Loading...
HomeMy WebLinkAboutCS 04-09 Cis REPORT TO EXECUTIVE COMMITTEE PICKERING Report Number: CS 04-09 148 Date: May 11, 2009 From: Gillis A. Paterson Director, Corporate Services & Treasurer Subject: 2009 - 2011 Internal Audit Work Plan Recommendation: That Report CS 04-09 from the Director, Corporate Services & Treasurer regarding the 2009 - 2011 Internal Audit Work Plan be received for information. Executive Summary: This report details the 2009 - 2011 Internal Audit Work Plan which provides a summary and brief description of the Internal Audit projects to be undertaken for the next three years. An update of activities since the last report to Council is also found below. Financial Implications: There are no direct financial implications associated with this report. Through its audits and reviews, Internal Audit plays an important role in evaluating the effectiveness of the City's internal controls to ensure proper stewardship over public money. Furthermore, Internal Audit contributes to an effective control environment by helping management identify and mitigate significant financial risks to the City. Sustainability Implications: There are no sustainability implications associated with this report. Background: Internal Audit Update In the Fall of 2007, the Executive Committee approved the 2008 - 2010 Internal Audit Work Plan. A total of five audits or reviews were planned for 2008. Internal Audit's final report on Animal Services Section's Internal Controls was provided to the Executive Committee in the fall of 2008. Internal Audit completed its review of the Clerks Division Revenue Controls and has issued its draft report for management's review and comments. The final report and management's Action Plan will be provided to the Executive Committee shortly. Internal Audit is currently in the planning stages of its review of the Operations Centre and will be starting the review soon. Report CS 04-09 May 11, 2009 Subject: 2009 - 2011 Internal Audit Work Plan Page 2 149 Audits that were planned for the Don Beer and Pickering Recreation Centre Arenas, Pickering Village Museum and the Information Technology area have been carried forward to the 2009 - 2011 Internal Audit Work Plan as explained below. The 2008 Internal Audit Work Plan was very aggressive in terms of the number of audits and reviews to complete. Furthermore, the Animal Services Section and Clerks Division reviews took longer than expected due to their scope and complexity. They had several objectives to cover, a large number of processes to review and many audit observations to analyze and report on. Also, the processes were examined in detail (as opposed to high-level reviews) and a significant amount of time was spent on developing the audit criteria and evaluating the audit results. Lastly, since these areas had not been previously reviewed by Internal Audit staff, there was a longer learning curve to understand the client's business, processes, risks and controls. The balance of this report deals with the development of the 2009 - 2011 Internal Audit Work Plan which is an update of the 2008 to 2010 plan approved by Council. There are no significant changes to the areas to be audited. Purpose of an Internal Audit Work Plan The purpose of the Internal Audit Work Plan is to determine the priorities of the Internal Audit activity. Establishing a Work Plan provides several benefits. - It focuses scarce resources on priority or high-risk areas. - It provides the basis for involvement of senior management in the audit process - It ensures that all areas of the City (and associated risks) are considered for audit attention. - It serves as a standard to assist in measuring the performance of the Internal Audit function. Furthermore, establishing a risk-based Internal Audit Work Plan to prioritize audits is considered a "best practice" and is required under the International Standards for the Professional Practice of Internal Auditing. A multi-year plan is also recommended to ensure sufficient internal audit coverage. Risk Assessment Process It is not possible to audit all of the City's operations during a twelve-month period. Determining which areas to audit and allocating audit resources to those areas is fundamental to an effective audit process. In order to assess the relative importance of potential audit entities and to objectively develop the Internal Audit Work Plan, the Manager, Internal Audit & Control conducted a risk assessment of the City's departments and programs in 2008. The purpose of the risk assessment exercise is to ensure that all areas of the City are evaluated from an audit risk perspective using uniform criteria and also to prioritize Report CS 04-09 May 11, 2009 Subject: 2009 - 2011 Internal Audit Work Plan Page 3 potential audit projects. The risk assessment process begins by applying the following risk factors against each audit unit. - Financial Impact (expenditures, revenues) - Liquidity of Assets - Potential for Liabilities (penalties, litigation) - Adverse Public/Political Exposure - Complexity - Last Audited - Audit Requests (from CAO, senior management) In considering the risk assessment, the risk factors were not evaluated equally as certain of them were viewed to be of more significance than others. Consequently, different weights were assigned to the risk factors, with a higher relative weight assigned to the risks of financial loss and public or political exposure. 2009 - 2011 Internal Audit Work Plan The results of the City-wide risk assessment , which included input from the Chief Administrative Officer and Director, Corporate Services & Treasurer, was used in selecting areas of the City for inclusion in the 2009 - 2011 Internal Audit Work Plan. Areas selected have a risk rating of either high or above average risk. Specifically, the Work Plan includes: - three high risk areas; and - eight above average risk areas. Attachment 1 is a summary and brief description of the internal audit projects to be undertaken over the next three years. The scope and specific objectives for these projects will be determined during the planning stages of each audit. Areas excluded from the Work Plan have either been audited in the last two years or had lower risk ratings and are listed in Attachment 2. In addition, add hoc and urgent requests may arise and the Work Plan provides for approximately 10 percent of available internal audit staff to meet these requests. The audits are to be completed by the Manager, Internal Audit & Control with the assistance of the Audit Analyst. Although the Work Plan is a multi-year plan, the risk assessment and Work Plan will be updated annually as risks and management priorities may change. In the event that audit projects are completed earlier than expected, projects planned for 2010 will be moved forward to 2009. Report CS 04-09 May 11, 2009 Subject: 2009 - 2011 Internal Audit Work Plan Page 4 1151 Attachments: 1. 2009 - 2011 Internal Audit Work Plan 2. Areas Not Included in the Internal Audit 2009 - 2011 Work Plan Prepared By: Approved/Endorsed By: mes Halsall Gillis A. Paterson Manager, Internal Audit & Control Director, Corporate Services & Treasurer JH:vw Copy: Chief Administrative Officer Recommended for the consideration of Pickering City Council C C b . Q nn, R CMM lip fT6onfas- Chief Admin s ATTACH MENT#_~_TO REPORT # _d~.' 5 2 2009 - 2011 Internal Audit Work Plan (Attachment 1) 2009 INTERNAL AUDITS Operations & Emergency Services Department Operations Centre (Roads, Parks and Municipal Garage) - The review will examine the Operation Centre's processes, procedures and internal controls over the acquisition of goods and/or services, approval of invoices and the inventory of supplies, materials and equipment (over $1 million of materials is purchased annually). Controls over the collection and recording of fees for services such as curb cutting and park permits will also be evaluated. Internal Audit will assess for efficiencies and adequacy of internal controls, and provide recommendations for improving the processes, where appropriate. Based on the results of Internal Audit's review, senior management will be giving consideration to whether a second review of the Operations Centre (phase 2) should be performed. It is anticipated that this review would cover the operational practices, resources, and processes related to the repair and maintenance of the City's roads and parks, winter control operations and management of the municipal fleet. If the second phase proceeds, the remaining audits and reviews planned for 2009 will be deferred to 2010. Arenas (Recreation Complex and Don Beer) - The audit will assist management in determining the adequacy and effectiveness of cash handling and related revenue controls at the City's arenas (Recreation Complex and Don Beer) and, if necessary, make recommendations to improve controls. Arena revenues are budgeted at over $1.5 million annually. Pickering Village Museum - The audit will assist management in determining the effectiveness of controls regarding cash handling, acquisitions, expenditures and inventories at the museum and, if necessary, make recommendations to improve controls. Museum expenditures are budgeted at over $400,000 with expected revenues of $141,000. Internal Audit Follow-Up Activities Internal Audit will follow-up on the status of outstanding report recommendations with respect to internal audits that were performed in 2007, 2008 and earlier. The audits completed included the Pickering Recreation Complex Cash Receipts and Revenue Audit, Animal Services Section Internal Controls Review, Clerks Division Revenue Controls Review and a City-wide Petty Cash Audit. 1 2009 - 2011 Internal Audit Work Plan (Attachment 1) 2010 INTERNAL AUDITS Operations & Emergency Services Department Fire Prevention and Suppression - The audit will examine the adequacy of administrative and financial controls over revenues, acquisitions, expenditures, and assets. Total expenditures for Fire Services Division are budgeted at over $10 million while total revenues are expected to be over $250,000. Planning & Development Department Planning & Building Services - Over $1 million in planning application and building permit fees were budgeted in 2008. The audit will assist management in determining the adequacy and effectiveness of the controls over the processing of applications, collection of fees, and issuance of building permits and, if necessary, make recommendations to improve controls. Corporate Services Department Supply & Services (City-wide) - The processes and controls for acquiring goods and services will be reviewed to determine whether procedures are consistent, comply with the purchasing bylaw and policies and procedures, and promote fair and open competition. This review will address processes and procedures from the identifying the need for goods and services through selection of the vendor. Information Technology (IT) - General computer controls apply to entire information systems and all software applications which reside on the systems. This review will assess the adequacy of the City's general computer controls in ensuring the proper development and implementation of applications, the integrity of information processing and the availability of computer operations. 2 1 2009 - 2011 Internal Audit Work Plan (Attachment 1) 2011 INTERNAL AUDITS Operations & Emergency Services Property Engineering - This section is responsible for implementing a significant portion of the City's capital budget (over $10 million budgeted in 2008). The audit will evaluate the management of capital projects and administration of construction contracts. Processes for controlling project costs, change orders, contract amendments, progress certificates and the release of holdbacks will be reviewed. Planning & Development Department Development Control - This section is responsible for implementing the City's development related capital budget (almost $3 million budgeted). The audit will evaluate the management of capital projects and administration of construction contracts. Processes for controlling project costs, change orders, contract amendments, progress certificates and the release of Letters of Credit and holdbacks will be reviewed. Corporate Services Department Finance & Taxation - This section is responsible for the processing and managing of tax billings ($160 million annually), collections and tax adjustments. This audit will examine administrative and financial controls over the accuracy and completeness of tax billings, approval of refunds and the effectiveness of cash handling procedures. Payroll (City-wide and Library) - Payroll represents the single largest cost (approximately $25 million annually) for the City. The audit will determine whether proper controls are in place to ensure (1) wages and salaries paid are accurate and authorized (2) payroll cheques are not issued to fictitious or terminated employees (3) employees are only paid for hours worked and (4) changes to employee master files are complete, accurate and properly authorized. 3 'JTACHMENT#4TO REPORT #-LLRO~ Areas Not Included in the Internal Audit 2009 - 2011 Work Plan 155 (Attachment 2) The areas listed below are excluded from the Work Plan due to a lower risk rating. Low Risk Administration Department - Administrative Services Corporate Services Department - Print/Mailroom Operations & Emergency Services - Administration Operations & Emergency Services - Sustainable Pickering Operations & Emergency Services - Culture & Recreation Administration Planning & Development - Heritage Pickering Moderate Risk City Council & Support Administration Department - Customer Care Centre Administration Department - Employment Services & Administration Administration Department - Safety & Employee Development Administration Department - Legal Services Administration Department - Office of Sustainability Corporate Services Department - Clerk Administration Corporate Services Department - Records Management Operations & Emergency Services - Emergency Operation Control Centre Operations & Emergency Services - Storm Water Management Operations & Emergency Services - Environmental Services Operations & Emergency Services - Community Centres/Seniors Activity Centre Operations & Emergency Services - Dunbarton Pool Operations & Emergency Services - Civic Complex Planning & Development - Administration, Information & Support Services Planning & Development - Committee of Adjustment Pickering Public Library The areas listed below are excluded from the Work Plan because they have had recent external or internal audit coverage (last two years) Corporate Services Department - Accounting Services Pickering Recreation Complex/Programs Animal Services Section Clerks Division 1