INTERNAL AUDIT RISK ASSESSMENT REPORT FY 2018 REVISED.PDF

RISK ASSESSMENT REPORT
Internal Audit Department
May 2017
Internal Audit Analyzes County Risks to Prioritize Audit Work
Risk, control, and governance largely determine an
organization’s ability to achieve its objectives. While
County management is responsible for managing Analyze
Perform Risk &
risk by implementing strong business processes and
Follow Up Prepare
internal controls, Internal Audit aids in the Plan
assessment of risks. Internal Audit analyzes the
operating environment to identify conditions that Publish Board
Audit Approves
may impair the County’s ability to achieve its goals. Reports Audit Plan
It performs audits to provide reasonable assurance
that the controls designed to address risks are Conduct
Audit
operating as intended. This collaborative process Work
gives consideration to over 400 potential audit areas
throughout the County.
This report describes the County’s risk environment and shows how the County Auditor prioritizes audit
areas and develops an annual audit plan for approval by the County Board of Supervisors (Board). The
Board, as the County’s governing body, determines whether resources are sufficient to implement and
maintain internal controls that provide assurance the Board’s strategic objectives will be met.
Managing Risk is Everyone’s 2
Responsibility
What’s on County Management’s 4
Mind?
How Identified Risks Influence the 7
Audit Plan
Audit Resources 8
FY 2018 Board Approved Audit Plan 9
Audit Universe 10

MANAGING RISK IS EVERYONE’S RESPONSIBILITY
Risk is the possibility that events might not go as planned.
While managing risk is challenging due to Maricopa
County’s diverse physical, financial, and operational
organization, it is also critical to the County’s success. The
Board of Supervisors establishes a five-year strategic plan
to provide a road map for the future and entrusts execution
of that plan to County officials. Risk management is the
process used to prepare for and protect the County from
uncertainties.
County leaders regularly identify risks that can threaten the
strategic plan, including:
 Suppressed property tax values due to legislative changes and a slow economic recovery.
 Increased proportion of retirement-eligible employees, leading to staffing issues such as high
turnover and loss of institutional knowledge.
 Continued reliance on enterprise-wide technology in an environment with continuously
evolving cybersecurity threats.
 Continued pressure on infrastructure, primarily caused by population growth.
 Continued cost shifts from state government to County government.
 Increased need to balance financial constraints with best-in-class service to County residents.
County leadership has responded to these risks by:
 Critically evaluating the operating budget and slowing spending on planned capital projects.
 Changing the budgeting approach from the “most likely” to “pessimistic” forecast for several
years while maintaining structural balance (recurring revenues meet or exceed recurring
expenses), which protects against unforeseen revenue declines and promotes sustainable
services.
 Investing in technology to increase productivity and provide better services to County
residents.
 Prioritizing maintenance of cash reserves to address unforeseen economic needs.
Three Lines of Defense
To assist County leadership in its risk response, the County can be viewed as having three lines of
defense that collaborate to assess and respond to risk.
Managers and supervisors are the first line of defense against risk. They are the risk owners
responsible for developing and executing control procedures on a day-to-day basis. Their actions help
mitigate risk and ensure compliance with regulatory requirements. Without managers’ support,
employees may not be effective in controlling the risk they encounter. In a perfect world, this would
be the only line of defense needed; however, in the real world, internal controls do not operate
perfectly.
2

Oversight and compliance functions such as Finance, Budget, Risk Management, Procurement,
Office of Enterprise Technology, and Human Resources, are the second line of defense. They are the
advisors who oversee risk and monitor countywide risk management practices. Several County
departments also have internal functions that serve this purpose, but often go unrecognized. These
activities range from quality control reporting to inspecting and reconciling County records.
Internal Audit is the third line of defense. Internal Audit is an independent function whose role is to
“spot check” a small number of County processes each year to determine that management is
identifying, implementing, and monitoring the necessary controls to prevent fraud, waste, and abuse.
These objective evaluators also serve as a resource to managers and supervisors in identifying areas
for improvement.
In addition to the three internal lines of defense discussed above, the County is also subject to external
reviews and audits from various state and federal regulators. All of these parties leverage their efforts
when evaluating County operations to ensure efficient use of County resources.
Controlling Risk is an Enterprise-Wide Responsibility
Managers and Supervisors 1st
Front line operating management that owns and Line of
manages risk and controls Defense
Department Managers
Oversight & Compliance 2nd
Functions Line of
Advisors that monitor risk and Defense
controls in support of management
Finance, Budget, Risk
Management, Procurement, etc.
Internal Audit
Independent evaluator
that provides
assurance to the 3rd
Board Line of
Defense
Maricopa County
Internal Audit Department
Source: Institute of Internal Auditors January 2013 Position Paper
Ethics and Fraud
The lines of defense shown previously are reinforced by fraud prevention efforts. Fraud is an act of
deliberate deception to secure unfair or unlawful gain at an organization’s or individual’s expense.
While fraud risk cannot be eliminated, it can be managed. Fraud prevention is addressed through
sound policies and procedures, and employee training. Maricopa County management addresses fraud
risk by encouraging strong ethical behavior using the following tools:
3

 The County Ethics Policy and Handbook outlines appropriate behavior.
 Additional County Policies clarify specific ethical behavior (e.g., the acceptance of gifts by
County employees is prohibited). Policies are developed and approved by designated policy
teams and by County leadership to ensure current issues are addressed.
 New Employee Orientation classes teach appropriate ethical behavior for all newly-hired
County employees.
 A County Hotline, provided by the Maricopa County CARES program, provides an
anonymous tip line for County employees. This hotline may be used to report fraud, waste,
and abuse, or other employee issues.
The Board of Supervisors also addresses fraud risk by maintaining an Internal Audit Department.
Internal Audit helps to deter fraud, waste, and abuse by promoting strong internal controls in the
following ways:
 Analyzing the potential for fraud during the audit planning process
 Issuing formal and informal recommendations that may deter fraud
 Reporting significant fraud issues to the County Attorney’s Office
 Providing internal control videos and other information on its website
WHAT’S ON COUNTY MANAGEMENT’S MIND?
In addition to speaking with County leadership, Maricopa County Internal Audit conducted a survey
of County managers to aid in the identification of key risks throughout the County. This survey was
sent to 73 managers across 52 departments and functional areas. With a 26% response rate, the top 5
risk categories identified were: 1) Employee Recruitment and Retention, 2) Information Technology
(IT) and Cybersecurity, 3) Budget & Resource Allocation, 4) Policy and Administration, and 5)
Health, Safety, and Security. These categories are consistent with most of the risks identified by
County leadership. The following word cloud visually represents the importance of risks identified by
the respondents based on frequency of the words used in responses. Discussions of the top five
categories follow the graphic.
This word cloud indicates County leaders’ top concerns relate to the County’s financial
position and administration, security (physical and IT), and employee-related topics.
4

1) Employee Recruitment & Retention
Engaged Employees are Effective Employees
The top risk identified in the County
management survey was recruiting top talent and Committed to Employee
keeping employees engaged. Similar to any for- Engagement
profit organization, the County’s workforce is
one of its greatest assets, but also one of its "Better, happier employees become
largest expenditures. With more than 14,000 better, more effective public
employees, personnel expenditures make up servants."
approximately 60% of the County’s overall Denny Barney, Chairman
operating budget in fiscal year (FY) 2017. With of the Board of Supervisors
continued pressure to compete with private
sector compensation, the County’s employee
turnover rate exceeded 14% in FY 2016, which represents an 8-year high. The Board of Supervisors
remains focused on improving retention through on-going compensation analysis and an investment in
workforce development opportunities, including a new internal training system.
The County also continues to see an increase in retirements and retirement-eligible employees. As of
July 2016, 9.4% of County employees in the Arizona State Retirement System are eligible for
retirement. Of the managers and executives in this group, the rate is even higher at 30.1%. Without
proper agency planning, the quality of services may suffer if a large number of seasoned employees
leave County employment. This risk is heightened if agency business processes are not adequately
documented.
2) IT & Cybersecurity
Technology is Costly, but Necessary
The technology landscape changes quickly and keeping up with those changes for a jurisdiction as
large and varied as Maricopa County is a challenge. The County’s IT professionals and department
leaders work together to evaluate technology needs and ensure decisions align with the County’s
strategic goals. They work to balance the
capabilities of the latest technology with important
Cybercriminals are leveraging factors such as operational performance, security
machine learning to target of the information the public entrusts the County
victims and there are a to protect, and cost.
plethora of public sources of
data to build and train The County’s Capital Improvement Program
review process provides County leadership with
malicious machine learning
information to make decisions about the value a
algorithms. technology project will provide in supporting
McAfee Labs 2017 Threats Predictions services to citizens. The FY 2017 revised budget
for capital improvement technology projects is
$89.3 million, 32% of the total capital
improvement budget. The two costliest projects for this fiscal year are the Public Safety Radio System
upgrade ($28.4 million) and the Treasurer’s Technology System upgrade ($19.9 million).
5

3) Budget & Resource Allocation
Balancing Increased Costs with Providing Best-in-Class Service
The County continually strives to develop a sustainable, structurally-
balanced budget and is focused on building necessary reserves to
ensure the County’s fiscal health continues into the future. With slow
economic growth and recent cost shifts from the state, balancing these
factors with the responsibility to provide mandated and other needed
services continues to be a challenge.
Despite increased demand for criminal justice, health care, and general
service delivery, in FY 2017, the County’s operating budget absorbed
approximately $11 million of additional costs that were shifted from the
state without a significant impact to provided services, a testament to
the success of prudent fiscal planning that the County has employed in
recent years.
4) Policy & Administration
Thorough Policies Lead to Consistent Practices
Policies and procedures are created by management to define behavior that supports an organization’s
mission and objectives. They are also commonly used to define controls that mitigate risks associated
with an environment. Thorough policies and procedures serve as effective training tools for staff and
faculty.
If written policies and procedures do not exist, are inaccurate, incomplete, outdated, and/or not
communicated, the risk of inconsistent practices and errors increases. County management reviews
countywide policies and collaborates with key department leaders to update or revise policies for the
Board of Supervisors or County Manager to consider. The target is to review all central policies on a
rolling five-year basis, or as directed.
5) Health, Safety, and Security
Always a Top Priority
Providing safe communities is an ongoing strategic priority for Maricopa County. With over 4 million
people spread across more than 9,000 square miles, the task of ensuring the health, safety, and security
of the citizens is a large one. This is further complicated by the nature of the world today, where
terrorism threats and public health concerns are high. County departments such as Public Health,
Human Services, Environmental Services, Air Quality, Emergency Management, and the Sheriff’s
Office are continuously working to provide a broad range of health, human, and environmental
services.
6

HOW IDENTIFIED RISKS INFLUENCE THE AUDIT PLAN
Internal Audit starts the risk assessment process by updating its list of all auditable areas (Audit
Universe – see page 10). Internal Audit compiles the list by reviewing the County’s organization
chart, budget, financial data, and Comprehensive Annual Financial Report (CAFR), which is audited
by the Arizona State Auditor General. Included in the list are areas that require audits on a regular
basis (mandated audits). For example, the Arizona Supreme Court requires accounting reviews of all
Justice Courts, the Clerk of the Superior Court, and other court departments every three years.
Additionally, the federal government requires an annual audit of expended federal grant funds, which
Internal Audit monitors.
Internal Audit then assigns a risk level (high, medium, or low) to the auditable areas based on several
factors such as financial impact, citizen impact, and risk appetite (based on leadership input, see the
following chart). Risk appetite can be defined as the level of risk an organization is prepared to accept
before taking action to reduce it. For example, the County may not have the latest version of a
particular technology, but as long as the technology it has keeps its operating data secure and allows
for delivery of necessary services to citizens, management may choose not to take action to replace it
immediately. County leaders’ risk appetite influences the level of audit resources. For example, in
2011, the Board of Supervisors allocated additional funds for auditing the Sheriff’s Office, a high-risk
office that is now audited annually. Additional resources can increase audit frequency, which can help
lower organizational risk.
Factors That Influence Risk Level
Citizen
Impact
Publicity Leadership
Impact Input
Public Health New
& Safety Challenges
Impact
Audit
Financial Risk Time Since
Impact Last Audit
Level
In addition to auditor judgment, Internal Audit considers
these seven factors to determine risk level.
7

Once risk levels are assigned, Internal Audit develops a draft audit plan for the upcoming year by:
 Comparing risk levels with the length of time that has elapsed since the most recent audit of
each area. Areas with longer audit intervals receive additional consideration for the audit plan
because of the increased risk that control weaknesses may go undetected if an area is not
audited for a long period of time.
 Estimating and assigning audit resources needed to complete the work.
 Discussing the draft audit plan with the County’s Citizens’ Audit Advisory Committee.
 Discussing the draft audit plan with County leadership and making adjustments as needed.
After the draft audit plan has been prepared and reviewed, Internal Audit seeks formal Board of
Supervisors approval for the audit plan prior to the start of the new fiscal year. See page 9 for the FY
2018 Board approved audit plan.
AUDIT RESOURCES
Acting under the Board’s authority, Internal Audit reviews controls that County management has
implemented to address and mitigate risk. A well-staffed internal audit function regularly auditing
high-risk areas can help lower risk, and can be a deterrent to fraud, waste, and abuse. Most County
leaders stated that the current internal audit frequency (on average 6 to 7 years) is acceptable.
However, they would be in favor of increasing audit frequency as the County’s financial condition
improves. Internal Audit’s body of work provides observations and recommendations that assist the
Board in making decisions that govern the County. Internal Audit completes its annual audit plan
using internal staff and external specialists as shown below:
Audit Resources
• Internal Personnel
20 positions (4 positions are part-time)
• External Specialists
$324,000 for subject matter experts (law enforcement,
information technology and security, engineering,
healthcare, construction, investments, actuarial services,
etc.)
8

FY 2018 AUDIT PLAN (pending Board approval)
Agency Audits
Assessor
Clerk of the Superior Court (including Data Center)
Recorder
Sheriff’s Office – Enforcement Support
Sheriff’s Office – Extraditions
Sheriff’s Office – Personnel Services
Treasurer – Property Taxes
Waste Resources and Recycling
Accounting Reviews
9 Justice Courts
Clerk of the Superior Court
Countywide Audits
Contracts/IGAs/Grants
Fixed Assets
Single Audit Monitoring
Special Requests
Non-Audit Reports
Annual Audit Follow-Up
Annual Audit Risk Assessment
Annual Performance Report
Citizens Financial Condition Report
9

AUDIT UNIVERSE
The following list represents all operational areas of the County. Internal Audit calls this list an “audit
universe” because it divides the County’s organizations into “auditable activities.” These activities are
defined in various ways, such as function, organizational unit, or program. Although each activity
could be the subject of an individual audit, it is more common that several, or all, activities within an
agency would be selected for review at the same time.
FY 2015 Audits FY 2016 Audits FY 2017 Audits FY 2018 Audits
Operational Audit Areas Assessor - Personal Property
Adult Probation - Administration/Accounting Assessor - Property Taxes
Adult Probation - Assessment/Development Assessor - Real Property
Adult Probation - Community Supervision Board of Supervisors (BOS)
Adult Probation - IT Systems BOS Clerk - Boards/Commissions Admin
Adult Probation - Other Activities BOS Clerk - Information Services
Air Quality - Compliance & Enforcement BOS Clerk - Meeting Management
Air Quality - IT Systems BOS Clerk - Special Districts
Air Quality - Monitoring BOS Clerk - Statutory Services
Air Quality - One Stop Shop Capital Improvement Program
Air Quality - Other Activities Clerk of the Superior Court - Court Records
Air Quality - Permitting Clerk of the Superior Court - Fiduciary Svcs
Air Quality - Trip Reduction/Vehicle Retrofit Clerk of the Superior Court - Finance/Acctg**
Animal Care & Control - Adoptions Clerk of the Superior Court - IT Systems
Animal Care & Control - Comm Outreach Clerk of the Superior Court - Other Activities
Animal Care & Control - Field/Facilities Clerk of the Superior Court - Public Records
Animal Care & Control - Finances Constables
Animal Care & Control - IT Systems** Contract Counsel
Animal Care & Control - Licensing Correctional Health - Clinics & Medications
Animal Care & Control - Other Activities Correctional Health – IT Systems
Animal Care & Control - Revenues** Correctional Health - Other Activities
Animal Care & Control - Shelter Operations Correctional Health - Pre-Booking/Intake
Assessor - Administration/Records Correctional Health - Procurement
Assessor - GIS/Mapping County Attorney - Administration/Finance
Assessor - IT Systems County Attorney - Check Enforcement
Assessor - Other Activities County Attorney - County Counsel
10

County Attorney - Enforcement Support Equipment Services - Fleet Management
County Attorney - IT Systems Equipment Services - Fuel
County Attorney - Other Activities Equipment Services - IT Systems
County Attorney - Prevention/Victims Equipment Services - Maintenance
County Attorney - Prosecution Equipment Services - Other Activities
County Attorney - RICO Equipment Services - Parts
County Call Center Facilities Management - Development
County Manager's Office Facilities Management - IT Systems
Education Services - Consortium Facilities Management - Maintenance
Education Services - Educ Support Svcs Facilities Management - Operations
Education Services - IT Systems Facilities Management - Other Activities
Education Services - Other Activities Facilities Management - Protective Services
Education Services - School Dist Elections Finance - 1099/Vendor Registration
Education Services - School District Payroll Finance - Collections
Education Services - Small Schools Finance - Electronic Document Mgmt
Elections - Ballot Preparation Finance - Financial Reporting
Elections - Ballot Tabulation Finance - Financial Services
Elections - Candidate Filing Finance - Industrial Development Authority
Elections - IT Systems Finance - IT Systems
Elections - Other Activities Finance - Other Activities
Elections - Voter Registration Finance - Payment Processing
Emergency Management - IT Systems Flood Control - Capital Improvement
Emergency Management - Other Activities Flood Control - Flood Hazard Plan
Emergency Management - Preparedness Flood Control - IT Systems
Emergency Management - Response/Recov Flood Control - Other Activities
Employee Benefits and Health Flood Control - Permitting
Environmental Services - Business Services Government Relations
Environmental Services - Env Enforcement Green Government
Environmental Services - Env Health Housing - IT Systems
Environmental Services - IT Systems Housing - Other Activities
Environmental Services - Other Activities Housing - Public Housing
Environmental Services - Vector Control Housing - Section 3
Environmental Services - Water/Waste Housing - Section 8
11

Human Resources - Compensation Juvenile Probation - Administration
Human Resources - Confidential Records Juvenile Probation - Detention
Human Resources - Emp Svcs & Diversity Juvenile Probation - Diversion
Human Resources - Employee Development Juvenile Probation - Finance/Accounting**
Human Resources - Employee Relations Juvenile Probation - IT Systems/iCIS
Human Resources - FMLA/ADA Juvenile Probation - Other Activities
Human Resources - FSLA Juvenile Probation - Supervision
Human Resources - IT Systems Library District - Branch Operations
Human Resources - Laws and Regulations Library District - IT Systems
Human Resources - Merit Commission Library District - Other Activities
Human Resources - Other Activities Library District - Support Services
Human Resources - Payroll Management & Budget - Budget Dev
Human Resources - Payroll System Management & Budget - CIP Oversight
Human Resources - Records Management & Budget - Economic Dev
Human Resources - Recruit & Hiring System Management & Budget - IT Systems
Human Resources - Tuition Reimb System Management & Budget - Other Activities
Human Services - Community Services Management & Budget - Policy/Compliance
Human Services - Grants Management & Budget - Program Advocacy
Human Services - Head Start MCSO (Sheriff) - Aviation
Human Services - IT Systems MCSO - Budget & Finance
Human Services - Neighborhood Stabilization MCSO - Cash Management
Human Services - Other Activities MCSO - Central Intake
Human Services - Senior Adult Living MCSO - Communications
Human Services - Special Transport Svcs MCSO - Contracts
Human Services - Workforce Development MCSO - Court Security & Operations
Innovation and Collaboration MCSO - Crime Lab
Integrated Criminal Justice Info System MCSO - Data Center
Internal Audit MCSO - Detention Capital Improvement
Justice Courts - Administration MCSO - Detention Classification
Justice Courts - Collections MCSO - Detention Food Factory
Justice Courts - Finance/Accounting* MCSO - Detention Inmate Fund/Canteen
Justice Courts - Other Activities MCSO - Detention Inmate Grievances
Justice System Planning & Information MCSO - Detention Inmate Programs
12

MCSO - Detention Institutional Services MCSO - Property & Evidence Mgmt System
MCSO - Detention Jail Centers MCSO - Records Management Systems
MCSO - Detention Jail Management System MCSO - Records, Warrants, and IDs
MCSO - Detention SIMS MCSO - Revenue & Business Services
MCSO - Detention Special Response Team MCSO - RICO
MCSO - Detention Transportation MCSO - SWAT and K9
MCSO - Enforcement Intelligence MCSO - Training Division
MCSO - Enforcement Major Crimes MCSO - Training Management System
MCSO - Enforcement Special Investigations MCSO - Warehouse/Surplus
MCSO - Enforcement Support MCSO - Weapons & Ammunition
MCSO - Expenditures Medical Examiner - Investigations
MCSO - Extradition Medical Examiner - IT Systems
MCSO - Fleet Management Medical Examiner - Lab Services
MCSO - Internal Affairs Medical Examiner - Medical Exams
MCSO - IT Bureau Medical Examiner - Other Activities
MCSO - IT Data Confidentiality and Security Non Departmental - Capital Projects
MCSO - IT Governance Non Departmental - Contingency
MCSO - IT Projects** Non Departmental - Infrastructure
MCSO - Jail Per Diem Non Departmental - Other Activities
MCSO - Jail Utilization Non Departmental - State Contributions/MOE
MCSO - Judicial Enforcement - Pawn Shops Non Departmental - Taxes
MCSO - Judicial Enforcement - Property OET (Enterprise Technology) - Application
Collections and Auctions Development & Support
MCSO - Judicial Enforcement - Warrants OET - Business Analysis
MCSO - Legal Policy & Compliance OET - Business Integration Services
MCSO - Network Security OET - Customer Service (Help Desk)
MCSO - Other Activities OET - Data Center Anti-virus/Intrusion Detect
MCSO - Patrol Division OET - Data Center Change Management
MCSO - Patrol IGAs OET - Data Center Contingency Planning
MCSO - Patrol IT Systems OET - Data Center Physical Security
MCSO - Payroll OET - Data Center Security Management
MCSO - Personnel Services OET - Data Center System Patching
MCSO - Property & Evidence OET - Data Center User System Access
13

OET - Data Center Utilization OPDS Legal Advocate - Adult Civil
OET - Data Loss Prevention Representation
OET - End User Security Awareness OPDS Legal Advocate - Adult Criminal
Representation
OET - Geographic Information Services
OPDS Legal Advocate - IT Systems
OET - Human Resources
OPDS Legal Advocate - Juvenile
OET - Incident Response Representation
OET - Information Security Governance OPDS Legal Advocate - Support Services
OET - IT Asset Management OPDS Legal Defender - Adult Criminal
OET - IT Contracts Representation
OET - IT Risk Management OPDS Legal Defender - Support Services
OET - IT Strategic Planning OPDS Public Advocate - Adult Civil
Representation
OET - Management Services (Finance)
OPDS Public Advocate - Contracts
OET - Mobile Devices
OPDS Public Advocate - Juvenile
OET - Operating System Security Representation
OET - PC/LAN Support OPDS Public Advocate - Support Services
OET - Risk Register & Data Classification OPDS Public Defender - Adult Civil
OET - Security Architecture Representation
OET - Service Level Agreements OPDS Public Defender - Adult Criminal
Representation
OET - Technology CIP Projects
OPDS Public Defender - Contracts
OET - Telecommunications
OPDS Public Defender - Support Services
OET - Threat Intelligence & Incident Tracking
OPS (Procurement Svcs) - Contract Monitor
OET - Virtual Desktop Infrastructure
OPS - IT Systems
OET - Wireless/Radio
OPS - Other Activities
Office of Communications
OPS - Procurement
OPDS (Public Defense Services) Contract
Counsel - Adult Civil Representation OPS - Purchasing Cards
OPDS Contract Counsel - Adult Criminal OPS - Records Management
Representation OPS - Reprographics
OPDS Contract Counsel - Contracts Parks and Rec - Fees & Other Revenues
OPDS Contract Counsel - IT Systems Parks and Rec - IT Systems
OPDS Contract Counsel - Juvenile Parks and Rec - Other Activities
Representation
Parks and Rec - Parks Operations
OPDS Contract Counsel - Support Services
Parks and Rec - Planning and Development
14

Planning and Dev - Building Permits Public Health - Refugee Screening Services
Planning and Dev - Fees Public Health - Tuberculosis/Hansen’s
Planning and Dev - Inspections Disease
Planning and Dev - IT Systems Public Health - Vital Registration Services
Planning and Dev - Land Use Planning Public Health - Women, Infants, & Children
Planning and Dev - Other Activities Real Estate
Public Fiduciary - Case Management Recorder - Document Operations
Public Fiduciary - Contracts Recorder - IT Systems
Public Fiduciary - Decedent Services Recorder - Other Activities
Recorder - Public Records
Public Fiduciary - Financial Management
Public Fiduciary - Investigations Research & Reporting - IT Systems
Public Fiduciary - IT Systems Research & Reporting - Other Activities
Public Fiduciary - Other Activities Research & Reporting - Surveys
Public Health - Clinical Services Risk Management - Claims
Public Health - Community Health Nursing Risk Management - Environmental
Public Health – Epidemiology/Disease Risk Management - IT Systems
Surveillance Risk Management - Loss Control
Public Health - Family Health Risk Management - Other Activities
Public Health - Fees Risk Management - Safety
Public Health - Grants Mgmt/ Procurement Special Projects and Public Outreach Svcs
Public Health - Healthcare for the Homeless Stadium District - Contracts
Public Health - HIPAA Stadium District - Events
Public Health - HIV/STD Stadium District - Facilities Management
Public Health - IT Systems Stadium District - IT Systems
Public Health - Laboratory Stadium District - Other Activities
Public Health - Medical Records Stadium District - Revenues
Public Health - Office of Oral Health Superior Court - Civil Justice
Public Health - Tobacco & Chronic Disease Superior Court - Court Fin/Cash Handling**
Prevention Superior Court - Criminal Justice
Public Health - Other Activities Superior Court - Family Justice
Public Health - Pharmacy Superior Court - IT Systems
Public Health - Preparedness & Response Superior Court - Juvenile Justice
Public Health - Promoting Healthy Lifestyles Superior Court - Law Library**
15

Superior Court - Probate/Mental Health Contracts - Revenue
Superior Court - Property & Evidence Cost Allocation (Internal Service Funds)
Superior Court - Self Service Centers** Customer Satisfaction
Sustainability Data Centers/Disaster Recovery
Transportation - Engineering Data Privacy and Security
Transportation - IT Systems E-Commerce
Transportation - Operations & Development Exit/Entrance - New Leadership
Transportation - Other Activities Expenditures
Transportation - Project Management Financial Condition Report*
Transportation - Roadway Maintenance Fixed Assets
Transportation - Traffic Management Grant Management
Treasurer - Accounting Internet Usage
Treasurer - Client Services Inventories
Treasurer - Investment Services IT - Cybersecurity Assessment
Treasurer - IT Systems IT - ERP Review
Treasurer - Other Activities IT Governance
Treasurer - Tax Services Leases
Waste Resources - Fees Network Security - Active Directory
Waste Resources - IT Systems Network Security - End Point
Waste Resources - Other Activities Network Security - End-User Security
Waste Resources - Solid Waste Network Security - Mobile Client
Countywide Audit Areas Network Security - Virus Detection
Accounts Payable Network Security - Web Apps
Accounts Receivable Network Security - Wireless
Annual Risk Assessment* OnBase Work Flow and Application
Audit Follow-Up* Payroll
Capital Improvements Performance Measure Certification
Cash Procurement/Purchasing
Combined Charitable Campaign/EASE Purchasing Cards/e-Payments
Contracts - Construction Records Retention
Contracts - Health Care Programs Revenues - Grants*
Contracts - IGAs* Revenues - Highway User Revenue Funds
Contracts - Other* Revenues - Licenses/ Permits/Fines
16

Revenues - Other Software License
Revenues - Property & Sales Tax/IGA Special Requests*
Revenues - Vehicle License Tax Travel
Single Audit Monitoring* Vehicle Usage
* On approved audit plan for all fiscal years presented.
** On approved audit plan for two or more fiscal years presented. The highlight color
corresponds to the most recent fiscal year an area was on the audit plan.
17