ANNUAL AUDIT RISK ASSESSMENT REPORT.PDF

RISK ASSESSMENT REPORT
Internal Audit Department
May 2018
Internal Audit Analyzes County Risks to Prioritize Audit Work
Internal Audit defines risk as the possibility that
an event will occur, which will impact an
organization’s achievement of its objectives. Analyze
While County management is responsible for Perform Risk &
Follow Up Prepare
managing risks by implementing strong business Plan
processes and internal controls, Internal Audit
aids in the assessment of risks. Internal Audit Publish Board
Audit Approves
analyzes the operating environment to identify Reports Audit Plan
conditions that may impair the County’s ability to
achieve its goals. Internal Audit performs audits Conduct
Audit
to provide reasonable assurance that the controls Work
designed to address risks are operating as
intended.
This report describes the County’s audit risk environment and shows how the County Auditor prioritizes
audit areas and develops an annual audit plan for approval by the County Board of Supervisors (Board).
The Board, as the County’s governing body, determines whether resources are sufficient to implement
and maintain internal controls that provide assurance the Board’s strategic objectives will be met.
Managing Risk is Everyone’s 2
Responsibility
How Risks Influence the Audit 3
Plan
How Audit Resources 5
Influence the Audit Plan
FY 2019 Board Approved 6
Audit Plan

MANAGING RISK IS EVERYONE’S RESPONSIBILITY
The Board of Supervisors establishes a five-year strategic
plan to provide a road map for the future and entrusts
execution of that plan to County leaders and managers.
Management regularly assesses risks that can threaten the
strategic plan and takes steps to ensure those risks are
mitigated and managed. While this is conceptually simple,
it is difficult and less precise in practice due to Maricopa
County’s diverse physical, financial, and operational
environment that includes over 50 agencies with distinct
missions and goals.
Three Lines of Defense
The County can be viewed as having three lines of defense that collaborate and assist County
leadership in assessing and responding to risk.
Controlling Risk is an Enterprise-Wide Responsibility
Management 1st
Front line operating management that owns and Line of
manages risks and controls Defense
Agency Management
Oversight Functions 2nd
Advisors that monitor risk in Line of
support of management Defense
Finance, Budget, Risk
Management, Procurement, etc.
Internal Audit 3rd
Independent evaluator Line of
that provides Defense
assurance to the
Board Maricopa County
Internal Audit Department
Source: Institute of Internal Auditors January 2013 Position Paper
Management is the first line of defense against risk. They are the risk owners responsible for
identifying, assessing, controlling, and monitoring risk on a day-to-day basis. Without management’s
support, employees may not be effective in controlling the risk they encounter. In a perfect world, this
would be the only line of defense needed; however, in the real world, internal controls do not operate
perfectly.
2

Oversight functions such as finance, budget, risk management, procurement, information technology,
and human resources, are the second line of defense. They are the advisors who monitor countywide
risk management practices. Several County agencies also have internal functions that serve this
purpose. These activities range from quality control reporting to inspecting and reconciling County
records.
Internal Audit is the third line of defense. Internal Audit provides reasonable assurance on the
effectiveness of governance, risk management, and internal controls, including the manner in which
the first and second lines of defense achieve risk management and control objectives. Internal Audit
“spot checks” a small number of County operations each year to ensure that management is assessing,
identifying, controlling, and monitoring risks. Internal Audit also serves as a resource to managers
and supervisors in identifying areas for improvement.
In addition to the three internal lines of defense discussed above, the County is subject to external
reviews and audits from various regulators and independent parties. All of these parties leverage their
efforts when evaluating County operations to ensure the best use of County resources.
Ethics and Fraud
The lines of defense shown previously are reinforced by fraud prevention efforts. Fraud is an act of
intentional deception to secure unfair or unlawful gain at an organization’s or individual’s expense.
While fraud risk cannot be eliminated, it can be mitigated. The term fraud mitigation refers to tools or
techniques used to reduce the frequency or severity of fraud.
Awareness is fundamental to fraud mitigation. Maricopa County mitigates fraud risk by encouraging
strong ethical behavior and using the following tools and resources:
County Policies Training and New County Hotline Internal Audit
- outline appropriate and ethical Employee Orientation - an anonymous tip line for - evaluates County operations
behavior - reinforce high expectations for County fraud, employees waste, and to abuse report and issues may recommendations deter fraud that
- updated to ensure current ethical behavior
issues are addressed - provides tools and resources to
County managers, such as the
Fraud Prevention Tool
HOW RISKS INFLUENCE THE AUDIT PLAN
To comply with industry standards, Internal Audit uses a risk-based approach to develop its annual
audit plan. Internal Audit attempts to quantify the possibility and consequences of risk factors. At its
core, this process involves asking and answering three questions:
1. What can go wrong?
2. How likely is it to go wrong?
3. What are the consequences of it going wrong?
3

This is a collaborative process giving consideration to over 400 potential audit areas throughout the
County. Internal Audit assigns a risk level (high, medium, or low) to each area based on several
factors such as financial impact, citizen impact, and leadership input.
Factors that Influence Risk Level
Citizen Impact Leadership Input
Public Health New
& Safety Challenges
Impact
Audit
Financial Risk Time Since
Impact Last Audit
Level
In addition to auditor judgment, Internal Audit considers these
six factors to determine risk level.
Input provided by County leaders revealed the following areas of concern:
Citizen Impact Areas Government Operations Areas
Public Services Workforce Challenges
Safe Communities Information Technology
Growth & Economic Development
The County’s strategic plan addresses these and other risks and leadership’s risk appetite. Risk
appetite can be defined as the level of risk an organization is prepared to accept before taking action to
reduce it. For example, the County may not have the latest version of a particular technology that
might improve efficiency, but as long as the current technology keeps information secure and allows
for the delivery of necessary services to citizens, management may choose not to take action to replace
it immediately.
Once risk levels are evaluated, Internal Audit develops a draft audit plan for the upcoming year by:
• Comparing risk levels with the length of time that has elapsed since the most recent audit of
each area. Areas with longer audit intervals receive additional consideration for the audit plan
because of the increased risk that control weaknesses may go undetected if an area is not
audited for a long period of time.
• Considering requirements for some areas to be audited or reviewed on a mandated or defined
schedule, such as every three years.
• Estimating and assigning audit resources needed to complete the work.
• Discussing the draft audit plan with the County’s Citizens’ Audit Advisory Committee.
• Discussing the draft audit plan with County leadership and making adjustments as needed.
4

After the draft audit plan has been prepared and reviewed, Internal Audit seeks formal Board of
Supervisors approval for the audit plan prior to the start of the new fiscal year. See page 6 for the FY
2019 Board-approved audit plan.
HOW AUDIT RESOURCES INFLUENCE THE AUDIT PLAN
A well-staffed internal audit function regularly auditing high-risk areas can help lower risk, and can be
a deterrent to fraud, waste, and abuse. Internal Audit’s body of work provides observations and
recommendations that assist the Board in making decisions that govern the County. County leaders’
risk appetite also influences the level of audit resources. For example, in 2011, the Board of
Supervisors allocated additional funds for auditing the Sheriff’s Office, an office now audited
annually. While additional resources can increase audit frequency – thereby lowering organizational
risk – County leaders understand that Internal Audit cannot audit all high risk areas annually and must
prioritize risks based on professional judgment. Internal Audit completes its annual audit plan using
internal staff and external specialists as shown below:
Audit Resources
• Internal Personnel
20 positions (5 positions are part-time)
• External Specialists
Funding for subject matter experts (law enforcement,
information technology and security, engineering,
healthcare, construction, investments, actuarial services,
etc.)
5

FY 2019 AUDIT PLAN
Agency Audits
Air Quality – Compliance and Enforcement
Clerk of the Superior Court – Fees and System User Access Management
Education Services – Rewarding Excellence in Instruction & Leadership (REIL) Program
Emergency Management – Preparedness
Flood Control District – Intergovernmental Agreements (IGAs)
Human Resources – Employee Benefits
Human Services – Workforce Development
Sheriff’s Office – Bonds, Fines, and Court Order Processing
Sheriff’s Office – Data Center
Transportation – Roadway Maintenance
Countywide Audits
Continuous Monitoring
Contracts/IGAs/Grants
Information Technology Risk Assessment
Legal Arizona Workers Act Compliance
Single Audit Reporting Compliance – Grant Subrecipients
Special Requests
Accounting Reviews
9 Justice Courts
Adult Probation
Non-Audit Reports
Annual Status Report of Audit Recommendations
Annual Audit Risk Assessment
Annual Performance Report
Citizens Financial Condition Report
6