AGENDA ITEM ATTACHMENT - AUDIT RISK ASSESSMENT REPORT.PDF

RISK ASSESSMENT REPORT 
 
 
 
 
Internal Audit Department 
 
 
 
 
 
May 2020 
 
 
  
 
 
 
 
 
 
 
 
 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Internal Audit Analyzes County 
Risks to Prioritize Audit Work  
Internal Audit defines risk as the possibility of an 
event occurring that will have an impact on the 
achievement of an organization’s objectives.  
County management is responsible for managing 
risks by implementing strong business processes 
and internal controls.  Internal Audit aids in the 
assessment of risks by analyzing the operating 
environment and identifying conditions that may 
impair the County’s ability to achieve its goals.  
Internal Audit performs audits to provide 
reasonable assurance that the controls designed 
to address risks are operating effectively.   
 
Risk Management is 
Everyone’s Responsibility 
2 
Risks Influence the Audit 
Plan 
3 
Audit Resources Influence 
the Audit Plan 
5 
Fiscal Year 2021 Audit Plan 
6 
Analyze Risk 
& Prepare 
Plan
Board 
Approves    
Audit Plan
Conduct
Audit Work
Publish
Audit 
Reports 
Perform    
Follow Up
This report describes the County’s risk environment and demonstrates how the County Auditor 
prioritizes audit areas and develops an annual audit plan for approval by the County Board of 
Supervisors (Board).  The Board, as the County’s governing body, provides resources to implement and 
maintain internal controls that provide assurance the Board’s strategic objectives will be met.

2 
 
RISK MANAGEMENT IS EVERYONE’S RESPONSIBILITY 
 
The Board and County leadership establish the direction of County operations through the 
development of a four-year strategic plan as a road map for the future.  Through the development of 
strategic goals and performance measures, County leaders and managers are entrusted to execute the 
plan.   
 
Management regularly assesses risks and 
opportunities that can threaten or support the 
strategic plan.  Procedures are developed to manage 
identified risks while maximizing potential 
opportunities.  Leaders classify risks to determine 
whether pursuing new opportunities is an effective 
use of resources for furthering County strategic 
goals.  Maricopa County’s diverse physical, 
financial, and operational environment necessitate 
that leaders throughout the entire organization 
participate in the risk management process.  
 
Governance, Risk Management, and Compliance 
County leadership ensures that the following processes are fully deployed to effectively manage 
strategic objectives: 
Governance – Overseeing operations and strategic goals by the Board. 
Risk Management – Predicting and managing risks that could prevent the County from achieving 
its strategic objectives. 
Compliance – Adhering to the laws, regulations, and County policies and procedures. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Integrating 
people, 
processes, and 
technology 
Countywide
Risk 
Management 
Identify, Prioritize, 
and Control
Governance 
Strategic Direction
Compliance 
Regulations, 
Policies, and 
Procedures

3 
 
Ethics and Fraud   
Risk management is further reinforced by fraud prevention efforts.  Fraud is an act of intentional 
deception to secure unfair or unlawful gain at the expense of an organization or individual.  While 
fraud risk cannot be eliminated, it can be mitigated through a strong ethical framework, effective 
controls, and education.  Awareness is fundamental to fraud mitigation, and is enhanced through 
effective use of the tools illustrated below:  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
RISKS INFLUENCE THE AUDIT PLAN 
Internal Audit uses a risk-based approach to develop its annual audit plan, as required by professional 
audit standards. 
 
Continuous Risk Assessment and Agile Auditing 
Internal Audit has adopted continuous risk assessment and agile audit practices to improve our 
responsiveness to the ever-changing County environment.  In addition to preparing an annual audit 
plan, we also review process level risks for many agencies throughout the year to identify audit areas, 
as illustrated below.   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Identify agencies 
& processes to 
monitor
Understand the 
organizations' 
strategic goals
Map key 
processes
Identify key risks 
to processes
Identify key 
controls
Assess 
remaining risks
County Policies
▪Outlines appropriate and
ethical behaviors
▪Addresses current issues
through regular updates
Training & Employee Orientation
▪Reinforces high expectations
for ethical behavior
Internal Audit
▪Evaluates County operations 
and issues recommendations 
that may deter fraud
▪Provides tools and resources   
to County leadership

4 
 
Organizational & Environmental Factors 
To better understand the impact of agency processes and risks on strategic goals, we met with County 
leaders and analyzed key strengths, weakness, opportunities, and threats (SWOT) for select County 
agencies.  We also identified environmental trends that may influence County operations. 
Trend Examples: 
• Housing – According to Zillow and the U.S. 
Department of Housing and Urban Development, 
County median home values continue to increase 
while apartment occupancy and rents are rising.   
• Population Growth – The most recently 
available census data shows an increase in 
County population of over 550,000 residents 
from 2010 to 2018, increasing the need for 
services.   
• Homelessness – The Maricopa Association of 
Governments Point-in-Time Unsheltered Street Count shows a growth rate of 11% in the 
population of homeless people from 2015 to 2020.   
Each of these environmental trends has the potential to impact one or more of the County’s strategic 
goals.  The table below summarizes the connection between these examples and the County’s 
FY2019-FY2022 key strategic goals:

5 
 
COVID-19 
The County deploys strategies for managing risks related to the COVID-19 pandemic.  The following 
were considered during our analysis and will be incorporated into our audit planning process as 
applicable: 
• Employee Health – Protecting employees as much as possible from the virus. 
• Workforce Effectiveness & Service Delivery – Supporting employee productivity and the 
continuation of services to County residents. 
• County Vendors – Verifying that critical vendors can provide goods and services promptly. 
• Financial – Assessing the economic effect on the County’s financial health. 
• Communications – Ensuring consistent, accurate, and timely status updates.   
 
Finalizing the Audit Plan 
 
Once risk levels are evaluated, we develop a draft audit plan for the upcoming year by: 
• Evaluating the length of time since the most recent audit of each area; the longer the audit 
interval, the greater chance that processes, people, and risks have changed. 
• Considering requirements for audits on a defined schedule and for mandated audits. 
• Analyzing audit resources needed to complete the work. 
• Discussing the draft audit plan with the Citizens’ Audit Advisory Committee and County 
leadership. 
 
After the draft audit plan has been prepared and reviewed, we seek formal approval for the audit plan 
from the Board prior to the start of the new fiscal year.  The FY2021 Board-approved audit plan is on 
page six.  
 
AUDIT RESOURCES INFLUENCE THE AUDIT PLAN 
 
The Board establishes our staffing level, balancing risk and budgetary requirements.  A well-staffed 
internal audit function that regularly audits high-risk areas can identify costly activities such as fraud, 
waste, and non-compliance, and assist management in the decision to avoid, share, reduce, or accept 
risks.  Our body of work provides meaningful assurance, advice, and insight to the Board on key risks 
so that they can make informed decisions.  We apply professional judgement and experience to 
prioritize high-risk areas and maximize limited resources using internal staff (20 positions) and 
external specialists (subject-matter experts).

6 
 
FISCAL YEAR 2021 AUDIT PLAN 
 
Agency Audits 
Adult Probation Department 
Enterprise Technology – Service Delivery 
Equipment Services – Fuel System Project 
Recorder and Elections – Election Readiness 
Sheriff’s Office – Detention (carried over from FY2020) 
Sheriff’s Office – Risk Assessment 
STAR Call Center – Election Readiness 
 
Countywide Audits 
Budget Special Requests 
Electronic Data Management and Loss Prevention 
Single Audit Reporting Compliance – Grant Subrecipients  
Other Audits Upon Request 
 
Continuous Monitoring 
Capital Improvement Projects 
Cellular Device Management 
P-Cards 
Other Areas as Determined 
 
Accounting Reviews 
Clerk of Superior Court 
9 Justice Courts  
 
Non-Audit Reports 
Audit Recommendations Status Report 
Citizens’ Financial Condition Report  
Countywide Risk Assessment 
Internal Audit Department Performance Report