Carson City Audit Committee Meeting Summary – October 20, 2026

The Carson City Audit Committee met on Tuesday, October 20, 2026, at 1:30 PM in the Robert 'Bob' Crowell Board Room. The committee reviewed the FY2027 Cybersecurity Assessment, discussed the monitoring and closure of previous audit findings, and received updates on the Fiscal Year 2027 audit work program and Fraud, Waste & Abuse Hotline activity. Chair Shuddy, Vice Chair Lamb, Member Scalia, and Member Stack were present (one member absent).

Consent Calendar

• Approval of Minutes: The committee unanimously approved the minutes from the June 16, 2026 meeting (4 ayes, 1 absent).

Public Comments & Testimony

• No members of the public provided comment during either of the two public comment periods.

Discussion Items

• 5A: FY2027 Cybersecurity Assessment (Eide Bailly LLP): The external audit team presented findings from four services: an external penetration test (no findings found), an internal vulnerability assessment (31 findings: 3 critical, 11 high, 17 medium), a Microsoft 365 tenant configuration assessment (several high-risk findings), and an endpoint security assessment of a single workstation (16 findings: 1 critical, 5 high, 8 medium). The internal auditor noted that the detailed findings were obfuscated in the public report for security reasons. Chief Information Officer Frank Abella stated that the IT Department has already remediated over 80% of the high and critical findings and utilizes compensating controls. He indicated the current budget is sufficient, and the primary need is time for careful testing before implementing changes to avoid disrupting critical applications.
• 5B: Audit Findings Tracking Report: Staff recommended closure for the Credit Card Security Compliance finding (after the treasurer determined consolidation of payment systems was not feasible due to differing purposes) and Finding #1 of the Public Guardian Asset Management review (policies and procedures completed). Due dates were extended to December 31, 2026, for a Community Development finding (pending a combined fee study by multiple departments) and the Asset Management Review (due to staff turnover).
• 5C: FY2027 Audit Work Program Update & Hotline Activity: No new cases of fraud, waste, or abuse were reported. Two major engagements are in progress: a Fire Department Overtime audit and a Sales Tax reconciliation analysis to identify gaps in filing following the statewide system conversion. Of the $110,000 annual audit budget, $35,000 has been expended to date on the cybersecurity engagement.

Key Outcomes

• Cybersecurity Assessment Accepted: The committee voted unanimously to approve the cybersecurity assessment report and direct staff to continue working on the recommendations.
• Audit Findings Closures Recommended: The committee voted unanimously (4 ayes, 1 absent) to recommend that the Board of Supervisors close the Credit Card Security Compliance and Public Guardian Asset Management findings. Status updates and date extensions were accepted for the other items reviewed.
• Next Meeting Scheduled: The committee set its next meeting for Tuesday, January 19, 2027, at which time a risk assessment update and planning for the upcoming audit work program will be initiated.