Policies and procedures

A comprehensive set of formal and appropriately communicated policies coupled with current, complete, and well documented procedures are essential to an effective system of internal controls for any organization. The City Auditor's Policies and Procedures are updated annually and detail the Audit Process and steps taken to ensure any Non-Audit Services undertaken do not impair the City Auditor's independence or objectivity. The information below outlines the City Auditor's process for conducting Performance Audits and undertaking potential Non-Audit Services.

Performance audits

The Office of the City Auditor conducts "Performance Audits" in accordance with Generally Accepted Government Audit Standards (GAGAS). Performance Audits determine whether City departments and programs are operating economically, effectively, and in compliance with applicable laws and regulations. Auditors examine, review, or perform procedures on a broad range of subjects such as internal controls, compliance with requirements of specified laws, regulations, rules, contracts or grants, and the reliability of performance measures.

Performance audits include: (1) an economy and efficiency review, and (2) a program review. An economy and efficiency review determines if the audited entity has acquired and used its resources efficiently. A program review, on the other hand, determines whether the audited entity has used its resources effectively.

The types of government services are broad and therefore, the types of audit objectives appropriate for Performance Audit vary. In its broadest context, audit objectives might assess: Effectiveness, Efficiency, Economy, Compliance, Data Reliability, Policy, other Prospective Evaluation, or Risk Assessment.

In order to satisfy GAGAS requirements, the City Auditor typically performs the following steps:

Flow chart depicting the audit process with the steps described in detail below. Step 1: Entrance Conference; Step 2: Preliminary Survey; Step 3: Risk Assessment; Step 4: Fieldwork; Step 5: Report Writing; Step 6: Exit Conference; Step 7: Report and Presentation; Step 8: Recommendation Follow-Up open_in_full

Entrance conference

Holds an Entrance Conference with the representatives of the audited entity to discuss the purpose, scope, and process of the audit and to address any questions or concerns the representatives have.

Preliminary survey

Conducts a Preliminary Survey to gain an understanding of:

  • The nature and profile of the programs being audited and the needs of potential users of the audit report;
  • Internal control as they relate to the inherent risks associated with the program being audited. Such inherent risks relate to a program's ability to 1) safeguard its assets 2) comply with laws, rules, regulations, policies and procedures 3) accomplish its goals and objectives 4) produce reliable financial and management information and 5) operate economically and efficiently;
  • The reliability of the program's information systems;
  • Legal and regulatory requirements, contract provisions or grant agreements, and potential fraud or abuse that are significant within the context of the audit objectives; and
  • The results of previous audits that directly relate to the current audit.

Risk assessment

Conducts a Risk Assessment. A risk assessment is a product of our-risk based audit approach, which seeks to test internal controls and helps identify threats inherent to the auditee's activities. In performing a risk assessment we try to assess whether management has an adequate system of internal controls in place to address the risk that is inherent to the entities operations. The results of this assessment are then used to help prepare a written Audit Program.

Fieldwork

Conducts Fieldwork or the execution of the written audit program during which the City Auditor or staff performs procedures to develop the elements of a finding for inclusion in the audit report. These elements include:

  • Criteria - the required or desired state or expectation of a program or operation;
  • Condition - the situation that exists;
  • Effect - the impact or potential impact of any differences between the Criteria and Condition;
  • Cause - the reason/s for the difference between the Criteria and Condition; and
  • Recommendations - Actions to correct reported differences between Criteria and Condition that are designed to eliminate or mitigate identified Effects.

Report writing

Prepares a Draft Report at the conclusion of Fieldwork which provides background information on the audit subject and findings which contain the elements described above. The City Auditor provides a copy of the Draft Audit Report to representatives of the audited entity for review and comment during the Exit Conference stage of the audit process.

Exit conference

Schedules an Exit Conference with representatives of the audited entity to receive their input and comments on the Draft Audit Report. To ensure technical accuracy and fairness to the audited entity, the City Auditor incorporates any needed changes to the Draft Audit Report identified during the Exit Conference into the Final Audit Report. The City Auditor then allows the representatives of the audited entity a reasonable period of time to prepare a written response for inclusion in the Final Audit Report.

Report and presentation

Issues the Final Audit Report simultaneously to the City Council, the audited entity, and the public. Presents the Final Audit Report to the Audit Committee for its review and approval. The Audit Committee then forwards the Audit Report along with any Committee modifications to the City Council for concurrence. 

Recommendation follow-up

Monitors and reports to the Audit Committee on a semiannual basis the Implementation status of City Council approved recommendations.

Non-audit services

The Office of the City Auditor may occasionally provide the following non-audit services provided they do not impair auditor's independence:

  • Participating in committees, task forces, or focus groups as an expert in a purely advisory, non-voting capacity to advise management on issues based on the auditors' knowledge, or to address urgent problems;
  • Providing tools or methodologies such as benchmarking studies and internal control assessment methodologies that can be used by management; and
  • Providing targeted and limited technical advice to management to assist them in activities such as answering technical questions or providing training, implementing audit recommendations, implementing internal controls, and providing information on good business practices.

The City Auditor must approve all requests for non-audit services. If the City Auditor concludes that performing the requested non-audit service would impair the Office's independence, he or she will so inform the requestor and decline to perform the work.

ON THIS PAGE