We would like to call to order the uh meeting of the audit committee for May twelfth twenty twenty six.

Can we have a roll call, please?

Chair Shudy.

Here.

Vice Chair Lambin.

Here.

Member Duke?

Here.

Member Scalia.

And Member Stack.

We have a quorum.

Thank you.

Next on the agenda are public comments and discussion.

I do not see anyone here from the public, but the public is invited at this time to provide comment on any topic that relates to a matter over which this public body has supervision control jurisdiction or advisory power, including any such matter that is not specifically included on the agenda as an action item.

No action may be taken on a matter raised during this period for public comment.

I do not see anyone from the public.

Center recommendations.

Sherry, take this away, please.

Thank you very much.

Um, CFO Sherry Russell Benaboo for the record.

And um, the first page I'm gonna direct you to is page 17.

It's the payroll processing assessment.

I do have three items I want to talk to you about today.

Um, the first one I'm recommending closure on is item number one on the payroll processing.

Um, this one was um a policy that we were waiting to get through the system, and it is complete and in policy tech.

Um, it has our detailed um payroll procedures, defines the staff involved, the timeline, and um, you know, time sheet submissions, that kind of thing.

So um that is complete, and I am recommending closure.

The second item I wanted to talk about was on the next page, the purchasing and contracts management review.

Um, this one is complete.

Um note that it's completed early.

Um, it was expected to complete 6 30 2026.

Um, but I always ask, and um this one was completed.

Um this was to reinforce our policy and um have some training on it, and so um we did do that.

The purchasing policy was um updated, we had trainings um for 25 participants on March 17th and 13 participants on March 24th.

Um, and she also created a Teams group so they could have a better communication for questions and discussion about purchasing, so um, I would like to close this item as well.

And back on page 20 for asset management review.

Um this one I I did a I oopsied.

Um I was supposed to bring the um deleted capital assets for 2025 along with the CIP plan because I thought there'd be a better synergy when you're talking about buying new CIP versus what we've gotten rid of.

So I it was a great idea.

Um, and then I forgot because the budget's very intense.

There's a lot of information, and so um I am going to take this to the May 21st meeting, the final budget, and then um have a discussion with the board as to when they want to hear that item.

Um it used to be brought with the um final financial report, which there really wasn't a synergy here.

It was like here's our financial report.

There were no findings.

Oh, and by the way, we got rid of these assets.

So it wasn't, I didn't know I didn't think it was a great time to give that information out.

So I tried to move it and that didn't work because I'm too busy during budget.

So um, so anyway, I will take it to the 521 meeting and and make sure that those deleted items are seen by the board.

Um, but I am asking for an extension on that one.

Uh and quick question on that one.

So that is really there's that's not a time sensitive.

It's not, and it's not even something that needs to be approved.

It's just in our policy for CIP, we let we have in our policy that we always let the board know what the deletions are, and so it's something that I do need to bring before the board so they can see it.

Um, but I haven't done that yet.

Okay, so are there any questions or comments regarding the two items that are before us?

Okay, one, nothing for you.

I have just one quick question on the timesheets that were moved to Friday by five, and I I remember that conversation, but I don't remember the why behind um moving it to the Friday.

It's just to give the staff a little more time to process payroll.

It used to be due um Monday, the Monday at 10, but we have to have it into the bank by Wednesday at two.

Okay, and so um we spent most of Monday morning chasing around timesheets that weren't submitted.

Um, so we couldn't really start payroll until like noon on Monday, and so it was starting to be where she was working overtime all the time to try to get payroll done.

Okay, and so the solution to that was to move it back to Friday at 5 so they could spend the first hour Monday morning chasing around timesheets and then and then she wouldn't have to work any overtime.

And that has been working better, yes, much better.

Yeah, great.

Okay, then um, if we can have a motion, please.

I'll do a motion.

Okay, um, I move to recommend to the board of supervisors closing the items discussed based on the correction.

Excuse me, findings and recommendations included in the audit findings tracking report.

And I would second that motion.

All right, all in favor.

Aye.

All right.

Um that's all of us.

So motion carries.

All right.

Okay, our next item for discussion only.

Discussion regarding fiscal year 2026 audit work program update and fraud, waste and abuse hotline activity.

Sherry.

I know.

I'm actually going to turn this over to Audrey Donovan, our audit manager.

Hi everyone, audit committee.

Appreciate being here today with you all.

Can you hear me okay?

Yes.

Okay, excellent.

So the update is going to include fraud waste and abuse hotline, which we meticulously monitor that.

I was just in there yesterday and Monday as we get closer to the audit committee date.

I want to make sure we're not missing something.

Then because we won't see each other for another month and sometimes three months.

There is nothing to report at this time that's related to Carson City.

So zero reports on fraud waste and abuse.

And the second item is the update on the internal audit plan.

We have executed or in process of executing the finalizing the risk assessment update and the public guardian engagement, which will be read out to you all next month, the final report for the risk assessment and the public guardian report.

Everything else has been delivered and we have invoiced up to we have about 20,000 left to invoice.

So these last two engagements will put us right at the budget.

Okay.

Any questions or comments for me?

I don't have any any questions.

I am going back and listening to previous meetings, and I know public guardian has we've discussed it quite a bit, you know, with new leadership and policies, and so I I am happy to see all of this kind of come to fruition and the audits completed.

So thank you for your help with that.

Thank you.

Okay, then uh item five C for discussion only discussion regarding the proposed internal audit services based on annual risk assessment procedures performed by ID Bailey for fiscal year 2027.

Thank you.

Thank you.

So this is our first item.

We typically have a discussion in March through May-ish about what items we want to look at in 2027.

So this is where you have the chance to throw out concerns you may have.

And we kind of all come to an idea of what we want to do for 2027 audit plan.

Um and then next meeting, I will bring the final audit plan and the risk assessment, and together we can um actually vote on it.

But today is just a discussion.

So I'll turn it over to Audrey because she did the risk assessment and you guys can talk and I'll make notes.

Thank you all.

Yes, thank you, Sherry.

Yes, hi.

I do have Kathy Villemar joining me today.

She assisted with the risk assessment update, and we do have six topics that we wanted to discuss with you, but I'll turn it over to her and then I'll jump in as we move along.

We'd like to make this a collaborative discussion.

So any questions, comments you have, and if there's anything that you're seeing that you that you thought you would be seeing, let's raise that as well.

We want to bring anything to the table that you may have from your lens in the community and um your lens from these operations.

So I'll turn it over to Kathy and then we will open it up to discussion.

All right, um, thank you, Audrey, and good afternoon, everyone, and thank you for your time today.

Um, as mentioned by Audrey and Sherry, we will be briefing the committee next month on the final risk assessment update and results, and as part of that process to finalize the risk assessment um and proposed internal audit plan, we wanted to take this time to share the potential internal audit topics that we have identified as a result of the risk assessment update.

Um, the topics we will discuss today reflect areas where risk change or complexity suggests internal audit could add value.

Um and again, this is not a finalized um audit plan.

Um we wanted to discuss this today to get a consensus and approval of the audits to be included in the FY27 plan.

Um the feedback we get from you today will help inform how we ultimately um refine and prioritize the internal audit plan that accompanies the full risk assessment briefing next month.

Um with that said, um I'd like to walk through the proposed internal audit topics at a high level.

Um the topics we're proposing include a cybersecurity penetration testing, um, a benefits compliance assessment, a fire department overtime assessment, um, a franchise fee review, um, a building department review and finally a human and health services billing process review.

And um I would like to open it up for discussion.

We're of course interested in your input on these topics and whether or not you believe these were in consideration, and whether there are topics that you feel should be discussed that have not been listed and you'd like considered in the FY27 plan.

So I open it up to the board for your feedback.

Thank you.

Would anyone like to start or are there I um going through this the fire department um that has come up the last couple of years, the overtime assessment.

Um I know previously there had been an audit in terms of um pay or something, and and so uh seeing the overtime assessment come up time and time again.

I think um it would be appropriate to proceed with that.

Uh I think in light of uh the cybersecurity issue that the state faced last fall.

Um that is should be a priority.

Uh the building department, I for the reasons uh within the packet, um, you know, that opportunity to uh to look at things during the stabilization and training.

While I think it would be helpful, I also think it is so new that I almost uh feel that um next year would be a more appropriate for the building department review.

And so those are um my top so cybersecurity fire department, um, and then I'm I'm in support of benefits compliance franchise fee, uh, and the the billing with health and human services.

I imagine there are, you know, it is such a highly um, you know, the so grant-based, many of their services, Medicaid-based, all of that, and that um is a bit in flux or um potential flux that I I think that is also an appropriate um assessment.

So those are my thoughts.

Any other I can give a little information.

Thank you.

Um on the fire department, we did it um in 2019, so it has been about seven years.

And um we were looking at overtime primarily, and they didn't have um code set up in telestaff to differentiate why they were using overtime.

So at that time we implemented code.

So it would be a good exercise to go back and see if they're using those codes, what the overtime's for, and kind of maybe um benchmark if there's a way to reduce overtime.

It's also wasn't part of that if like wild land they were sent out to another fire and then some of the billing and then yes, that's the problem is some of it is reimbursable and some of it's because of vacations and sick, but a lot of it is because it's they're going out into um region other regional areas and doing firefighting, and we get reimbursed for that.

So um so backfilling, you know.

Um so yeah, so I think it would be a good exercise to revisit it.

Um and then the cyber security penetration, it has been almost sixty years since that last penetration testing we did, and I 100% agree with what happened to the state, it's probably a good idea to revisit that.

We did just do the benefits compliance testing with HR in 2019, which again was six or seven years ago.

Um, so it's you know, we could look at that again.

Um that to me is not as critical.

Um we have never reviewed franchise fees, and we've never done a process on the HHS billing either.

So both of those areas would be good because we've never done an internal audit on them.

So perhaps um then the the priority the cybersecurity and fire department and then um followed by franchise fee and um billing.

And then to wait, you know, I guess depending on um how much money and um the scope that we're interested in, um potentially wait on the benefits and the building department, uh unless that there's ample funding, which haw I don't anticipate that um and I know that uh uh we are still at the 110,000, and I know that that was a conversation the last couple of years as well.

Um hopefully eventually there'll be funding to increase um the money for that, but we it is what it is.

So is everyone comfortable with that?

Uh I am uh actually the company I work for um we have quarterly meetings, uh one of which was this morning, and cyber security is almost four on the forefront of uh our conversations.

Uh I think uh one of the folks um made a comment that uh um you know the uh attacks are up almost tenfold.

This is a corporation out of Canada, but um they're growing their uh footprint here in the US.

Um so I would totally agree with the cybersecurity.

The other is the um HHS billing and process, is in the news so darn much.

We're just now hearing about billions of dollars in Ohio.

Is any of that headline stuff?

I don't want to pile on, but is any of that related to where not that we have issues or anything like that, but if it is related, then it would be worth saying that it's worth looking into it.

Yeah, um, so I think some of that in the headlines um where PPI is stolen and it costs lots of money, um, where personal information is stolen.

Um that will be hit with the cyber cyber one.

But um HHS billing we outsourced for a little while, and I think we're back in sourcing.

And so we just want to um, you know, review that process and, you know, see if we can't if it's best to have it in-house or it's better to outsource.

Um, I mean, like I said, we've never done an internal audit on it.

So um there could be issues, there could not be, you know.

I mean, you've seen doctors hauled away in chains for miscoding you know, Medicare bills.

Um, so this stuff is important, and it it it's I agree it's important.

So this is an opportunity for that baseline.

Yes.

And to really see where we're at.

Yes, see what we're doing, make sure we're coding things correctly.

Just and then with the fire department.

Did that is as you've kind of mentioned it, did it kind of come to a comfortable conclusion that it wasn't.

I mean, I've I've managed my share of people, and uh, you know, overtime is an easy thing to mismanage, you know, not pay attention to what you're doing, or it doesn't have to be fraudulent, but it can be just sloppy.

Um, but it keeps my understanding and going back, it it hasn't, we haven't done this audit since we did the audit in 2019 for fire station overtime.

Yeah, so that was um pre-COVID pre-um.

The wildland fire pre-the-new station, pre-the-wildland firefighters.

Um, so all of that stuff is new.

Uh, we did get the raise grant, which gave us nine firefighters, and the overtime did decrease for one year.

It was a three-year grant.

Um, so I just think this is a good opportunity to go in and make sure they're using the coding that was set up for them so we can see where their overtime's coming from.

Um, and then you know, make decisions based on that, you know.

If it really overtime is being every time there's a holiday, it's overtime.

Every time somebody takes a vacation, there's overtime.

You know, if it really is that, then maybe you know, we need to look at hiring some more firefighters to fill that gap because it'd be better to just pay a regular firefighter than continually paying overtime for everybody.

But um, but this would be a good you know, baseline to tell us where we are.

Right, thank you.

You're welcome.

So uh is that helpful?

Um in terms of of um the direction we want to go in.

Or thank you, audit committee chair.

This is Audrey.

So we find this we find this very helpful.

So if I could reiterate the primary one would be cyber, followed by fire department, the overtime uh franchise fee, and if there's any budget HHS, did we need to talk about potentially reordering those based on budget for prioritization of which engagements to be absolutely included on the FY27?

Would so it's is this group is it that we'd like all four to be for sure included, or is there some flexibility on HHS?

I think my decision's gonna come after I see what it's gonna cost or what our budget's gonna shape.

Okay.

So question, can I ask a question?

You bet.

Okay, thank you.

Um, Audrey, um, for the franchise fees, um, we like I've always wanted to dig in and do an audit on those, but um NRS doesn't allow us to go out to you know, Sierra Nevada and the telephone companies in order to do an audit.

So would you how would you look at that?

Would you do benchmarking or what's what's the process there?

Just high level.

Yep, so high level on this one would be to look at the completeness of your franchise fee agreements.

We've done a number of these engagements and find that there are um outdated, long outdated contracts that have expired upwards of 50 years ago.

So to have the right terms and conditions that you could go back on legally to enforce, we need to have a current agreement, and we also need to have um audit clause in there.

So if we do need to dig into records, you guys have the ability for us to go in there and ask for that.

Um, whether or not these agreements are clearly defining the terms, the calculation basis, the reporting requirements, the payment timeliness, um, those requirements to ensure that the franchise fees are being paid completely timely and accurately would be included in looking at those contracts, and whether or not there has been any formal updates to those contracts.

Um we know that there are many ways that we could look at this from a revenue leakage and compliance aspect.

And Cherry, you brought up one of the biggest hurdles is the ability or inability to dig into these records.

Um, so it would be scoping this out um to determine what else we could do.

Um we can go into the completeness and accuracy of the reports that are being provided, the timeliness of those.

So what are the reported gross receipts, the net profit of the entity, the other fee bases that are consistent just to see if they're consistent with the contractual and the statutory definitions?

So those are the two angles that we feel we could accomplish.

And once we understand the contracting terms and language and what the audit clauses would allow for, we may be asking and seeking a second phase on this to if we can get access to these records, we'd like to look to see that the revenue is looked at from 100% completeness, meaning that the residents within the boundaries of the city of Reno are identified and then bumping those up against the franchise fee data to ensure that they are capturing all the residents within the boundaries.

Is there revenue that is not being collected that should be and reported to the city?

Thank you very much for that, Audrey.

Um, we are Carson City though, not Reno.

Did I say we know?

Oh good, all good.

Thank you.

I apologize.

No worries, no worries.

Okay.

All right.

Um, we look forward to to see the um the the presentation and and uh the outline of the scope and the costs and all of that.

We'll move forward.

Yeah, and we've been sorry to interrupt you, um Madam Chair Audit Committee members, um, based on what we believe we could accomplish with these risks and ensure that we can establish how to mitigate these risks, meaning we've identified what the root causes and then how we can form recommendations to address those root cause.

Um we've gone through and identified these types of um areas that we can accomplish and a preliminary budget.

So for the franchise fee for the completeness of all the contracts and the accuracy and the completeness of the franchise fee reporting, we are estimating that that would be a $30,000 budget.

And so if we were to even just say two more at $30,000 apiece, we're at 90,000.

We also have the oversight of the um performing the risk assessment update again and monitoring the fraud waste and abuse hotline, and if there's any follow-up action that needs to happen, we're here to support that.

So we have outlined roughly um 30,000 for three engagements.

Okay.

Even if we were to say do one for 25, that really would mean one's 25, one's 30, and one's 35.

So on average, 30 apiece, which is why I brought up initially your top three.

Um, unless we get a budget increase, I don't see squeezing a fourth one in there unless we drastically reduce the size of these engagements and the scope.

We can scope these to any budget.

If you want $15, 25,000, we can scope them that way, but to bring you an engagement that we feel adds value, they're between 25 and 35.

Okay.

Thank you.

Thank you.

Okay, so then yes, and if I'm understanding correctly, the priorities will be the cyber security, the fire department over time and the franchise fees.

Is everyone comfortable with that?

Or well, I guess we'll find out.

I know HHS, sorry to interrupt again.

I know HHS is an important topic.

We also do realize that for us to get in there with this new billing practice, the timing wouldn't be until the beginning of next year.

Similar to the billing department, the right time would be next year.

So these two would be right for said FY28 plan, and we could start moving into that next year.

Those two.

Okay.

Oh, I see.

So it could they could align well together, potentially.

Yeah, the timing.

The timing, right?

I mean, they could roll over into FY28.

That's the word I was looking for.

Okay.

All right.

Well, thank you very much.

Any other discussion?

No.

Okay.

Um then that would take us to item 5D for discussion only.

Consideration of dates for the next meeting.

We did previously set the meeting for June 9th.

However, I'm out of town on June 9th.

Hopefully doing something fun.

Visiting mom.

Oh, that's excuse.

So if there's any way we could move it to the 16th or the 23rd.

We haven't been there in New Orleans.

On both those days?

The 23rd.

Does the 16th work?

The 16th works for me.

Okay.

Okay, we'll tentatively set it for the 6th 16th, and we'll send it out to the rest of the committee and see if we can get everybody.

New Orleans, that's nice.

Ah.

That's well deserved.

They got some good Cajun Spice down there.

Yeah.

New Orleans.

All right.

Okay.

Then next agenda item, agenda item six, public comments.

Invited to comment anyone.

Masses of people.

Okay.

Well, um, then Audrey and Kathy and Christine, thank you so much for um the meeting and and for um bringing uh what I I feel some wonderful um suggestions for the internal audit topics, and so appreciate everyone's time.

And so uh I will adjourn this meeting.

Thank you, everyone.

Thank you.

Thank you.