City of San Diego Audit Committee Meeting – July 10, 2019

The City of San Diego Audit Committee met on July 10, 2019, with Chair Sherman presiding, Vice Chair Councilmember Jen Campbell, and committee members Alan Spencer, Ricardo Valdivia, and Stuart Halpern present. Interim City Auditor Kyle Elser, Deputy City Auditor Danielle Knighton, Principal IT Auditor Steven Gomez, Department of Finance representative Scott Clark, and City Attorney’s Office representative Joan Dawson participated. The committee took unanimous action on several work plans and continued the new city auditor selection item to a future date.

Consent Calendar

• The opening routine approval motion, made by Alan Spencer and seconded by Ricardo Valdivia, passed unanimously.

Public Comments & Testimony

• Martha Welts expressed concern that the audit function is “hiding” information from the public. She stated that the public currently sees only a performance audit, which she called “only half of the potential,” and referenced past votes, spending figures, and water cost increases of 4% annually without a council vote. She argued that residents want to see how the city spends money and that current reporting is not transparent enough.
• Clive Richard, a self-identified resident of Council District 9, said he has followed the committee since its creation and urged the committee to protect the independence of the city auditor. He questioned why the mayor plays any role in recommending or selecting the independent auditor and recommended changing the charter if necessary to guarantee independence from the mayor’s office.

Continuance of Item No. 4

• Chair Sherman requested, and the committee unanimously agreed, to continue agenda item No. 4 on the selection process for the new city auditor to a future date. No public comment was taken on the item itself.

City Auditor’s Monthly Activity Report

• Interim City Auditor Kyle Elser reported that four audit products had been issued since the last meeting: a confidential recommendation follow-up report; a confidential IT audit of disaster recovery preparedness (issued confidentially due to security concerns); the FY20 citywide IT risk assessment and audit work plan; and the FY20 citywide performance audit risk assessment and work plan.
• Two audits were in report-writing stage: the Public Utilities AMI implementation project audit, completed in late June and awaiting the city management response, and the Neighborhood Services homelessness audit, expected to be issued in August.
• Three audits were in fieldwork: the IT audit of network perimeter controls; the FY19 annual Central Stores inventory audit; and the risk management city attorney liabilities payout audit. On the last audit, Elser noted the office was requesting certain records from the City Attorney’s Office and that lack of access could constitute a scope impairment. Alan Spencer asked about timelines for resolving the records request. Joan Dawson explained that the requested documents relate to closed-session materials covered by the Brown Act and that her office was working with the City Auditor’s Office on a legal path forward. Elser clarified they are seeking the city attorney’s case summaries rather than the closed-session minutes themselves. No specific resolution timeline was provided.
• Three audits were in planning: strategic human capital management; Development Services charges for deposit accounts; and the IT audit of citywide sensitive data encryption standards and data classification. One FY19 planned audit, the Engineering and Capital Projects Department charges audit, had not yet been started.
• Elser summarized FY19 results: 18 audit reports and two hotline investigation reports, containing 85 recommendations to improve city operations.

FY2019 Comprehensive Annual Financial Report Milestone Update

• Scott Clark of the Department of Finance presented the FY2019 CAFR timeline, as required by municipal code. Key milestones included: Disclosure Practices Working Group reviews in October; first draft CAFR delivered to outside auditors MGO by early October; adjustments and additional DPWG review in November; DPWG sign-off by early December; anticipated audit opinion on December 6; the full CAFR brought to the Audit Committee in January; and forwarding to the City Council in February. Clark said any significant deviations from the schedule would be reported to the committee.

Appointment to Disclosure Practices Working Group

• In accordance with San Diego Municipal Code Section 26.1709(d)(2), Ricardo Valdivia nominated Stuart Halpern to serve on the city’s Disclosure Practices Working Group. The motion was seconded and passed unanimously. Chair Sherman noted that the newest committee member traditionally receives the assignment.

FY20 IT Risk Assessment and Audit Work Plan

• Steven Gomez, principal IT auditor, presented the FY20 IT risk assessment and audit work plan. The IT audit universe includes more than 300 applications and supporting systems citywide. The office used COBIT guidance and eight risk factors across three ranking categories: auditor ranking, IT department ranking, and department criticality ranking.
• The plan included two carryover audits: the IT audit of network perimeter controls, in fieldwork with a report expected next month, and the IT audit of citywide sensitive data encryption standards and data classification, on hold pending hiring a new IT auditor.
• Two new IT audits were planned: an audit of legacy applications, estimated at 600 hours, and a subsequent targeted audit based on the findings, estimated at 885 hours.
• In response to committee questions, Gomez said the network perimeter controls audit addresses cyber defense, detection, and recovery; information shared by other cities about ransomware incidents is generally high-level. He also stated that “vulnerability” falls under inherent sensitivity and that “supportability” primarily covers currency, patching, and vendor agreements, with some training considerations.
• The committee unanimously approved the FY20 IT audit work plan on a motion by Valdivia, seconded by Halpern.

FY20 Citywide Risk Assessment and Audit Work Plan

• Kyle Elser and Danielle Knighton presented the FY20 citywide audit work plan, which contained 19 projects. Five were carryover audits: Neighborhood Services homelessness expenditures and organizational structure; Risk Management/City Attorney public liability; Development Services billing for deposit accounts; Human Resources personnel compensation, incentives, and discipline; and Public Works Engineering and Capital Projects design-phase charges and project prioritization.
• Eight new audits were proposed: city fiscal sustainability and financial condition over a 10-year period; small and local business enterprise and emerging local business enterprise contract programs; Public Utilities industrial wastewater control program follow-up; street sweeping program efficiency and effectiveness; sustainability/climate action plan audit; San Diego Police Department data completeness, reliability, and reporting methodologies; Real Estate Assets Department lease strategy and holdover agreements; and a second Neighborhood Services homelessness audit focusing on data-driven approaches and evidence-based practices.
• Other planned activities included fraud hotline operations, follow-up on prior audit reports, the IT audit plan, the annual Mission Bay Fund audit, a peer review required under government auditing standards, office process improvements for compliance with the revised 2018 government auditing standards, and the annual Central Stores inventory audit required by municipal code.
• During discussion, Elser said the office does not conduct a full questionnaire-based citywide risk assessment annually; the last one was about five years ago, and departments are reassessed when significant changes occur. Scott Clark explained the Department of Finance’s internal controls group, its annual report on internal controls over financial reporting, and coordination with the City Auditor’s Office. Elser noted that the Treasurer’s Office handles certain audits, such as leases and TOT, and that no high-ranked audit was set aside for subjective reasons this year.
• In response to questions about the fraud hotline, Elser explained that “unsubstantiated” means there is insufficient evidence, that an intake and review committee helps evaluate investigation conclusions, and that cases are generally closed only after a request for additional information. He also said the 30-day closure period runs from the request for additional information, not from the original report.
• The committee unanimously approved the FY20 citywide audit work plan on a motion by Valdivia, seconded by Spencer.

Key Outcomes

• The committee unanimously approved the routine opening motion.
• The committee unanimously voted to continue item No. 4, the selection process for the new city auditor, to a future date.
• Stuart Halpern was unanimously appointed to the Disclosure Practices Working Group.
• The FY20 IT audit work plan was unanimously approved.
• The FY20 citywide audit work plan was unanimously approved.
• The meeting adjourned to the next Audit Committee meeting scheduled for October 2, 2019, at 9:00 a.m. in the same room.