All right.

The time is now 101 p.m.

on September 2nd, 2025, and the meeting of the audit committee is now called to order.

Madam Clerk, can you call the roll?

Councilmember Mesa Gonzalez.

Councilmember White.

Citizen Member Tino.

Present.

Chair Via Cron.

Here.

Chair, we have quorum.

Thank you.

First item on the agenda is approval of the minutes.

Are there any corrections to the minutes?

So long ago.

Can I get a motion and a second to approve the minutes?

I got a motion and a second.

All in favor say aye.

Aye.

All opposed say no.

Motion carries.

Madam Clerk, are there any members of the public signed up to speak?

We have no members of the public signed up to speak.

All right, great.

There are four final internal audit reports on the consent agenda agenda.

Do any members wish to pull an item on consent for discussion?

Yes, uh Chair, I'd like to pull item three.

All right, item three.

Any others?

Okay, so we will approve uh motion for which the remainder of the remainder of the consent agenda, except that except item three.

Do I have a motion?

Motion made.

I have a motion and a second.

All in favor say aye.

Aye.

All right.

So we'll start with the individual item.

Item number three.

Uh did you want to just ask some questions?

Okay.

Thank you, Chair.

Uh this is the Greater SATX audit.

And um I have some, I think significant concerns.

Uh, you know, the first line here in the summary is that EDD's service agreement with Greater SATX is appropriately monitored.

Um, but then if you read further into the audit uh into the audit, I'm not sure how that statement can really uh be made because uh it says here that our ED, our economic development department cannot sufficiently validate greater SATX performance metrics because Greater SATX does not provide sufficient support documentation for validation.

And so my concern here is we are giving a significant amount of funding to Greater SATX.

I believe in the mission of Greater SATX, it does a lot of good things, but we need to make sure that just like with every organization that we give money to that we are getting uh the bang for our buck, if you will.

And so I don't know who's here to to perhaps answer questions on what we are going to do uh differently moving forward.

And in I guess my first specific area where I guess the or that that we need to address is that it looks like one of the reasons we're saying we don't have the appropriate documentation uh chair is that these uh these businesses that Greater SATX is is is counting as wins, these these deals a lot of them are what they're they're calling non-incentive businesses, and these folks don't have I guess documentation requirements that they have to give us, and so we can't really determine you know if if our service agreement is is being um if we're getting I guess what we've bargained for.

So what are we doing there?

Uh and thank you for that.

Um Brenda, is anyone from Greater SATX here today?

Um yes, uh one of their team members just walked in the door, ma'am.

Okay.

Um I am because we have a new uh board uh committee member.

I am thinking that if we had a motion to take this up next month that we we could have them that we could have you present um next month, and then that way more of the greater team, because I know they just went through a leadership change too, so I don't want to put them in a position where they can't, and then that way uh Trisha can kind of uh get some more information on this also and um get briefed by you, buddy, if you haven't uh briefed Trisha yet, if you could brief her on this issue.

Can I get a motion to move this to uh next audit committee meeting?

Yeah, motion made.

I've got a motion.

next month and then that way more of the greater team because I know they just went through a leadership change too so I don't want to put them in a position where they can't and then that way uh Trisha can kind of uh get some more information on this also and um get briefed by you buddy if you haven't uh briefed Trisha yet if you could brief her on this issue is it can I get a motion to move this to uh next audit committee meeting yeah motion made I've got a motion do I have a second all right all those in favor say aye aye aye okay so uh item the I the audit item on greater sat will be moved to the next audit committee meeting and buddy you have your directions on uh briefing with our new uh trust uh committee member and hopefully our we'll get a second community representative and they can be briefed also and then greater SATX thank you for coming in today but let your team know we we expect you to be here to answer questions next month all right now we're going on to our individual items that's item six is audit of the finance P Card program can we get a staff presentation hello oh sorry just checking for good afternoon my name is Abigail Esteves I was the audit manager for this project and I'll be presenting the results over the finance P Card program audit overall our objective was to determine if the P Card program was managed in accordance with the department's policies and procedures we determined that finance had adequate controls to provision P Card program participants.

This included both providing participants uh the initial required training as well as having their credit limits authorized by the appropriate individuals they also had adequate controls to ensure accurate payment is made to Chase Bank on a monthly basis.

However we did identify um opportunities for improvement as it pertained to policies and procedures transaction monitoring and analysis and P card controls.

Our first recommendation was over policies and procedures we determined that the P card user guide was outdated so we recommended that the guide be revised and periodically updated as needed our next recommendation was over transaction monitoring we selected a sample of transactions and identified a few that were either not approved either in the Chase bank system or as part of the transaction logs which were required at the time or um were not appropriately supported by itemized receipts.

For this next item we had a recommendation over transaction analysis to provide some context regarding the work we performed here we performed data analytics over a data set it was um at the time eight months worth of data which was approximately 2000 transactions and we performed various data analytics to try to identify potential anomalous activity and three of the potential items that we identified were potentially restricted purchases for the subsect we performed keyword searches to see if any potentially restricted purchases were identified.

We also identified the opportunity for use of contracts this was based on an analysis both within and across departments to determine whether there were purchases in excess of 3,000 with the same merchants.

And lastly we determined that there were credits limits that were significantly higher than average spending for certain card holders so they're recommending that finance review these results as well as develop controls moving forward to identify potential issues such as these recommendation was over P card controls we identified a blocked merchant category code being used without approval additionally we determined that access to both P cards and system access was not adequately monitored monitored or delimited timely and this was specific to employees that had since been separated and no longer required access to either the system or an active P card but to clarify there were no purchases made on those P cards finance agreed with our recommendations and developed corrective action plans with a tentative completion date of June 2025 and we're currently working with finance to confirm implementation.

That concludes my presentation but both myself and finance are available to answer any questions you may have all right before we discuss can I get a motion in a second motion I've got a motion in a second I'll entertain uh discussion does anyone have any questions Councilman White Thank you Chair so Buddy when we do these executive summaries right it's they they always it seems to me start with everything's being adequately done and then it goes into but you know here's all the list is another one where I'm not sure how we can say that this P Card program is being adequately monitored.

All right.

And when when you when you when you look through this report, I mean let's let's start with the some, you know, these transactions having supporting documentation, right?

45%, almost half, no support didn't have the the requisites uh supporting documentation.

We look at the transaction reports, right?

You guys looked at three months of of uh unapproved transaction reports and found that 502 out of the 1135, 44 percent again remained unapproved uh for for three or more months.

I mean, you you you keep going and you look at you look at the uh the issues here, and I think there was a summary play page here uh somewhere somewhere.

Um you got sixteen hundred and forty-four questionable transactions plus hundreds uh exceeding the three thousand dollars that should have been under under contract.

You have a hundred and twenty-three uh cardholders that had limits significantly above their actual spending, and then maybe most concerningly to me, you have employees that are no longer working with the city of San Antonio whose cards, if I'm reading this right, remained remained active.

Um they they still had system access for 99, an average of 99 days, with seven still holding active cards.

I mean, again, this is taxpayer money.

Um they trust us to spend it appropriately, they trust us to monitor uh how the money is being spent, not just by the external groups that we give money to that we talk about all the time, but certainly um our own employees as well.

And so I guess um all that is to say moving forward, we've got a plan to rectify this, right?

How many of you have council member?

Let me speak to your your initial question.

The way we answer our objectives, and I'm gonna use extremes to illustrate, uh, is it's either going to be a no.

So if you look at the if you look at the objective, it says determined if P Gar program is managed in compliance with policies and procedures.

I'm gonna use uh because I can use it, it's been published.

So I'll use the NHSD home rehab audit.

That was a a no overall.

So overall, the entire process is a no.

So we have three options when we answer our objective.

We answer it as a no that the program is not, in this case, that the program is not effective or adequately monitored.

Then we have the affirmative, obviously, right?

Um if the majority of the items are being executed as intended, and you have issues, i.e.

what we're gonna discuss next month, um, from a greater SA Texas from a compliance monitoring perspective, overall they're monitoring components of the contract, with the exception of performance matrix.

So we're not gonna give them a conclusion that overall they're not monitoring, because overall they're monitoring effectively, because there's a component that they're not monitoring, which is a performance metrics.

Then you have the ones that fall in between.

This is a specific example of audits that fall in between.

What we typically do is we give the conclusion on the affirmative first, that's with the first paragraph, and then the items that need improvement.

The reason we categorize this as needed improvement is one from a volume perspective, we're talking about thousands and thousands and thousands of transactions.

We don't take in consideration materiality the way an external auditor would, because we're program procedural related in terms of testing.

Secondly, is some of these are anomalies that we didn't confirm.

So they're potential uh areas, and what we're our our direction is we took a sample of the anomalies and confirmed that X amount were probably uh uh shouldn't have been executed.

Well, we're telling Troy's team to go re research the remainder to see if you can confirm if that's a condition that currently exists with the remainder of those transactions.

We're not necessarily necessarily saying each one of those transactions should have not taken place.

So I just wanted to give context behind our results.

But but that your first initial uh question, and and I'm expanding simply because we had new committee members.

Um you'll see audits, and I use NHSD an example, which overall it's a no.

Then you'll see audits that overall it's a yes.

And then that's why you don't see us answering the direct objective directly directively, because we have two components here, what they're doing well, what they're not doing well, and we're also taking consideration the volume of purchases.

So just to give you some context, and then I believe Troy can speak to the and just if I can just just ask a uh clarifying question.

So you you guys are not auditing the efficacy of the program.

It's just whether or not they're they're following the procedures.

In this case, yes, you there's there's controls in place and there's procedures that they should be following, i.e.

the results of the audit, and we're looking at it from a control procedure perspective when it comes to approvals, procedures, and then uh the one you mentioned from an access perspective.

We have uh we have employees that that still have that card.

We we take we take the next step and we take a look to see if there was any purchases on those cards that those uh employees that still have cards to see if there's any purchase activity, and there was not.

So um the control there is a user access control.

There's a there's a tail to this test because potentially somebody can make a purchase because now they have a card.

So and just just the la last follow-up point is that so I'm always talking about wasteful spending.

You your audit wouldn't necessarily tell us if money was being spent wastefully, but just rather whether internally we're following proper procedures and correct.

In this case, yes.

Okay.

Yes.

Okay.

And councilman, just to add to your last question.

I think your last question was is there a plan in place?

Yes, sir, there's a plan in place.

When we look at this, and to Buddy's point, this is looking at controls, just kind of put in context.

There's 26,000 transactions that run through this program in less than a year.

Of that, Buddy, and we're appreciative of what he pointed out because he did point out some deficiencies, and we're grateful for that.

And we went back and Melanie Keaton, our deputy finance director and her team went back and went through every transact transaction that they identified and looked at it from the perspective.

You know, I think the reference there they're unrelowed.

Well, we went back and there's some reasons they were unallowed from a systems perspective, because we were in the process of converting from Wells Fargo to Chase, which is a new system.

There were some limitations in the old system that we had put things in place.

This new system actually gives us some opportunities to actually build some additional controls in to make sure one that they're approved and they're allowed.

Um we had some duplicate things in place under the old system that we can do away with now.

When we went through all the transactions, we did not see anything that gave us concern or pause as far as what was being purchased.

Um the last issue I think I'll say is that we talked about the um the issue on the card holders that were not terminated.

We did go back and look at that.

We had a process in place that wasn't working.

We strengthened that process.

Now, whenever there is a termination through our payroll or through our HR process, they're gonna notify us proactively so we can discontinue their participation in the program.

So we we've taken a look at it, look at it, we've strengthened it across the board, and we actually have a new procurement guide.

It is, I'll be transparent.

It is a little bit late.

We're supposed to come out the end of June 30th.

We lost three of our individuals that were actually administering the program, but that will be coming out this week, and it's the program guide has actually been modified to actually strengthen some of our processes and our controls.

So there is a plan in place.

Um, and this is a program then working with Buddy and Abigail that we want some frequency on looking at it because it is a high volume and high potential for um high risk area.

So hopefully we'll be coming back with the auditor's office more frequently on this type of program.

Yeah.

And I appreciate that, and and I don't I don't want to I don't want to belabor the point, but um it should, it seems to me be easier to monitor ourselves internally uh than it is to monitor some of these out outside groups.

Um we need to do both, certainly.

Uh and so, you know, but I'm happy that we're taking steps to to try to rectify some of this because when it comes to public perception, I mean this is the this is the kind of thing that just it doesn't look right.

So thanks, Chair.

Thank you.

And I think Ben, you want to speak a little.

This is well, Troy and and your uh kind of department, and I know P Cards I you know you there might be wasteful spending at City Count at City Hall.

I don't know, because I know our uh our teams have access to that.

But Ben, you want to share a little on the procedures and how we're moving forward on that.

Sure, Chair.

I'll just add a couple of comments.

I think Troy covered it well.

Appreciate your comments, Councilman.

Certainly something we want to be very vigilant of.

Um as Troy mentioned, the program is really meant to take away some of the bureaucracy and burdensome processes of doing small dollar purchases.

So as Troy mentioned, you know, for the year that Buddy was looking at, we're talking about 7.3 million dollars, 26,000 transactions.

So we're talking about less than 300 on average.

Um the things that Buddy noted and kind of went through are I think some transitional stuff that occurred between us moving from the uh Wells Fargo platform over to the Chase platform.

You know, there's certainly some technology things that we need to use the system to track better and allow us to catch things a little bit quicker.

But I did want to note for you that in the management response, so buddy mentioned the 1600 and what was it, 44 potentially unallowed transactions.

Troy had finance to go back and look at every one of them to make sure there was not an issue, wasteful spending, something else going on.

Found the documentation, cleared most of them, all of them, didn't find any what I would call disallowed costs, but still concerning that those things were there, and that you know, again, we want Buddy to come in and navigate to come in and say, Hey, can I see these things?

We want that to be a five-minute process.

Here are these things, we're cleared, we're done.

Um that didn't happen in this case, so we've got some work to do and some improvement to do.

But I think there are transitional things that occurred.

There's certainly things that we can do better.

We can certainly take advantage of the platform that we now have fully implemented and is in place.

So I think a lot of the issues that we talked about here we can address and and shouldn't have these issues going forward.

So and I and I I don't know, buddy, if this isn't on your follow-up plan, but we want to follow up.

This is one we want on our kind of a regular basis because it's just a lot of volume and it's a lot of transactions, a lot of different kinds of transactions.

There's some efficiencies that come out of it too.

He mentioned a couple of things in here, and I lost the page.

Um that talked about um some of these things could be on annual contracts.

Well, we can potentially get a better price.

We want to do that too.

So there's a lot of value in the data analysis, really looking at that.

It changes, so we want to be monitoring in that, looking at that, so that we can implement and follow that and making sure we're we're going getting the best price we can for items as well.

So there are a number of things that came out of it that we'll follow up on.

Ben, just to touch, we are this is we follow up on each one of our audits, but this is a cycle audit.

So this is one that we consider repeating every three to five years.

Uh, but we will follow up on each one of the recommendations, and then it it is in our cycle uh audits uh to complete every depending on the severity every three to five years.

I think on this one, uh sorry, Cheryl, on this one bit and buddy, maybe there's a consideration to move it up a little bit sooner.

And we had a few issues.

I know it's like on a three or four-year cycle.

Uh I'd be happy if Buddy comes back next year and says, hey, I want to make sure all this stuff is is implemented and that we're taking advantage of the technology where we can great.

Thank you, Chair.

Councilman uh uh Messagonzales.

Sorry, apologies.

Are there specific departments that I guess more departments and others that were using this or of the of the 26,000?

Was it coming from any specific no councilman?

I think this is kind of a citywide.

It's all over the place, all across the board.

Okay, so it's really meant to be a process again that that takes a lot of small dollar purchases and doesn't have us go through the formal formal process.

Yeah.

So um still have controls in place, so want to make sure we're tracking it, but it's available to all departments to use.

Yeah, um, so there wasn't any one particular area that I saw that was that was a specific issue.

No, and the only thing I would add to that is just to give you some more context, is about today there's a little over 400 of these cards are out across the city wide.

But it's not really there are some departments going to be higher volume users than other, but this is not something that was isolated of one department and other is across the board.

Okay, thank you.

All right, thank you.

We've got a mo uh any other questions.

We've got a motion and a second.

All those in favor, uh say aye.

Aye.

All opposed say no.

Motion carries.

We're on to item seven.

Uh this is a this is for briefing only, but because this is the audit committee that we are going into 2026 with.

I wanted to make sure that you all were briefed on this item before we started with our regular meetings, uh, which Debbie will send out and we will have the time.

So uh Buddy, go ahead and present.

All righty, uh for those uh new folks.

My name is Buddy Vargas, I'm the city auditor.

Uh again, uh great to be back.

Uh welcome to the new folks.

I'm gonna be presenting the proposed 26 uh annual audit plan.

Buddy, before are you gonna need us to accept this or this is just it's a briefing.

It the actual approval is uh the plan is to have it on the A session October 9th for council approval.

All right, well, so I'm sorry, we will need to.

I will need a motion in a second after this to send it forward to an A session.

Thank you.

Okay.

Uh again, our audit plan is uh required to be presented to the audit committee and also council.

Right now, tentatively it's uh scheduled.

Our goal is to schedule it on the October 9th uh council meeting.

Uh to touch base on just uh some background on our methodology, we uh solicit input from management from mayor and council.

Uh we also do a high-level risk assessment uh to prioritize audits.

Uh we start anywhere between 80-ish audits on a potential plan, uh and we take a uh a high-level risk approach to uh whittle that down to a manageable number.

Uh our plan can be modified throughout the year.

There's significant changes, risk change, controls, procedures change, and we uh modify appropriately.

I wanted to touch base on four of those uh that were on the 25 plan that are modified.

We have two that uh are were postponed that rolled over to 26.

Uh one of them is the uh aviation um parking operations audit.

We started that audit.

There were some significant uh opportunities with the vendor that aviation got involved with.

Also uh Troy's team was also involved.

Uh they made some significant process and procedural changes, so we decided to let that uh those uh modifications run for a while, and we added it to the 26 plan.

Uh same uh methodology for the SAP upgrade.

There were ours allocated in 25.

However, the first phase just got implemented last month in July.

So we're gonna let that process run, and we put that on the 26 plan.

A couple of audits that did not make it uh for consideration to 26, two that were considered for rollovers was the CCDO parking operations.

Uh, but during the year we learned that there's an RFP uh probably mid-late spring, and it really doesn't make sense for us to audit that when uh it may be outsourced.

So we're gonna take a look at that at probably 27-28.

Uh the last one is the LGC audit.

That's uh from a risk standpoint, considering our our uh budget shortfall, that was probably one of the priorities we actually focused on for what gets included for 26.

Very low risk, uh very small in scope.

So we rolled that over to 26, but even during our risk assessment process, it didn't make the 26 plan.

Uh just an overview, what our audit include our plan includes is 32 performance audits.

We have three consulting projects, uh we have special project requests.

We have some hours that are reserved throughout the year again to either add our uh audits or adjust audits where needed.

Uh we have follow-up work, we have audits uh that we have to follow up on, so we have hours allocated for that, and then we also have hours for our data analysis function that we do uh throughout the year.

Um the one thing I wanted to mention again is we started with around 80 audits.

Our priority for 2026 was to add as much value as possible for 26 and to try to impact hopefully 27 from a revenue and expenditure perspective because of our budget shortfall, uh, the economic uh position that we're in right now.

So you'll see that the majority of our audits, a good chunk of them approximately 10 uh have a significant revenue component.

Uh we do have a couple that are related to safety uh from a uh uh because of the recent flooding that happened here in San Antonio, so you'll see that.

Uh there's a new homeless service department, so you'll see a couple of homeless um audits that are on the plan.

Uh and really just want to kind of highlight that again.

We start with around 80 and then we whittle it down to a manageable number.

Um, and again, we we uh take a uh a risk-based approach.

So to give you uh just a quick example, if it was a compliance-based audit uh versus a revenue or expenditure component, it probably didn't make the 26 plan.

And that's actually my presentation list.

Anybody wants to discuss the anything on the plan or the plan in general?

All right, thank you, buddy.

approach so so to give you uh just a a quick example if it was a compliance based audit uh versus a revenue or expenditure component it probably didn't make the 26 plan and that's actually my presentation list anybody wants to discuss the anything on the plan um or the plan in general all right thank you Betty so we have if you look on your slideshow there is 30 eight three consulting projects and then the 35 uh 35 including um the ones I think I think the one we're uh what I'm happy to see on there or what is our um is our workforce our workforce development regarding project quest and of course the uh homeless service and strategies as we move make the move to the new um the new department currently uh just to touch on that council member we are right now in there and ready to work but we're looking at the ready to work as a whole okay and it's a uh these are cycle audits we'll take a deep dive uh with a particular vendor particular contract so that's why that made it to 2026 now I think this looks good with the input of the council I I feel like this looks good uh do any of my committee members have any questions uh count Councilman uh Mesconzals yeah I was just wondering if you could maybe add a call on that kind of I guess maybe last time it was an audit took place in that department or if this is I I can definitely do that I can probably add that to the next audit committee as an informational item if you like uh I have it with me but it's not something I added to the presentation because this was a very short meeting I guess just when you take it to a session right we would have to take this yes and maybe you can include just a so I have I have uh we have a matrix that has every department that's been audited for the seven years over seven years yeah I guess of these 38 oh okay yeah these 38 that were this is a plan for this next fiscal year right exactly right so just when the last audit was done now some of them are are our new audit so yeah they wouldn't be honored okay yeah we can definitely add that okay thanks councilman white yeah I just want to say thanks for your work um this is important stuff always but especially now when we're in a in a place of of budget deficits and money being very very uh tight around here it's it's extremely important that we know that we're spending the taxpayers money appropriately and uh I hope that through your work we will uh um you know nothing's gonna be perfect so we're gonna find areas where we can do better and we owe it to the citizens to do that thanks thank you any other questions all right uh I think the one thing is uh making sure we have that um that third column that lets us know the last time that department was audited if it's a new department with a new uh audit or a new feature because some of them look like new um products that we may have purchased uh so this might be new if you could include that so that when we get um when the council gets it they'll and they'll see that on there uh so all I need is a motion and a second to take this to um a session on uh September ninth October night October 9th second okay we have a motion and a second all in favor say aye aye any opposed I have it motion carries um there being no further discussion we have a motion a second all in favor the time is now 135 p.m and the meeting is now adjourned thank you