I would like to call the uh audit committee to order.

Um, can we please have a roll call?

Chair Shuddy.

Here, Vice Chair Lambon.

We have a quorum.

Thank you.

Um next on our agenda public comment.

Uh is anyone in the public who would like to make public comments.

Seeing none, we go to agenda item four, uh, for possible action approval of minutes.

Corrections or changes.

I would move that we accept the minutes from last reading.

I'll second.

Excellent.

All in favor.

Aye.

Aye.

And anyone opposed or abstained.

No.

Thank you.

Minutes are approved.

Then next on our agenda, five A for possible action.

Discussion and possible action regarding the monitoring, review, and closure of previous internal audit findings and/or recommendations, including in the audit findings tracking report and a recommendation to the board of supervisors to close completed findings.

Are you for?

I'm sorry, you're reading five.

I am I'm sorry, I am reading from the last meeting notes.

Okay, let's try this again.

I thought it just was reading weird, so my apologies.

Let's try this again.

Meeting items 5A, take two.

Okay.

For possible action, discussion and possible action regarding report prepared by the Carson City Internal Auditor, Id Bailey, LLP for fiscal year 2026 audit work program concerning the Carson City Public Guardian Asset Management Assessment, including findings and recommendations.

That makes much more sense.

That's the one, yep.

Um Sherry Russell Benabuchi Financial Officer for the Record.

And I'm going to turn this straight over to Audrey Donovan and her team for to go over the findings.

Hi, Audrey.

Thank you, Sherry.

Hi, thank you.

Audrey Donovan, senior manager with ID Bailey.

And I do want to thank you, audit committee chair and audit committee members for being here today.

Kathy has prepared a briefing for the public guardian asset management assessment.

And then we also, I notice they are in attendance as well, the public guardian and deputy public guardian.

Um Kathy, I'll go ahead and turn it over to you for the briefing.

Alright, thank you, Audrey, and good afternoon, everyone.

Um I will be walking through the public guardian review here, and um at this time we would also like to express our gratitude to everyone involved in conducting this engagement, particularly the public guardian, of course, hello, and the deputy public guardian, and um, of course, our amazing nays and sherry.

So um the public guardian asset management was identified as a risk area in the FY25 risk assessment report.

Oops, sorry.

Um risk assessment report, and as such, it was approved as an internal audit project.

Um the objective of this uh review was to assess the adequacy of controls and procedures in place to protect the assets of wards under guardianship from laws, misuse, or unauthorized transactions.

The scope of the engagement was for the most recent fiscal year from July 1st, 2025, through current operations.

The assessment found that CCPG has implemented adequate controls and processes to safeguard ward assets.

We found no exceptions identified in the completeness or accuracy of um case transactions during testing.

Case files were well maintained and transactions were consistently supported by appropriate documentation.

CCPG is also improving operations by transitioning to digital records and eliminating the need to store physical valuables, reducing the risk associated with that.

Overall CCPG demonstrated practices which support effective asset management and compliance.

We also identified two findings with accompanying recommendations, um, to strengthen CCPG's internal control environment.

The first finding is on policies and procedures.

CCPG has policies and procedures in place that has been developed over time as processes has evolved but have not gone through a formal review or update process.

Our recommendation is to build on what already exists by updating and strengthening those policies to better reflect how things are currently done.

That includes assigning ownership, um, setting a regular review schedule, making sure that the documentation clearly outlines key controls, responsibilities, and expectations.

These are practical steps that can help improve consistency and make it easier to demonstrate that controls are operating effectively.

Um the second finding relates to formalized review and oversight controls.

CCPG has appropriate controls in place, such as approvals, reconciliations, and oversight.

However, we noted that these activities are not consistently documented.

In our testing, most transactions had proper support, but often did not include clear evidence of reviewer approval.

Similarly, reconciliations were completed but didn't consistently show who prepared them, when they were completed, or whether they were reviewed.

In a small team environment where segregation of duties is naturally limited.

Documented review is especially important because it serves as a key compensating control.

Without that documentation, it becomes difficult to demonstrate that controls are consistently applied and independently validated.

Our recommendation is to focus on making these controls more visible and consistent through documentation.

Additionally, CCPG can implement a simple process to track and resolve discrepancies and leverage existing system tools and basic automation to improve consistency, visibility, and accountability of control activities.

These steps will significantly strengthen oversight and make it easier to demonstrate that controls are working as intended.

Management is in agreement with the recommendations and has actually implemented or is in the process of implementing most of the action items recommended.

And with that, we're happy to answer any questions you may have regarding the report.

Thank you very much.

So has everyone read through this?

And are there any comments, any questions, any considerations, concerns?

Celebrations.

Alright.

As you said, Lisa, it really is worth celebrating.

The last time we did the public guardian, I think they had 20 findings.

So Sandra and her team are doing an amazing job and um, you know, a CFO, I just want to thank you.

Yeah, I second that.

And and even with the recommendations, you know, I I see um, you know, especially the second one, it's making the controls visible.

It's sounding like you already have them in place, but you haven't documented that they have happened and so um and just kudos that you've already started to implement these things.

Uh is there anything you would like to add?

And if so, you can come up here and speak to it or awesome.

So, after we received the report, we immediately I think part of it was already in progress because we did outsource comprehensive uh standard office procedures, which will be slated to be completed uh this month.

And so it's a total of five volumes.

Uh, one volume covers just financials alone, so it's very very extensive.

So we've that that should be done in the next couple of weeks.

And then to address the findings in two, we've already uh purchased stamps, both preparer and approval stamps, so then you have that visible uh showing that we are internally uh preparing and reviewing those documentations.

So, and we've utilized uh one of the QuickBooks tools, which was already enabled in order to track user profiles.

We are currently working with IT.

It should take approximately about 30 days or so.

We were just advised of that a few days ago.

It for them to adjust the user profiles so they correlate to a specific person within the office.

So if you ever have to go in there and see who made an adjustment, you'll be able to see who that individual was within the office.

So I think that safely covers all the key points that uh were found as internal issues within our department, and so we're already executing and we'll finalize them, you know, in a very short amount of time.

Wonderful.

Much appreciated, and thank you for the good work that both of you as well as the team do on behalf of citizens in Carson, and it's such an important service.

So thank you.

Thank you.

We appreciate it.

All right.

Well, then, is there any other discussion, or would someone like to make a motion to approve the report?

Um, and it sounds like staff is already working on the recommendations, so um, but to approve the report.

I would uh second the congratulations and a thank you very much for all the hard work and initiative.

It's wonderful.

I also move that uh we would approve the um report presented by the uh the auditors as presented.

Is there a second?

Yeah, I'll second that.

Great, thank you.

All in favor say aye.

Aye, and that is unanimous.

Thank you very much and well done.

Thank you.

Okay, we are now going to agenda item 5B for possible action, discussion and possible action regarding the monitoring, review, and closure of previous internal audit findings, and or recommendations included in the audit findings tracking report and the recommendation to the board of supervisors to close completed findings and or recommendations.

So we only have one to close this uh this time.

I mean, we met a month ago, so um, but it's on page 31 in the asset management review, and it's uh finding number one.

Um, this is the one I talked about um regarding presenting the capital asset disposals to the board.

Um I had this great idea, it didn't pan out.

Um, the board actually told me they would prefer to see it with the audit as we have done in the past.

So um I did present it on 521, they did see the disposals, and going forward I will present it um in December with the audit.

And um uh Eagle Eye Lisa found uh um spelling error, so I will fix that seek and uh I will add a status update to this so we can remember what we talked about today.

And and for the record, it was a great idea.

It really was.

And you know what?

Everybody's brain works differently and what what uh um fits in uh you know it we we all have a different brain, and so um I was actually kind of following your your path, um, but it's it it all works.

So thank you though for the great idea.

Absolutely.

Uh okay, is there any discussion on this one or does anyone have a problem with closing this particular item?

I have a question since I wasn't here.

On average, how many capital items are disposed annually?

I mean it depends.

Um I believe last year there were maybe 50.

Um, sometimes we have seven, it just depends how many old assets we have.

Yeah, I I kind of like to remember.

It's usually two to three pages of the spreadsheet if that helps.

I kind of like your idea better too.

I was just kind of wondering about the volume because that's a lot to look at at once.

But well, I I don't know.

I it was, you know, kind of the synergy of the disposal versus the new, and um but but it does make sense to do it with the audit too because that's when you're actually disposing of them.

So I'm open to both, and and the board wants to hear it during the audit, and that's perfectly fine.

Obviously, it's a little easier for me to remember during the audit because I completely forgot during the budget, so um, there's just so much going to the board during the budget, so it'll work out better this way, I think.

Well, that's good.

Alright, then um, is there a motion?

Someone like to make it.

Can we move the I motion that we remove item as listed?

Is there a second?

I'll second.

All right, um, all in favor, aye, and sounds like it's unanimous.

So thank you.

That one taken care of.

Okay, agenda item 5C for discussion only.

Discussion regarding fiscal year 2026 audit work program update and fraud, waste and abuse hotline activity.

Turn this over to Audrey again.

Thank you.

Thank you again, audit committee chair.

Not audit committee members.

Want to quickly give you an overview of where we're at with the FY26 plan, the internal audit and related activities that have been completed for this year.

They include the risk assessment update for FY27 in the work plan for that fiscal year.

We have been assisting where needed in the follow-up procedures, and then also monitoring the fraud waste and abuse hotline.

The activities that we have completed.

Get over to my other screen.

And that was to assess the controls and the procedures in place, as Kathy mentioned, to protect the assets of wards under guardianship from loss, misuse, or unauthorized transactions.

We have delivered the capital asset accounting engagement, and that one was to evaluate the city's accounting for capital assets across the full life cycle of capital asset activity, and that included acquisitions, capitalization, depreciation, and disposal.

We also assess the effectiveness of internal controls over the capital asset accounting and compliance with applicable accounting standards such as GASB 34.

The last engagement that we completed is the credit card payment security and compliance review, where we assess the effectiveness of vendor compliance, cost efficiency, PCI compliance, and fraud prevention across applicable city departments that were under the taking city credit cards, so PCI compliance was a requirement.

These have been completed, and I'm pleased to say that we have been on track and on budget.

And following this meeting, we will invoice our final invoice, which is oh, I think it's roughly 17,000.

That's remaining of the 110,000 budget.

So on track and on budget.

And that concludes our briefing for FY26.

Well, thank you and um well done.

Well done.

Were there no fraud waste and abuse?

Was there anything on that?

Oh, I thought that was a different agenda item.

And I've looked at every week.

I'm looking at the fraud, waste and abuse hotline.

I hopped in there before this meeting this morning, and there was no reported activity there.

The last report that we received through the hotline was October of last year.

Great, thank you.

And you had reported on that before I remember.

Yes, okay.

Thank you.

Okay, agenda item 5D for possible action, discussion and possible action regarding the annual risk assessment and a recommendation to the board of supervisors for the internal audit plan for fiscal year 2027.

And Sherry and Audrey I'm sure.

Yeah, I'm gonna put a wrench in this and you guys.

Um I'm wondering if it's possible, Audrey, if um we can uh reduce the franchise fee, and and of course, audit committee.

Let me know what you think about this.

Um if it's possible to reduce the franchise fee assessment a little bit, the scope and um add to the next year's um internal audits, uh something to do with sales taxes.

If I can get um the list of car sales for the last two years, um, who reported to the state before their revenue um change and who reported after, if it's possible that you guys could help assess who's missing or the completeness of the sales taxes.

Now I'm not positive I can get this information from the state, but I'm working with them to try to get this information.

Um, and I'm hoping it wouldn't be too large of a project um maybe five or ten thousand dollars um I'm only looking at pulling about four or five of the larger um taxing um categories I guess um out and then getting the lists for those and just making sure that what we had before the revenue conversion from the state is the same as what it's after.

Does that sound like something that's possible Audrey first off.

Oh yeah it um I think it's warrants a a discussion related to scope on all three of the engagements rather than a reduced scope on franchise fee as the funds I don't think the lowering of the scope is going to add value and give you enough um of the fund the budget available to pick up the sales tax to your auto sales that you're talking about so this I believe warrants a a larger discussion and may incorporate the scope for the fire department over time.

I do know that the cyber security pen test the scope that we currently have there the fees of 35 is the minimum for that project.

So there would not be anything to reduce there and so it's I guess it's really just fire and franchise fee.

Yeah.

Is there a means we wouldn't be able to get dollar amounts it would it would be straight um entities who reported before the conversion versus entity who's who reported after and if we were who is missing kind of um engagement.

Yes.

So we would pick like car dealerships and and merchandise I mean just the just the bigger categories um food sales you know that one actually sounds more interesting than the franchise fee.

Well I mean there's a larger potential for reimbursement if if there are there are missing entities so um that was the idea was that maybe because franchise fees is going to be tough to go out and actually audit the other entities.

Yeah you had mentioned that at the last meeting as well so we can do a completeness and then try to go after if they haven't reported to us.

But you know the sales tax the mayor had spoken with the governor and I think I have a a person a contact person over there that will get me the information I'm looking for so this could help us as a city.

And so are you it's it's sounding like it wouldn't be beneficial to reduce the franchise fee assessment to fewer hours to reduce the scope so do you um yeah do you do see then us doing the franchise fee next year potentially because I do think going back and listening to the discussion about the franchise fee and the benefits of it to make you know to audit that I think it is an important project obviously because it rose to the top three that said um if I hear what you're saying and so would you know depending uh Audrey on what the numbers look like and all or or your um high level view opinion um if we postpone franchise fee assessment for next year, and then uh substitute what you are recommending.

Is that something yeah thank thank you, audit committee chair?

I think that that's an excellent idea, and maybe even at this point we pause the franchise fee assessment to ensure that Sherry can get the data that she's looking for from the state, and if and when that data is obtained, we can simply move the franchise fee, like you said, to the fiscal year in next year, following year, and swap this um data, the prior pre and post conversion data for this one.

So discussion.

Is there a hesitation?

Um, okay.

I just I'm trying to read facial expressions, all right.

Um so what if we uh deleted the franchise fee uh assessment for this year?

Um would you replace it with another topic?

If so, what would that be?

Or would you take the funds and put it back into one and two?

Given that uh, you know, I think Audrey had said that uh we can't cut, we cannot cut number one, because we're already at the minimum, doesn't sound like a great place to be.

We're already looking at the absolute least that we can look at, which begs the question that are we're going to end up no no comment about what you're doing, but it then says you know what's the quality of the report gonna look like if we're doing it at the minimums, as opposed to what you know, uh the auditors thinks we should be at.

So would we be re replacing it?

Moving the funds somewhere else, uh we will be replacing the franchise fee assessment with the prior and post conversion sales tax that if I can get the data.

If I can't get the data that we would move forward with the franchise fee assessment, so if you can get the data, then we would can you say that again?

So if I can get the data from the state, we would move forward with the sales tax um internal audit.

Um if they refuse to give us the data, then we would just move forward with the franchise fees.

Okay, I misunderstood.

Okay.

Because there's not if they won't give me the data, there's nothing to audit.

So I do have a contact there, and I'm hopeful that I can get the data.

That's why I brought it up today.

Is there a reason why you couldn't get I mean that that's an interesting question?

But I would hope that I mean they it their proprietary returns, so I mean they could say no, but um the fact that I'm only asking for the company's name, um, not how much they paid us, just the company's name, and I honestly just want to compare who paid us and who didn't.

I see, okay.

Who's missing?

Who's missing?

Well, more of who's missing than was on there.

Okay, so um, then and this is just uh discussion only.

So there's not a motion.

There is a motion.

Well, then there would be a motion, that's right.

There is a motion.

Yeah, this is the one I look at.

This is the one that uh last time was discussion only.

This one's for.

But okay.

Um, here, do you want to just the proposed motion?

Um I propose that if our auditor can get the information needed to audit the sales tax, we go forward with that, and if not, we continue on with the franchise fee.

So I think B, I move to recommend to the Board of Supervisors Fiscal year 2027 internal audit work program with the potential changes of if we can get right access to the records.

Yes um that we would then include um or we would swap the um we would exchange yes the the recommendations um okay we can also just say as discussed on the as discussed on the record as well yeah but why be easy right okay um is there a second so then I'll second that all right uh any more discussion okay all in favor say aye aye aye anyone opposed or abstaining thank you okay um hope that makes sense and sorry I was I I should have just said as discussed on the record apologies on that sorry about that what's that question okay uh then agenda item five e for discussion only or does that give you everything you need let me go back and ask um Audrey okay thank you sorry about that uh then agenda item five e for discussion only consideration of dates for the next meeting of the Carson City audit committee.

So this one I usually um kind of defer to uh the audit um crew um as to timing of when we could possibly have a first report and so that Sherry is going to depend on which engagement we kick off first if we start with the cyber security pen test and vulnerability assessment I have sent out a scoping document to the director um Freica Bella for your IT services um getting a full listing of all that needs to be included and that's in scope the I've not received a response back yet I was hoping to start with that engagement and at which point we would be ready for a report in three months if it's the fire department I'd need to get confirmation from the department that they're ready to kick that off and so I would think within three to four months depending on their availability I'm pausing on the sales tax and the franchise fee is that one seems um like it might take a little bit longer to get a time frame on that.

So I to be safe I think we need to look at least four months out so that we can get cybersecurity or fire in place.

Okay so October then that is actually the start of our annual audit so I would ask if we could do um October um 21st or the 28th that means the auditors are already here and I'm not scrambling to get ready for them.

Oh I'm sorry those were Wednesdays we usually meet on Tuesday 20th or the 27th.

The 20th would work better for me if that works for everyone October 20th the 20th yeah works for I'd bailey excellent okay then we will plan on perfect thank you all right and so then agenda item six public comment there is no public but um everyone still invited to comment uh okay well then without further ado um good meeting.

And again, sorry for the confusion with with the the wording in the motion and um thank you everyone for being here.

Appreciate you uh and your volunteering.

So much obliged and have a great summer and thank you for the good work um you do uh Audrey, Kathy, and I'd Bailey team, and we appreciate you.

And I'm sorry for throwing a wrench in the works today, but uh that just seemed like an important uh important audit.

That's why we're here.

Wrenches are happily received.

Great.

Okay.

Have a good day.

Bye.

Thank you.

Bye.