January 18, 2023 Draft Minutes
Extracted text (via pymupdf)
13545 characters
DRAFT
MINUTES
AUDIT COMMITTEE
MAIN LIBRARY – BOARDROOM
5959 W. BROWN ST, GLENDALE,
ARIZONA 85302
January 18, 2023
1:30 P.M.
Councilmember Jamie Aldama, Chairperson
Councilmember Ian Hugh, Member
Councilmember Raymond Malnar, Member
Irene Avalos, Member
Rusty Simmons, Member
City Manager Kevin Phelps, Ex-officio Non-voting Member
Budget and Finance Director Levi Gibson, Ex-officio Non-voting Member
1. CALL TO ORDER
Councilmember Malnar called the meeting to order at 1:30 p.m.
2. ROLL CALL
Present: Councilmember Ian Hugh, Member
Councilmember Raymond Malnar, Member
Irene Avalos, Member
Budget & Finance Director, Levi Gibson, Ex-officio Non-voting Member
Absent: Councilmember Jamie Aldama, Chair
Rusty Simmons, Member
City Manager Kevin Phelps, Ex-officio Non-voting Member
Also present: Mike Kingery, Independent Internal Audit Program Manager
James Gruber, Chief Deputy City Attorney
Vicki Rios, Assistant City Manager
Jamsheed Mehta, Assistant City Manager
Feroz Merchhiya, Chief Information Officer, Innovation & Technology
Arlene Chemello, Deputy Chief Information Officer, Innovation & Technology
Michelle Woytenko, Director, Field Operations
Craig Croner, Deputy Director, Field Operations
Jeff Bratcher, Program Manager, Organizational Performance Office
Chelsea Ritchie, Consulting Senior Manager, Moss Adams (Guest)
Paul Ashe, President, Securance Consulting (Guest)
Note: With Councilmember Aldama (Chair) absent; Councilmember Malnar presided
DRAFT
3. CITIZEN COMMENTS
No members of the public were present. No comments.
4. APPROVAL OF THE MINUTES
Councilmember Hugh motioned to approve the Audit Committee Minutes of the September 15,
2022, meeting as written. Member Avalos made the second. Motion carried unanimously.
5. MOTION TO CALL FOR AND ENTER INTO EXECUTIVE SESSION
Councilmember Hugh motioned to call for and enter into Executive Session at 1:32 p.m.
Member Avalos made the second. Motion carried unanimously.
6. EXECUTIVE SESSION
Review and discuss draft audit reports pursuant to Glendale City Code
§2-54b and §2-58c (A.R.S. §38-431.03 (A)(2)). Session was held.
7.
MOTION TO ADJOURN EXECUTIVE SESSION AND RECONVENE IN OPEN
SESSION
Councilmember Hugh motioned to adjourn Executive Session at 2:11 p.m. Member Avalos made
the second. Motion carried unanimously and Open Session was reconvened.
8.
CONSIDERATION AND POSSIBLE VOTE ON EXECUTIVE SESSION ITEMS
Councilmember Malnar announced that the committee would review and consider vote to approve the
following two audit reports with discussed modifications: Password Security and Fleet Management.
Member Avalos motioned to approve the audit reports. Councilmember Hugh made the second. Motion
carried unanimously.
9.
DISCUSSION ON IIAP POLICY, PROCEDURES, AND AUDIT CHARTER
Mr. Kingery explained the background of the City’s audit charter. As currently written, the charter
indicates that the Independent Internal Audit Program (IIAP) follows standards from two organizations.
The Yellow Book includes Generally Accepted Government Auditing Standards (GAGAS) and is
published by the Government Accountability Office (GAO). The Red Book is the common name of the
International Professional Practices Framework, published by the Institute of Internal Auditors (IIA). By
following both sets of standards, the audit charter makes the IIAP an “Orange Book” audit shop. For a
DRAFT
one-person audit shop, adhering to two sets of standards is very difficult due to the large amount of
administration required by each.
Mr. Kingery explained what he learned as a member of the peer review team for the City of Toronto,
which is a Yellow Book shop. When he did the peer review in October of 2022, Toronto had a staff of
around 33 people, which included one person whose sole duties involved compliance with Yellow Book
standards for the entire office. Mr. Kingery added that when he has discussed standards and peer
reviews with other auditors, as well as with the leader of the ALGA (Association of Local Government
Auditors) peer review program, those parties advised that small audit shops should choose either the
Red Book or Yellow Book, but usually not both. Per his research, Mr. Kingery determined that most small
audit shops follow the Red Book, but indicated he is willing to follow either one or both sets of standards.
Mr. Kingery noted that our audit charter needs to be updated regardless, to reflect some changes in
practice and correct some errors. He offered to present the pros and cons of Yellow vs. Red vs. Orange
Book shops, along with a revised charter and a proposed Policies and Procedures manual to the June
audit committee meeting for their consideration. He added that he was about to lead a peer review team
of an Orange Book shop in Florida, which would also provide additional insight and experience.
Member Avalos thought this was a good approach and asked if we’re okay with any approach as long as
we adhere to the corresponding standards. IIAP staff (Mr. Kingery) confirmed that was correct, and
added that ALGA recommends at least one full year of operating under newly adopted standards before
requesting a peer review. Member Avalos asked that if we changed nothing, when is IIAP due for our
peer review. IIAP staff responded that currently we would request one for FY24, but that we have options
on how to write the charter/policies/procedures to account for timeline changes if necessary.
Mr. Kingery indicated that Yellow Book standards call for a peer review every three years, while Red
Book is every five years. He added that ALGA wants the requesting audit shop to know its operations
are up and running successfully prior to getting on the peer review schedule. Member Avalos noted a
concern that if we repeatedly change the type of shop we are (Yellow, Red, or Orange Book), would that
reset the clock of when peer reviews are due and lead to us never having one completed. She wants
IIAP to ensure that the updated charter reflects that we will adhere to the peer review standard based on
which type of audit shop we ultimately decide upon.
Member Malnar asked for clarity as to if IIAP is recommending one type of audit shop over another. Mr.
Kingery noted that ALGA generally leans towards Red book for small shops, but that he wasn’t
recommending one over the other. Rather, presenting the info at the June audit committee meeting to
consider member feedback would help shape the revised charter, which is an internal departmental
change and does not require City Council action. There was no additional discussion on this item.
10.
UPDATE ON COMMITTEE GOALS
Mr. Kingery reviewed the goals that were reaffirmed by the Audit Committee during the September 15,
2022 meeting. The goals are: 1) developing a work plan for implementation of an Independent Internal
Audit Program (IIAP) quality assurance and improvement program in preparation for a peer review in
FY24, and 2) monitoring remediation of outstanding recommendations from prior audits to ensure they are
fully implemented by expected/target date. As the first goal was just thoroughly discussed in the last topic,
IIAP staff addressed the second goal.
Mr. Kingery noted that he did not include the spreadsheet of outstanding findings in the audit packet to
give the audited departments as much time as possible to provide updates prior to this meeting. Of the
findings reviewed with the committee in the September 2022 meeting, only minor updates to five of them
have occurred. Two are closed, two more are essentially closed but being further evaluated by IIAP, and
one was erroneously omitted by IIAP from the last meeting’s spreadsheet. The latter item pertained to
DRAFT
revision of the City Clerk’s policies and procedures and was still under consideration by the City Manager’s
Office prior to publishing an official revised version. Mr. Kingery said he would email the spreadsheet of
outstanding findings to the committee and offered to include it with the pre-meeting materials moving
forward. Member Avalos agreed with that approach and asked for confirmation of when IIAP considers a
finding to be closed. Mr. Kingery stated that it depends on the nature of the finding and items could be
considered closed for different reasons, but that ultimately items are closed when the audited department
has adequately addressed the recommendations as confirmed by IIAP. There was no further discussion.
11.
UPDATE ON FY23 AUDIT PLAN
For the FY23 audit plan, Mr. Kingery noted there were four assigned to staff (Property Evidence for the
Police Department, the Triennial Agreed Upon Procedures for City Courts, an Airport Compliance audit,
and another Purchase Card audit). He noted that following consultation with Police leadership and the
City Manager’s Office, and per IIAP recommendation, the Property Evidence engagement would be a
limited scope audit for a number of reasons. These reasons include internal controls already in place as
part of annual Police accreditation standards and thorough analysis of requirements for the proposed new
Property Evidence facility during its initial design stages. Mr. Kingery stated that he has completed the
fieldwork phase of the audit and will present the report at the next audit committee meeting.
IIAP staff noted that fieldwork for the Courts audit is just underway and the report for that engagement will
also be presented at the next meeting. He added that the Airport Compliance audit had not yet begun
and will likely start in the fourth quarter of FY23. In addition, Mr. Kingery indicated that the p-card audit
will probably be replaced by the Payroll audit deferred from FY22 if some automated analytics can be
successfully and timely implemented. Mr. Kingery stated that he has worked with the vendor for our audit
software (Diligent/HighBond) and the IT department to see about installing some robotics/analytics related
to payroll. This is currently going through the procurement process. Therefore, the timing of this audit will
be dependent upon contract terms and system integration/implementation.
Mr. Kingery indicated that with Moss Adams’ presentation today of the Fleet Management audit, the FY22
audit plan is complete. For the contracted audits in FY23, one of our qualified vendors (Heinfeld Meech)
is wrapping up fieldwork on the first (Field Operations Asset Management) of two audits under our current
structure. The second audit by Heinfeld Meech is Fire Asset Management, which will begin after the Super
Bowl. Another vendor, Securance Consulting, presented the Password Security audit today, and their
second audit (Third Party Risk) has a kick-off meeting scheduled for mid-February.
The remaining four contracted audits will be done by Moss Adams. The Housing (compliance) audit
fieldwork is nearing completion and will be presented in either the next committee meeting or the following.
A second audit in Community Services of the Revitalization Program will likely begin in the final quarter of
FY23. The third audit by Moss Adams is a City Fees engagement; fieldwork is nearly complete, with a
meeting on preliminary findings later this week. The fourth and final audit is a review of the Procurement
Process; IIAP is working with Budget & Finance to schedule an opening conference soon.
Mr. Kingery added that he is in the midst of a city-wide risk assessment exercise. He is gathering results
and meeting with each department’s leadership team to discuss them. Compiled results will shape the
FY24 audit plan, which he hopes to present at the next audit committee meeting. As the next meeting is
only two months away due to the postponement of today’s meeting, IIAP staff asked committee members
if they wanted to stay on the regular schedule or maybe combine the remaining two meetings into one,
possibly in May. The committee members indicated their preference was to stay on the regular schedule.
There were no other comments or questions.
DRAFT
12.
COMMITTEE COMMENTS AND SUGGESTIONS
Member Avalos thanked IIAP staff for continuing to work simultaneously on many projects, recognizing
the difficulty for a one-person audit shop to tackle so much. There were no further comments, suggestions,
or questions.
13.
NEXT MEETING
The next regularly scheduled meeting of the Audit Committee will be on Thursday, March 23, 2023, at
2:00 p.m. All committee members agreed on that date/time.
14.
ADJOURNMENT
With no further business, Councilmember Malnar adjourned the meeting at 2:34 p.m.
The Audit Committee meeting minutes of January 18, 2023, were submitted and approved this _____th
day of __________, 2023.
Michael Kingery
Independent Internal Audit Program Manager