ANNUAL RISK ASSESSMENT FY 2017.PDF

RISK ASSESSMENT REPORT
Internal Audit Department
May 2016
Internal Audit Analyzes County Risks to Prioritize Audit Work
Risk, control, and governance largely determine an
organization’s ability to achieve its objectives. While Analyze Risk &
County management is responsible for managing Prepare Plan
risk by implementing strong business processes and
internal controls, Internal Audit aids in the Perform Board Approves
assessment of risks. Internal Audit analyzes the Follow Up Audit Plan
operating environment to identify conditions that
may impair the County’s ability to achieve its goals.
It performs audits to provide reasonable assurance Publish Conduct
Audit Reports Audit Work
that the controls designed to address risks are
operating as intended. This collaborative process
gives consideration to over 400 potential audit areas
throughout the County.
This report describes the County’s risk environment and shows how the County Auditor prioritizes audit
areas and develops an annual audit plan for approval by the County Board of Supervisors (Board). The
Board, as the County’s governing body, determines whether resources are sufficient to implement and
maintain internal controls that provide assurance the Board’s strategic objectives will be met.
Managing Risk is Everyone’s 2
Responsibility
What’s on County Management’s Mind? 4
How Identified Risks Influence the Audit 7
Plan
Audit Resources 8
FY 2017 Board Approved Audit Plan 9
1 Audit Universe 10

MANAGING RISK IS EVERYONE’S RESPONSIBILITY
Managing risk is critical to Maricopa County’s success.
Risk is the likelihood that events might not go as planned.
Managing risk is challenging due to the County’s diverse
physical, financial, and operational organization. The
Board of Supervisors establishes a five-year strategic plan
to provide a road map for the future. County officials are
responsible for implementing the Board’s strategy.
However, risks can threaten the success of the strategic
plan. Risk management is the process used to prepare and
protect the County from these uncertainties. County
leaders regularly identify risks that can threaten the
strategic plan, including:
• Suppressed property tax values due to legislative changes and a slow economic recovery.
• Increased proportion of retirement-eligible employees, leading to staffing issues such as high
turnover and loss of institutional knowledge.
• Increased FY 2017 pension costs.
• Continued reliance on enterprise-wide technology, while ensuring information is
appropriately secured.
• Continued pressure on infrastructure, primarily caused by population growth.
• Continued cost shifts from state government to County government.
• Increased need to balance financial constraints with best-in-class service to County residents.
County leadership has responded to these risks by:
• Reducing the operating budget and slowing spending on planned capital projects.
• Maintaining a structurally-balanced budget (recurring revenues meet or exceed recurring
expenses), which protects against unforeseen revenue declines and promotes sustainable
services.
• Investing in technology to increase productivity and provide better services to County
residents.
• Re-establishing cash reserves to address unforeseen economic needs.
To assist County leadership in its risk response, the County can be viewed as having three lines of
defense that collaborate to assess and respond to risk.
Managers and supervisors are the first line of defense against risk. They are the risk owners and
managers. They are responsible for developing and executing control procedures on a day-to-day
basis to mitigate risk and for ensuring compliance with regulatory requirements that County
departments must follow. Without managers’ support, employees may not be effective in controlling
the risk they encounter. In a perfect world, this would be the only line of defense needed; however, in
the real world, internal controls do not operate perfectly.
2

Oversight and compliance functions such as Finance, Budget, Risk Management, Procurement,
Office of Enterprise Technology, and Human Resources, are the second line of defense. They are the
facilitators who oversee risk and monitor countywide risk management practices. Several County
departments also have internal functions that serve this purpose, but often go unrecognized. As part of
our 2016 County management survey, 21 respondents indicated that they have audit or compliance
activities within their departments. These activities range from quality control reporting to inspecting
and reconciling County records.
Internal Audit is the third line of defense. Internal Audit is an independent function whose role is to
“spot check” a small number of County processes to determine that management is identifying,
implementing, and monitoring the necessary controls to prevent fraud, waste, and abuse. These
objective evaluators also serve as a resource to managers and supervisors in identifying areas for
improvement.
In addition to the three internal lines of defense discussed above, the County is also subject to external
reviews and audits from various state and federal regulators. All of these parties leverage their efforts
when evaluating County operations to ensure efficient use of County resources.
Controlling Risk is an Enterprise-Wide Responsibility
1st
Managers and Supervisors Line of
Front line operating management that owns and Defense
manages risk and controls.
Department
Managers
Oversight & Compliance 2nd
Functions Line of
Advisors that monitor risk and Defense
controls in support of management. Finance, Budget, Risk
Management, Procurement, etc.
Internal Audit
Independent evaluator
that provides
assurance to the
Board. 3rd
Line of
Defense
Maricopa County Internal
Audit Department
Source: Institute of Internal Auditors January 2013 Position Paper
3

Ethics and Fraud
The lines of defense shown previously are reinforced by fraud prevention efforts. Fraud is deliberate
deception to secure unfair or unlawful gain at an organization’s or individual’s expense. While fraud
risk cannot be eliminated, it can be managed. Fraud prevention is addressed through sound policies
and procedures, and employee training. Maricopa County management addresses fraud risk by
encouraging strong ethical behavior using the following tools:
• The County Ethics Policy outlines appropriate behavior.
• The County Ethics Handbook offers guidance for compliance with the County Ethics
Policy.
• Additional County Policies clarify specific ethical behavior (e.g., the acceptance of gifts by
County employees is prohibited). Policies are developed and approved by designated policy
teams and by County leadership to ensure current issues are addressed.
• New Employee Orientation classes teach appropriate ethical behavior for all newly-hired
County employees.
• A County Hotline, provided by the Maricopa County CARES program, provides an
anonymous tip line for County employees. This hotline may be used to report fraud, waste,
and abuse, or other employee issues. Employees can also report an incident or issue using the
CARES webpage on the County intranet.
The Board of Supervisors also addresses fraud risk by maintaining an Internal Audit Department.
Internal Audit helps to deter fraud, waste, and abuse by promoting strong internal controls in the
following ways:
• Analyzing the potential for fraud during the audit planning process
• Issuing formal and informal recommendations that may deter fraud
• Reporting significant fraud issues to the County Attorney’s Office
• Providing internal control videos and other information on its website
WHAT’S ON COUNTY MANAGEMENT’S MIND?
In addition to speaking with County leadership, Maricopa County Internal Audit conducted a survey of
County managers to aid in the identification of key risks throughout the County. This survey was sent
to 115 managers across 52 departments and functional areas. With a 30% response rate, the top 5 risk
categories identified were: 1) Employee Turnover & Compensation, 2) Budget & Resource Allocation,
3) IT and Cybersecurity, 4) Citizen Perception, and 5) Health, Safety, and Security. These categories
are consistent with most of the risks identified by County leadership. The graph on the following page
summarizes the risks identified by the respondents. Discussions of each category follow the graph.
4

Management Survey Risk Categories
6) Other
4%
5) Health, Safety,
& Security
8%
4) Citizen
Perception 1) Employee
8% Turnover &
3) IT/ Compensation
Cybersecurity 52%
8%
2) Budget &
Resource
Allocation
20%
The majority of risks identified by County management relate to employee
compensation and turnover
1) Employee Turnover & Compensation
The Silver Tsunami Could Impact County Services
The top risk identified in the County
management survey relates to the County’s more As we bid farewell...
than 12,500 employees. Similar to any for-profit
organization, the County’s workforce is one of "Of all that we have accomplished
its greatest assets, but also one of its largest together, I am most proud of the
expenditures, making up approximately 60% of County’s talented and energetic
the County’s overall operating budget in FY management team and employees."
2016. With continued pressure to compete with
private sector compensation, the County’s County Manager Tom Manos reflects on his 30
years of service as he announces his retirement
employee turnover rate exceeded 13%, on
average, from FY 2013 through FY 2015. The
Board of Supervisors remains focused on improving retention. In 2014, it approved updated salary
and job requirements in five employment areas where turnover had been particularly high.
As of July 2015, 21.7% of County employees in the Arizona State Retirement System are eligible for
retirement within the next five years, with 8.3% eligible this fiscal year. Of the 432 executives and
managers in this cohort, 15.7% are eligible for retirement now and an additional 21.1% will be eligible
by the end of FY 2021. This risk may be heightened if funding is not available to replace retiring
employees with equally qualified staff.
5

Without proper agency planning, the quality of services may suffer if a large number of seasoned
employees leave County employment. This risk is heightened if agency business processes are not
adequately documented.
2) Budget & Resource Allocation
Balancing Increased Costs with Providing Best-in-Class Service
In FY 2016, budgeted state mandates resulted in approximately $14
million of additional costs to the County to provide services that were
previously the responsibility of the State. The County anticipates
additional costs to be shifted in FY 2017. While this is not the only
financial constraint that the County faces, this and the ever-increasing
demands of a growing population make reconciliation of these
opposing points difficult. Additional costs have the potential to
reduce the County’s capacity to provide needed services to citizens.
3) IT & Cybersecurity
Technology is Costly, but Necessary
The technology landscape changes quickly and keeping up with those changes for a jurisdiction as
large and varied as Maricopa County is a challenge. While the cost of technology is high, these
investments can help the County successfully
manage risk by ensuring data is secured and
The Insecurities of Info Security available to allow for efficient management of
Only 39% of top IT executives say County operations and strategic decision making.
their organization is effective at Sound IT investment decisions should align with
detecting cyber threats and the organization’s business strategy and be
only 30% feel they are effective at coordinated across all business units. The
County’s Capital Improvement Program review
preventing them. process provides County leadership with
2016 Ponemon Institute Research Report on information to make decisions about the value a
Malware Detection & Prevention technology project will provide in supporting
services to citizens.
The FY 2017 budget for capital improvement technology projects is $100.8 million, 37% of the total
capital improvement budget. The two costliest projects are the Public Safety Radio System upgrade
($35.2 million) and the Treasurer’s Technology System upgrade ($18.8 million).1
1 FY 2017 Maricopa County Tentative Budget. Adjustments will be made to the information presented in the
tentative budget based on Board-approved changes for the Treasurer’s Technology System upgrade project
that occurred on May 2, 2016.
6

4) Citizen Perception
Helping Citizens Understand the County’s Role
Ensuring citizen concerns are heard and acted upon when appropriate is key to accomplishing County
goals. While this may seem like a simple concept, understanding the responsibilities and constraints
of County government can be a challenge, especially when the division between federal, state, and
local government is blurred. Maricopa County Animal Care and Control is one area of County
operations that has experienced challenges in bridging this expectation gap. The agency has expanded
services beyond mandated care in an attempt to satisfy public demand. However, these additional
services come at a cost. The Maricopa County Office of Communications continuously works to
provide consistent and effective communication, media relations, and community relations so that
citizens are informed of County activities and services, but there is always more work to be done.
5) Health, Safety, and Security
Always a Top Priority
Providing safe communities is an ongoing strategic priority for Maricopa County. With over 4 million
people spread across more than 9,000 square miles, the task of ensuring the health, safety, and security
of the citizens is a large one. This is further complicated by the nature of the world today, where
terrorism threats and public health concerns are high. County departments such as Public Health,
Human Services, Environmental Services, Air Quality, Emergency Management, and the Sheriff’s
Office are continuously working to provide a broad range of health, human, and environmental
services.
HOW IDENTIFIED RISKS INFLUENCE THE AUDIT PLAN
Internal Audit starts the risk assessment process by updating its list of all auditable areas (Audit
Universe – see page 10). Internal Audit compiles the list by reviewing the County’s organization
chart, budget book, financial data, and Comprehensive Annual Financial Report (CAFR) audited by
the Arizona State Auditor General. Included in the list are areas that require audits on a regular basis
(mandated audits). For example, the Arizona Supreme Court requires accounting reviews of all
Justice Courts, the Clerk of the Superior Court, and other court departments every three years.
Additionally, the federal government requires an annual audit of expended federal grant funds, which
Internal Audit monitors.
Internal Audit then assigns a risk level (high, medium, or low) to the auditable areas based on several
factors such as budget size, financial impact, and risk appetite (based on leadership input, see the
following chart). Risk appetite can be defined as the level of risk an organization is prepared to accept
before taking action to reduce it. For example, the County may not have the latest version of a
particular technology, but as long as the technology it has keeps its operating data secure and allows
for delivery of necessary services to citizens, management may choose not to take action to replace it
immediately. County leaders’ risk appetite influences the level of audit resources. For example, in
2011, the Board of Supervisors allocated additional funds for auditing the Sheriff’s Office, a high-risk
office that is now audited annually. Additional resources can increase audit frequency, which can help
lower organizational risk.
7

Factors That Influence Risk Level
Citizen Citizen
Impact Perception
Financial Leadership
Impact Input
Audit
Budget Risk New
Size Challenges
Level
In addition to auditor judgment, Internal Audit considers these six factors to
determine risk level
Once risk levels are assigned, Internal Audit develops a draft audit plan for the upcoming year by:
• Comparing risk levels with the length of time that has elapsed since the most recent audit of
each area. Areas with longer audit intervals receive additional consideration for the audit plan
because of the increased risk that control weaknesses may go undetected if an area is not
audited for a long period of time.
• Estimating and assigning audit resources needed to complete the work.
• Discussing the draft audit plan with the County’s Citizen’s Audit Advisory Committee.
• Discussing the draft audit plan with County leadership and making adjustments as needed.
After the draft audit plan has been prepared and reviewed, Internal Audit seeks formal Board approval
for the audit plan prior to the start of the new fiscal year. See page 9 for the FY 2017 Board approved
audit plan.
AUDIT RESOURCES
Acting under the Board’s authority, Internal Audit reviews controls that County management has
implemented to address and mitigate risk. A well-staffed internal audit function regularly auditing
8

high-risk areas, can help lower risk, and can be a deterrent to fraud, waste, and abuse. Most County
leaders stated that the current internal the audit frequency (on average 6 to 7 years) is acceptable.
However, they would be in favor of increasing audit frequency as the County’s financial condition
improves. Internal Audit’s body of work provides observations and recommendations that assist the
Board in making decisions that govern the County. Internal Audit completes its annual audit plan
using internal staff and external specialists as shown below:
Audit Resources
Internal Personnel
20 positions (4 positions are part-time)
External Specialists
$324,000 for subject matter experts (law
enforcement, information technology and
security, engineering, healthcare, construction,
investments, actuarial services, etc.)
FY 2017 BOARD APPROVED AUDIT PLAN
Agency Audits
Countywide Audits
Animal Care & Control Services
Contracts/IGAs/Grants
Constables
Mobile Phones
Environmental Services
Network Security
Internal Audit (External Review)
Revenue Contracts
Juvenile Probation
Single Audit Monitoring
OET Data Center
Special Requests
Sheriff’s Office – Patrol
Sheriff’s Office – IT Non-Audit Reports
Superior Court Annual Audit Follow-Up
Annual Audit Risk Assessment
Accounting Reviews
Annual Performance Report
9 Justice Courts
Citizens Financial Condition Report
Juvenile Probation
9

AUDIT UNIVERSE
The following list is intended to represent all areas within the County that are available to be audited.
To define the universe, Internal Audit divides the organization into manageable auditable activities,
which may be defined in a variety of ways, such as by function, activity, organizational unit, program,
or project. This list is updated on a periodic basis as County operations change and Internal Audit
conducts its work.
FY 2014 Audits FY 2015 Audits FY 2016 Audits FY 2017 Audits
Operational Audit Areas Assessor - Personal Property
Adult Probation - Administration/Accounting Assessor - Real Property
Adult Probation - Assessment/Development Board of Supervisors (BOS)
Adult Probation - Community Supervision BOS Clerk - Information Services
Adult Probation - IT Systems BOS Clerk - Meeting Management
Adult Probation - Other Activities BOS Clerk - Special Districts
Air Quality - Compliance & Enforcement BOS Clerk - Statutory Services
Air Quality - IT Systems Capital Improvement Program
Air Quality - Monitoring Clerk of the Superior Court - Court Records
Air Quality - One Stop Shop Clerk of the Superior Court - Fiduciary Svcs
Air Quality - Other Activities Clerk of the Superior Court - Finance/Acctg
Air Quality - Permitting Clerk of the Superior Court - IT Systems
Air Quality - Trip Reduction/Vehicle Retrofit Clerk of the Superior Court - Other Activities
Animal Care & Control - Adoptions Clerk of the Superior Court - Public Records
Animal Care & Control - Comm Outreach Constables
Animal Care & Control - Field/Facilities Contract Counsel
Animal Care & Control - Finances Correctional Health - Clinics & Medications
Animal Care & Control - IT Systems** Correctional Health - Info Technology
Animal Care & Control - Licensing Correctional Health - Other Activities
Animal Care & Control - Other Activities Correctional Health - Pre-Booking/Intake
Animal Care & Control - Revenues** Correctional Health - Procurement
Animal Care & Control - Shelter Operations County Attorney - Administration/Finance
Assessor - Administration/Records County Attorney - Check Enforcement
Assessor - GIS/Mapping County Attorney - County Counsel
Assessor - IT Systems County Attorney - Enforcement Support
Assessor - Other Activities County Attorney - IT Systems
10

County Attorney - Other Activities Equipment Services - IT Systems
County Attorney - Prevention/Victims Equipment Services - Maintenance
County Attorney - Prosecution Equipment Services - Other Activities
County Attorney - RICO Equipment Services - Parts
County Call Center Facilities Management - Development
County Manager's Office Facilities Management - IT Systems
Education Services - Consortium Facilities Management - Maintenance
Education Services - Educ Support Svcs Facilities Management - Operations
Education Services - IT Systems Facilities Management - Other Activities
Education Services - Other Activities Finance - 1099/Vendor Registration
Education Services - School Dist Elections Finance - Collections
Education Services - School District Payroll Finance - Electronic Document Mgmt
Education Services - Small Schools Finance - Financial Reporting
Elections - Ballot Preparation Finance - Financial Services
Elections - Ballot Tabulation Finance - Industrial Development Authority
Elections - Candidate Filing Finance - IT Systems
Elections - IT Systems Finance - Other Activities
Elections - Other Activities Finance - Payment Processing
Elections - Voter Registration Flood Control - Capital Improvement
Emergency Management - IT Systems Flood Control - Flood Hazard Plan
Emergency Management - Other Activities Flood Control - IT Systems
Emergency Management - Preparedness Flood Control - Other Activities
Emergency Management - Response/Recov Flood Control - Permitting
Employee Benefits and Health Government Relations
Environmental Services - Business Services Green Government
Environmental Services - Env Enforcement Housing - IT Systems
Environmental Services - Env Health Housing - Other Activities
Environmental Services - IT Systems Housing - Public Housing
Environmental Services - Other Activities Housing - Section 3
Environmental Services - Vector Control Housing - Section 8
Environmental Services - Water/Waste Human Resources - Compensation
Equipment Services - Fleet Management Human Resources - Confidential Records
Equipment Services - Fuel Human Resources - Emp Svcs & Diversity
11

Human Resources - Employee Development Juvenile Probation - Finance/Accounting**
Human Resources - Employee Relations Juvenile Probation - IT Systems/iCIS
Human Resources - FMLA/ADA Juvenile Probation - Other Activities
Human Resources - FSLA Juvenile Probation - Supervision
Human Resources - IT Systems Legal Advocate - Contracts
Human Resources - Laws and Regulations Legal Advocate - Other Activities
Human Resources - Merit Commission Legal Defender - Contracts
Human Resources - Other Activities Legal Defender - IT Systems
Human Resources - Payroll Legal Defender - Other Activities
Human Resources - Payroll System Library District - Branch Operations
Human Resources - Records Library District - IT Systems
Human Resources - Recruit & Hiring System Library District - Other Activities
Human Resources - Tuition Reimb System Library District - Support Services
Human Services - Community Services Management & Budget - Budget Dev
Human Services - Grants Management & Budget - CIP Oversight
Human Services - Head Start Management & Budget - Economic Dev
Human Services - IT Systems Management & Budget - IT Systems
Human Services - Neighborhood Stabilization Management & Budget - Other Activities
Human Services - Other Activities Management & Budget - Policy/Compliance
Human Services - Senior Adult Living Management & Budget - Program Advocacy
Human Services - Special Transport Svcs MCSO (Sheriff) - Aviation
Human Services - Workforce Development MCSO - Budget & Finance
Innovation and Collaboration MCSO - Cash Management
Integrated Criminal Justice Info System MCSO - Central Intake
Internal Audit MCSO - Communications
Justice Courts - Administration MCSO - Contracts
Justice Courts - Collections MCSO - Court Security & Operations
Justice Courts - Finance/Accounting* MCSO - Crime Lab
Justice Courts - Other Activities MCSO - Data Center
Justice System Planning & Information MCSO - Detention Capital Improvement
Juvenile Probation - Administration MCSO - Detention Classification
Juvenile Probation - Detention MCSO - Detention Food Factory
Juvenile Probation - Diversion MCSO - Detention Inmate Fund/Canteen
12

MCSO - Detention Inmate Grievances MCSO - Personnel Services
MCSO - Detention Inmate Programs MCSO - Property & Evidence
MCSO - Detention Institutional Services MCSO - Property & Evidence Mgmt System
MCSO - Detention Jail Centers MCSO - Records Management Systems
MCSO - Detention Jail Management System MCSO - Records, Warrants, and IDs
MCSO - Detention SIMS MCSO - Revenue & Business Services
MCSO - Detention Special Response Team MCSO - RICO
MCSO - Detention Transportation MCSO - SWAT and K9
MCSO - Enforcement Intelligence MCSO - Training Division
MCSO - Enforcement Major Crimes MCSO - Training Management System
MCSO - Enforcement Special Investigations MCSO - Warehouse/Surplus
MCSO - Enforcement Support MCSO - Weapons & Ammunition
MCSO - Expenditures Medical Examiner - Investigations
MCSO - Extradition Medical Examiner - IT Systems
MCSO - Fleet Management Medical Examiner - Lab Services
MCSO - Internal Affairs Medical Examiner - Medical Exams
MCSO - IT Bureau Medical Examiner - Other Activities
MCSO - IT Data Confidentiality and Security Non Departmental - Capital Projects
MCSO - IT Governance Non Departmental - Contingency
MCSO - IT Projects** Non Departmental - Infrastructure
MCSO - Jail Per Diem Non Departmental - Other Activities
MCSO - Jail Utilization Non Departmental - State Contributions/MOE
MCSO - Judicial Enforcement - Pawn Shops Non Departmental - Taxes
MCSO - Judicial Enforcement - Property OET (Enterprise Technology) - Application
Collections and Auctions Development & Support
MCSO - Judicial Enforcement - Warrants OET - Business Analysis
MCSO - Legal Policy & Compliance OET - Business Integration Services
MCSO - Network Security OET - Data Centers
MCSO - Other Activities OET - Data Loss Prevention
MCSO - Patrol Division OET - End User Security Awareness
MCSO - Patrol IGAs OET - Geographic Information Services
MCSO - Patrol IT Systems OET - Help Desk
MCSO - Payroll OET - Human Resources
13

OET - Incident Response Planning and Dev - Inspections
OET - Information Security Governance Planning and Dev - IT Systems
OET - IT Asset Management Planning and Dev - Land Use Planning
OET - IT Contracts Planning and Dev - Other Activities
OET - IT Risk Management Protective Services - Background Checks &
OET - IT Strategic Planning Badge Access
OET - Management Services (Finance) Protective Services - IT Systems
OET - Mobile Devices Protective Services - Other Activities
OET - Operating System Security Protective Services - Security
OET - PC/LAN Support Public Advocate - Delinquency
OET - Risk Register & Data Classification Public Advocate - Dependency
OET - Security Architecture Public Advocate - IT Systems
OET - Service Level Agreements Public Advocate - Mental Health
OET - Technology CIP Projects Public Advocate - Other Activities
OET - Telecommunications Public Defender - Indigent Representation
OET - Threat Intelligence & Incident Tracking Public Defender - IT Systems
OET - Virtual Desktop Infrastructure Public Defender - Other Activities
OET - Wireless/Radio Public Fiduciary - Case Management
Office of Communications Public Fiduciary - Contracts
OPS (Procurement Svcs) - Contract Monitor Public Fiduciary - Decedent Services
OPS - IT Systems Public Fiduciary - Financial Management
OPS - Other Activities Public Fiduciary - Investigations
OPS - Procurement Public Fiduciary - IT Systems
OPS - Purchasing Cards Public Fiduciary - Other Activities
OPS - Records Management Public Health - Clinical Services
OPS - Reprographics Public Health - Community Health Nursing
Parks and Rec - Fees & Other Revenues Public Health - Epidemiology & Disease
Surveillance
Parks and Rec - IT Systems
Public Health - Family Health
Parks and Rec - Other Activities
Public Health - Fees
Parks and Rec - Parks Operations
Public Health - Grants Management/
Parks and Rec - Planning and Development Procurement
Planning and Dev - Building Permits Public Health - Healthcare for the Homeless
Planning and Dev - Fees
14

Public Health - HIPAA Stadium District - Events
Public Health - HIV/STD Stadium District - Facilities Management
Public Health - IT Systems Stadium District - IT Systems
Public Health - Laboratory Stadium District - Other Activities
Public Health - Medical Records Stadium District - Revenues
Public Health - Office of Oral Health Superior Court - Civil Justice
Public Health - Office of Tobacco & Chronic Superior Court - Court Fin/Cash Handling**
Disease Prevention Superior Court - Criminal Justice
Public Health - Other Activities Superior Court - Family Justice
Public Health - Pharmacy Superior Court - IT Systems
Public Health - Preparedness & Response Superior Court - Juvenile Justice
Public Health - Promoting Healthy Lifestyles Superior Court - Law Library**
Public Health - Refugee Screening Services Superior Court - Probate/Mental Health
Public Health - Tuberculosis/Hansen's Superior Court - Property & Evidence
Disease
Superior Court - Self Service Centers**
Public Health - Vital Registration Services
Sustainability
Public Health - Women, Infants, & Children
Transportation - Engineering
Real Estate
Transportation - IT Systems
Recorder - Document Operations
Transportation - Operations & Development
Recorder - IT Systems
Transportation - Other Activities
Recorder - Other Activities
Transportation - Project Management
Recorder - Public Records
Transportation - Roadway Maintenance
Research & Reporting - IT Systems
Transportation - Traffic Management
Research & Reporting - Other Activities
Treasurer - Accounting
Research & Reporting - Surveys
Treasurer - Client Services
Risk Management - Claims
Treasurer - Investment Services
Risk Management - Environmental
Treasurer - IT Systems
Risk Management - IT Systems
Treasurer - Other Activities
Risk Management - Loss Control
Treasurer - Tax Services
Risk Management - Other Activities
Waste Resources - Fees
Risk Management - Safety
Waste Resources - IT Systems
Special Projects and Public Outreach Svcs
Waste Resources - Other Activities
Stadium District - Contracts
Waste Resources - Solid Waste
15

Countywide Audit Areas IT Governance
Accounts Payable Leases
Accounts Receivable Network Security - Active Directory
Annual Risk Assessment* Network Security - End Point
Audit Follow-Up* Network Security - Mobile Client
Capital Improvements Network Security - Virus Detection
Cash Network Security - Web Apps
Contracts - Construction Network Security - Wireless
Contracts - Health Care Programs OnBase Work Flow and Application
Contracts - IGAs* Payroll
Contracts - Other* Performance Measure Certification
Contracts - Revenue Procurement/Purchasing
Cost Allocation (Internal Service Funds) Purchasing Cards/e-Payments
Customer Satisfaction Records Retention
Data Centers/Disaster Recovery Revenues - Franchise Fees
Data Privacy and Security Revenues - Grants
E-Commerce Revenues - Highway User Revenue Funds
Exit/Entrance - New Leadership Revenues - Licenses/ Permits/Fines
Expenditures Revenues - Other
Financial Condition Report* Revenues - Property & Sales Tax/IGA
Fixed Assets Revenues - Vehicle License Tax
Grant Management Single Audit Monitoring*
Internet Usage Software License
Inventories Special Requests*
IT - Cybersecurity Assessment Travel
IT - ERP Review Vehicle Usage
* On approved audit plan for all fiscal years presented.
** On approved audit plan for two or more fiscal years presented. The highlight color
corresponds to the most recent fiscal year an area was on the audit plan.
16