, an annual survey, and a board-approved IT risk
assessment conducted during FY 2019 revealed the following areas of concern:
Citizen Impact Areas Government Operations Areas
Public Health & Safety Legal and Compliance
Infrastructure and Service Capacity Recruitment, Retention, and Succession Planning
Growth & Economic Development Service Quality & Efficiency
Information Technology
Business Continuity & Disaster Recovery Data Privacy Protection
Business Operations Support IT Risk Identification & Management
4

Overall Risk Rating
Once risk levels are evaluated, Internal Audit develops a draft audit plan for the upcoming year by:
• Weighing risk levels with the length of time that has elapsed since the most recent audit of
each area. Risk increases with longer audit intervals because processes, people, and risks
change over time and internal controls may no longer be effective.
• Considering requirements for some areas to be audited or reviewed on a mandated or defined
schedule.
• Estimating and assigning audit resources needed to complete the work.
• Discussing the draft audit plan with the County’s Citizens’ Audit Advisory Committee.
• Discussing the draft audit plan with County leadership.
After the draft audit plan has been prepared and reviewed, Internal Audit seeks formal approval for the
audit plan from the Board prior to the start of the new fiscal year. The FY 2020 Board-approved audit
plan is on page six.
HOW AUDIT RESOURCES INFLUENCE THE AUDIT PLAN
A well-staffed internal audit function that regularly audits high-risk areas reduces risk, and can deter
costly activities such as fraud, waste, and non-compliance. Internal Audit’s body of work provides
observations and recommendations that assist the Board in making decisions that govern the County.
County leaders’ risk appetite also influences the level of audit resources. For example, in 2011, the
Board allocated additional funds for auditing the Sheriff’s Office, an agency now audited annually.
While additional resources can increase audit frequency – thereby lowering organizational risk –
County leaders understand that Internal Audit cannot audit all high risk areas annually and must
prioritize risks based on professional judgment. Internal Audit completes its annual audit plan using
internal staff and external specialists as shown below:
Audit Resources
• Internal Personnel
20 positions, including:
2 Managers
4 Supervisors
8 Senior Auditors
4 Internal Auditors
• External Specialists
Funding for subject matter experts (e.g., law enforcement,
information technology and security, engineering,
healthcare, construction, investments, actuarial services)
5

Maricopa County Fiscal Year 2020 Audit Plan
Agency Audits
Correctional Health Services – Clinic Services
Library District – Information Technology
Planning and Development – Information Technology
Planning and Development – Permitting Services
Public Fiduciary – Guardianship Services
Public Health – Information Technology
Real Estate Department – Asset Management
Recorder and Elections – Elections Readiness
Sheriff’s Office – Detention
Countywide Audits
Budget Special Requests
Contracts – Construction and Other Contracts
Legal Arizona Workers Act Compliance
Purchase Order Governance and Controls
Revenues – Fines, Forfeits, and Charges for Services
Single Audit Reporting Compliance – Grant Subrecipients
Special Requests
Continuous Monitoring
Capital Improvement Projects
Cellular Device Management
P-Cards
Other Areas as Determined
Accounting Reviews
9 Justice Courts
Juvenile Probation Department
Non-Audit Reports
Audit Recommendations Status Report
Citizens’ Financial Condition Report
Countywide Risk Assessment
Internal Audit Department Performance Report
6