AUDIT & FINANCE COMMITTEE

MINUTES

October 2, 2008

The Audit & Finance Committee of the City of Mesa met in the lower level meeting room of the Council Chambers, 57 East 1st Street, on October 2, 2008 at 10:38 a.m.

COMMITTEE PRESENT	COUNCIL PRESENT	STAFF PRESENT
Scott Somers, Chairman	None	Debbie Spinner
Dina Higgins
Kyle Jones
Christopher Brady, Ex-Officio

(Items on the agenda were discussed out of order, but for purposes of clarity will remain as listed on the agenda.)

1. Items from citizens present.

There were no items from citizens present.

2. Hear a presentation and discuss the City Auditor’s Office, including auditing procedures and the FY 2008/2009 Annual Audit Plan.

Chairman Somers stated that because all three members of the Audit & Finance Committee are new to their positions, he thought it would be appropriate for staff to provide a brief overview of the duties and responsibilities of the City Auditor’s Office and also familiarize the Committee with the FY 2008/2009 Annual Audit Plan.

City Auditor Gary Ray explained that the City Auditor’s Office has been in existence for 28 years, during which time the City Auditor reported to the City Manager. He stated that in the May 16, 2006 General Election, Mesa voters approved an amendment to the City Charter which designated that the City Auditor be appointed by and report to the City Council. Mr. Ray commented that this modification allowed the City Auditor’s Office to be organizationally independent of City operations.

Mr. Ray commented that the City Auditor’s Office conducts audits and investigations to evaluate the City’s ability to do the following:

• Operate efficiently and effectively;

• Comply with laws, regulations, policy, and grant and/or contract terms;

• Safeguard assets from loss, damage or inappropriate use;

• Report financial and performance information accurately;

• Accomplish goals and objectives; and

• Provide quality customer service.

Mr. Ray advised that four employees presently staff the City Auditor’s Office and introduced Senior Internal Auditors Jerry Faccone and Jason Taylor who were present in the audience.

Mr. Ray referred the Committee to the FY 2008/2009 Annual Audit Plan, which was approved by the previous Council. (See Attachment 1) He explained that the prior Audit & Finance Committee directed him to inform the members of this Committee that they have the authority to make changes to the FY 2008/2009 Annual Audit Plan if they so choose.

Mr. Ray offered a short synopsis of the audit process, which results in the development of the Annual Audit Plan. (See Attachment 2) He commented that the Audit & Finance Committee reviews the Annual Audit Plan, makes changes/suggestions they deem appropriate, and recommends to the full Council that the Plan be approved.

Discussion ensued relative to the process by which a Councilmember could request the inclusion of an audit on the Audit Plan if, for instance, he or she suspected that fraud was occurring in a City department; that per the City Charter, the City Manager or the City Council could direct the City Auditor to perform an audit; and that if a Councilmember went directly to the City Auditor with the request, Mr. Ray could recommend to the Audit & Finance Committee that the audit be conducted.

City Attorney Debbie Spinner further clarified that if any City employee or Councilmember believed that fraud was occurring at the City, the individual could contact the City Auditor and an investigation would be started immediately. She stated that if there was an interest regarding the audit of a particular area or function of the City, the Committee could amend the Annual Audit Plan to include that item on the list. Ms. Spinner added that if the Committee deemed a specific audit a critical issue, the members could recommend to the full Council that not only should the audit be conducted, but that it be considered a priority and resources be dedicated immediately in that regard.

Chairman Somers acknowledged that there are “different levels” of audits. He cited, by way of example, the Adult Softball League fraud investigation that was conducted immediately due to the nature of the charges; the Fire Department overtime audit, which was not a fraud matter, but of concern to the Council; and various random audits that the Audit & Finance Committee would like to see completed.

Mr. Ray noted that the FY 2008/2009 Annual Audit Plan contains a category entitled “Special Audits,” which would include audit requests that require immediate attention and may take the place of a scheduled audit. He also advised that during the Fire Department overtime audit, his staff discovered certain findings within the Payroll Department that, in their opinion, were significant enough to warrant further investigation. Mr. Ray stated that he received concurrence from Mayor Smith and City Manager Christopher Brady that the additional investigation should be included under the “Special Audits” category. He added that the audit reports would be issued to the Audit & Finance Committee for acceptance and then made public.

In response to a question from Committeemember Jones, Mr. Ray noted that he has perceived “a little more apprehension” on the part of staff regarding the fact that the audits conducted by his office are now reviewed by the Audit & Finance Committee. He stated that the purpose of the process was to make City government more transparent and accountable. Mr. Ray added that he instituted the follow-up reviews to ensure that staff completed the audit recommendations.

Chairman Somers thanked Mr. Ray for the presentation.

3. Hear a presentation, discuss and provide direction on the following audits:

a. Police Records – Fee Collection Process

Mr. Ray reported that this item is a follow-up review on an audit that was conducted for the period of February through March 2007. He explained that as a result of the audit, his department recommended two Corrective Action Plans, both of which have been implemented.

b. Police Evidence Section Policies and Procedures

Mr. Ray advised that this matter is an original audit of the Police Department’s Evidence Section Policies and Procedures. He stated that the three Corrective Action Plans provided to staff received an adequate response. Mr. Ray noted that in 9 to 12 months, his staff would perform a follow-up audit to assess whether the recommended Corrective Action Plans have been implemented.

Discussion ensued relative to the disposal of drugs and drug paraphernalia obtained by the Mesa Police Department.

c. Mesa Arts Center Complimentary Tickets

Mr. Ray indicated that this item is a follow-up review on an audit that his department conducted of the Mesa Arts Center (MAC). He explained that the final report from the initial audit included four Corrective Action Plans with recommendations to address his department’s findings. Mr. Ray stated that staff from the MAC provided responses to the audit and concurred with such recommendations and findings. He added that the recommended Corrective Action Plans have been completed.

d. Petty Cash/Change Funds

Mr. Ray reported that over a two-month period, his department performed unannounced cash counts of petty cash and change funds at a number of Responsibility Centers (RC) throughout the City. He stated that overall, the petty cash and change funds were maintained at the authorized levels.

e. Credit Card Security Review

Mr. Ray reported that this item was a review of the City’s compliance with the Payment Card Industry’s Data Security Standards (PCI DSS). He explained that the matter was treated as an advisory services review in order to familiarize staff (at 26 sites that accept credit card payments) with data security standards. Mr. Ray also stated that next year, his department would conduct an annual audit of the City’s compliance with the PCI DSS. He noted that his office has made general recommendations to ensure compliance and added that most departments have begun implementation, with several fully implementing the recommendations.

Discussion ensued relative to the fact that the City Auditor’s review focused on day-to-day processing activities with the purpose of assisting in the City’s PCI DSS compliance efforts; that ITD has a different set of standards that it must address related to securing the encryption of data; that the above-referenced standards were developed by the PCI Security Standards Council, which was founded by the major payment card brands (i.e., American Express, Visa, Inc.); that failure to comply with the PCI DSS would result in the City no longer being able to accept credit card payments; that the PCI Security Standards Council could audit the City, but that would be unlikely unless there was, for example, some type of security breach; and that procedurally, the City Auditor’s Office would complete a self-compliance checklist to ensure the City’s compliance with the PCI DSS.

Chairman Somers thanked Mr. Ray for the presentation.

4. Adjournment.

Without objection, the Audit and Finance Committee meeting adjourned at 10:59 a.m.

I hereby certify that the foregoing minutes are a true and correct copy of the minutes of the Audit & Finance Committee meeting of the City of Mesa, Arizona, held on the 2^nd day of October 2008. I further certify that the meeting was duly called and held and that a quorum was present.

_________________________________________

LINDA CROCKER, CITY CLERK

pag

(attachments – 2)