August 24, 2004

SUBJECT: Response to Santa Clara County Civil Grand Jury Regarding Inquiry Into Financial and Performance Audits for the County and Cities in the County

The City of Sunnyvale must by law respond to findings and related recommendations made by the Santa Clara County Grand Jury regarding audit operations.

The Grand Jury has recommended that cities in Santa Clara County, including Sunnyvale, consider conducting financial and performance audits and consider performing annual risk assessments to determine which areas to audit.

This report discusses the Grand Jury’s findings and recommendations. A proposed letter of response to the Grand Jury is provided as Attachment A.

BACKGROUND

In June 2004, the City Council received the final report "Inquiry into Financial and Performance Audits for the County and Cities in the County" from the 2003/2004 Santa Clara County Civil Grand Jury. This report is Attachment B of this report. Although the findings do not apply to Sunnyvale, the City must by law respond in a manner prescribed by California Penal Code Section 933.

The first finding related to Sunnyvale was that the City Auditor of San Jose makes effective use of a risk analysis to focus audits on the most vulnerable areas of government operations and those functions with the potential for greatest savings.

The related recommendations are that all cities in the county, including Sunnyvale, should consider performing and annually updating a formal risk analysis of similar to that done by San Jose and should use the analysis to determine which areas to audit. Sunnyvale already conducts an annual risk assessment and uses that assessment as the basis for the Annual Performance Audit Work Plan.

The second finding related to Sunnyvale was that "several cities" in the county do not have financial and performance management auditing programs. The Grand Jury recommends that cities implement such audit programs. Sunnyvale already has an internal audit program for performance and operational audits and contracts with outside auditors to perform financial audits.

According to Penal Code 933.05, the City of Sunnyvale is required to "Agree" or "Disagree" with each finding. If the City disagrees, in whole or in part, the City must include an explanation that details the reasons why it disagrees. In addition, the City is required to respond to each recommendation.

Fiscal Sub-Element Policy 7.1D.2 contains the following action statements:

7.1D.2a: "Conduct periodic financial, operational, and management audits to assure that adequate internal controls exist and that management practices are in compliance with Federal, State and City rules and regulations."

7.1D.2b: "Maintain an internal audit program as a management tool."

In addition, the City’s Performance Audit policy, as adopted in the City’s Performance Audit Charter in December, 2003, requires the use of risk assessment in the formulation of the annual audit work plan.

Based on the above policies, and the City’s existing practices, it is clear that Sunnyvale agrees with the findings that cities should have audit programs and use risk assessments to determine which areas to audit.

With respect to the recommendation that cities use risk assessments, staff already uses an annual risk assessment in the formulation of the performance audit work plan. This assessment assigns a numerical rating to each program on the basis of the following factors:

• The size of the program, in terms of dollars and the number of measures;
• The program’s sensitivity/visibility and complexity;
• Known or suspected issues, including turnover;
• The severity of any previous audit findings;
• The amount of time since the program’s most recent audit and its most recent restructure;
• Whether the program provides important fiscal control functions.

After assigning a numerical score to each program, staff averages all of the scores. Then staff ranks the programs on the basis of whether their scores are comparatively low, below average, average, above average, or high. Programs with high scores are audited first.

Because of our policy to use risk assessment, and the fact that risk assessment was the basis for the current audit work plan, staff believes the Grand Jury response should indicate that the recommendation related to risk assessment has already been implemented.

Staff believes that the Grand Jury response to the recommendation that cities conduct performance and financial audits should also indicate that Sunnyvale already conducts such audits. As previously indicated, internal staff carry out performance audits, and financial and operational audits are conducted either by internal staff or by contract with external auditors.

Sunnyvale has already implemented the recommendations, and the cost of performing the risk assessments and audits is already represented in the budget. No additional funds are required.

Public contact was made through posting of the Council agenda on the City's official notice bulletin board, posting of the agenda and report on the City's web page, publication of the Council agenda in the San Jose Mercury News, and the availability of the report in the Library and the City Clerk's Office.

ALTERNATIVES

1. Authorize the Mayor to sign the attached letter and response form (Attachment A) in response to the Grand Jury’s findings and recommendations.

2. Direct staff to prepare an alternate response to the Grand Jury.

Staff recommends Alternative #1.

Prepared by:

Cheryl Solov
Internal Audit Manager

Reviewed by:

Mary J. Bradley
Director of Finance

Approved by:

Amy Chan
City Manager

Attachments

A. Response Form and Letter of Response to the Grand Jury (.pdf format)

B. Grand Jury Report "Inquiry into Financial and Performance Audits for the County and Cities in the County" (.pdf format)