CITY OF GAINESVILLEOffice of the City Auditor

06

CITY AUDITORSMESSAGEHonorable Mayor, Commissioners, and Citizens:

The Public InterestGovernment Auditing Standards defines public interest as “the collective wellbeing of the community of people and entities” that the auditor serves. My staff and I take this charge very seriously! Since accepting the position as City Auditor in April 2015, we have focused like a laser on identifying risks and threats to the City’s mission. To that end, my wonderful and committed staff and I have implemented an entirely new three-pronged approach to address these areas.

Attack Strategy• Risk Based Audits – our Annual Audit Plan is based on risks, not on rotation. In this way

our efforts target the most vulnerable areas.

• 24/7 Hotline for Fraud, Waste, and Abuse – This third-party operated hotline allows anonymous and identifiable reporting in multiple languages, 365 days per year via either telephone or internet site.

• Internal Control Program – We are working to implement a widely-used internal control plan across the organization. The Committee of Sponsoring Organizations (COSO) of the Treadway Commission updated its framework to COSO Integrated Framework 2013, and we are implementing it now so that risks and controls will be formalized.

ResultsDuring our first 17 months we have completed much needed audits into important areas such as fleet vehicle maintenance, Gainesville Police Department’s Property and Evidence management, the Historic Preservation Board, general fund revenue estimates for fiscal year 2016 and 2017, GRU’s processing of GREC Invoices, a policy and procedure audit related to incidents surrounding the arrest of the Fraternal Order of Police representative, health plan dependent eligibility, GRU’s SAP upgrade procurement, and the vehicle fuel process. We also received 35 hotline contacts during our first nine months of the hotline being active. Two items resulted in internal investigations by the City Auditor, one item was investigated by an external organization, and lesser items were passed on to management to resolve.

We will continue to be your eyes and ears as your advocate for more effective and efficient government.

Sincerely,

Carlos L. Holt, CPA, CFF, CFE, CIA, CGAP01

06

CITY OF GAINESVILLEENABLING LEGISLATION FORCITY AUDITORNote: In fiscal year 2016 the current City Auditor and staff worked with the City Attorney and staff to re-write and take to the City Commission all three pieces of legislation noted below.

Resolution 150297 - Feb 4, 2016• Sets the composition and duties of the Audit and Finance Committee.

• Designates that the City Auditor is responsible for Audit and Finance Committee agendas and reports.

Resolution 150127 - Feb. 4, 2016• Enumerates City Auditor responsibilities

• Provides that the City Auditor’s budget be adjusted only by the City Commission

• Requires a Fraud, Waste, and Abuse reporting mechanism (hotline) and provides investigative duty authority to the City Auditor

• Requires an Annual Audit Plan

• Requires all officers and employees to furnish the City Auditor with information, data, and responses to questions along with access to property, buildings, databases, software applications, etc.

Ordinance 150284 - Feb 18, 2016• Updates language to be consistent with GAO Government Auditing Standards

• Tasks the City Auditor with assisting the Audit and Finance Committee with affecting the contracting process for external financial audits.

02

During this period the City Auditor and staff have also:

Worked with Human Resources to add a presentation of the 24/7 Fraud, Waste, and Abuse hotline to the new employee orientation and provide a hotline card and small poster for each.

Played an integral part of the Citizen’s Academy that takes local citizens through many phases of local government.

Volunteered for annual United Way fund drives.

The public should know that many audits we perform are not related to finances. Rather, audits may be related to construction, project implementation, access to services, performance of contractors, etc.

0603

Auditors often attend city functions and view opperational processesThe largest municipal fraud ever discovered was in Dixon, Illinois in 2012 where the woman below had embezzled $54 million, an amount greater than two entire annual city budgets. All the three elements of the City Auditor’s three- pronged approach are designed to prevent and detect such crimes.

The process for approving the biomass plant’s monthly invoices was audited during this period.

03

SUMMARY OFINVESTIGATIONSPERFORMEDInvestigation of Misreporting of Crime StatisticsAllegations: A whistleblower who requested confidentiality in accordance with Florida whistleblower statutes and an anonymous caller alleged that the GPD had reclassified crime incident reports to move incidents that would be reported as FBI Uniform Crime Report (UCR) Part I crimes (most serious) to Part II crimes (less serious)

Finding: After a thorough evaluation of the multi-stage crime incident reporting process, including inspecting hundreds of incident report and interviewing several witnesses, we were able to determine that the allegations were unsubstantiated.

Investigation of Misuse of Grant Funds and Fees Paid for RentAllegations: A complainant that leased a building from Reichert House alleged that her rent payments were not properly deposited in the Reichert House Account, that a grant Reichert House received was being misused, and that there was a requirement to train Reichert House youths in the business that she ran (a seafood restaurant).

After inspecting all correspondence, bank records, financial transactions, and interviewing many witnesses, we were able to determine that the allegations were unsubstantiated.

SUMMARY OF PERFORMANCEAUDITS ISSUED

Audit of Fleet OperationsWe found that although most city departments are generally satisfied with service, significant concerns were communicated regarding vehicle and equipment service rates, mark-ups on parts and subcontracted services, and the length of vehicle downtimes. Some further observations:

• Labor charges were inconsistent• Routine maintenance costs were substantially higher at Fleet than at local providers• Industry related cost per mile metrics were substantially higher for Fleet than industry benchmarks.

However, weak methods for the collecting and retaining mileage data casts doubt on the accuracy of the resulting metrics

• Only 46 percent of Fleet maximum available work hours were spent performing maintenance• Application management for FASTER and the security of underlying tables were not established

Fiscal Year 2016 General Fund Revenue Estimate AttestationWe found the projected Fiscal Year 2015-2016 General Fund Revenues and Other Sources of Funds in the total amount of $108,599,293 as adopted by the City Commission on September 17, 2015, were prepared using data and methods to provide reasonable assurance the revenues will be realized. Concerned parties can place reasonable reliance on revenues contained in the General Government Financial and Operating Plan.

We noted the status of one revenue source (leasing agreement) is currently at $247,000 of unrecognized income. Management is aware and currently renegotiating terms with the tenant and seeking another tenant to share space. This item would not be material to the overall revenue estimates of the City (0.2%).04

0605

Audit of GRU Processing of GREC InvoicesWe found several contract metrics that were not implemented as described in the contract, the most significant of which was the Construction Cost Adjuster used to calculate the Non-Fuel Energy Charge. The miscalculated rate increased all MW-h of available energy charges by 3.21% instead of 1.81% resulting in overpayment of $0.77 per MW-h of available energy, 1,133,115 MW-h since the commercial operation date. For internal processes, the entire invoice process is centered on one position and should be segregated. Fuel process monitoring requires increased effort. Measuring and verifying delivered energy as well as ascertaining the amount of available energy that should be reimbursed on the invoice was found to have adequate overlapping controls and sufficient oversight although several recommendations were provided.

Audit of Gainesville Police Department– Property and Evidence SectionIn general, internal controls over property and evidence inventory were adequate to ensure compliance with applicable standards. The RMS system used to track inventory is sufficient to ensure an accurate inventory. We noted internal controls pertaining to building security, cash handling and document retention should be strengthened. We also noted storage capacity needs attention.

04

Audit of Health Dependent EligibilityOur testing indicated that a small number of ineligible dependents were enrolled in the City’s health care plan. Our sampling found that 98 percent of enrolled dependents were eligible for their enrolled coverage. Out of 290 dependents included in the statistical random sample, employees chose to drop five dependents when qualifying documents and affidavits were requested. Another dependent was deemed ineligible (should not have been retained in the plan after life event/age change). Coverage was discontinued for these six by Risk Management. The statistical sample exception rate projects that 45 ineligible dependents (39 more) were resident in the population of dependents. Risk Management’s processes have effective controls but they should include a proactive, rotational dependent verification.

Audit of City Policies and Procedures• We found that no City funds were identified as being expended for activities related to events

detailed in the FDLE affidavit.

• No administrative investigation was completed for either the GPD Officer who retired or for the Human Resources manager who resigned.

• The Mayor was not subject to City codes related to ethical standards and disciplinary procedures; rather, to state standards if determined applicable.

• The Mayor self-reported his interactions with the former GPD Officer/FOP President to the Florida Commission on Ethics; however, the Commission dismissed the matter due to a process issue with self-reporting.

• Fraternal Order of Police (FOP) labor contract (2010 – 2013) negotiations were materially complete prior to the Mayor taking office. The former HR Manager played only a supporting role negotiating the FOP labor contract but participated in 61 GPD disciplinary actions during the period detailed in the affidavit, ten of them involving grievances where the former GPD Officer/FOP President represented the officers in the hearings.

• Current City Policies and Procedures regarding ethics and conduct are reasonable, proactive, and continually reviewed. No set of standards would ensure hidden and unknown infractions do not occur.

• Human Resources management and GPD management competently and reasonably dealt with both situations upon their discovery.

Audit of Historic Preservation BoardThe Board is knowledgeable and passionate in seeking to preserve the character of the City’s Historic District and other historical structures. However, we found:

• The Board’s passion has at times been perceived as confrontational and lacking civility by petitioners, especially for demolition requests

• Board members representing professional interests must be careful to abide by conflict of interest rules during discussions and voting

• There is not a current and accessible local register of historic properties

• Board activities were not reported to the City Commission annually

• Board rules were not submitted for City Commission approval

• Preservation Guidelines were voluminous and unclear

• Proactive efforts to secure external grants weren’t conducted

06

05

General Fund Revenue Estimate Attestationfor Fiscal Year 2017(*now performed prior to start of fiscal year)

We found the projected Fiscal Year 2016-2017 General Fund Revenues and Other Sources of Funds in the total amount of $113,398,251 as adopted by the City Commission on September 15, 2016, were prepared using data and methods to provide reasonable assurance the revenues will be realized. Concerned parties can place reasonable reliance on revenues contained in the General Government Financial and Operating Plan.

Audit of GRU SAP Upgrade Interim Report 1(underway but not complete at end of FY 2016)

The project team is functioning within the standards of project performance. However, we found that there are four areas of general concern at this time which can be adequately address by GRU without long-term negative impacts.

• The SAP Premium Engagement Services presents a lack of clarity of services to be provided and value to be received

• There is a lack of visibility of the project schedule due to it not being updated in a timely manner

• The contractor is not filling some key roles when scheduled

• Data migration staffing presents risks to the critical path and completion timeline

Audit of VehicleFuel Process(underway but not complete at end of FY 2016)

• Fleet Management’s fueling structure is obsolete, labor intensive, and inefficient

• Fuel transaction records from the vendor could not be accurately matched with the fuel transaction records in FASTER, the City’s Fleet Management system

• Some departments with high fuel usage were not monitoring their fuel usage transactions

• Internal controls over “dummy” keys (not specifically assigned to a vehicle or person) were not in place to establish accountability for fuel gallons pumped

• Gainesville Regional Utilities (GRU) Eastside Operations Center fuel site equipment has experienced frequent outages since its 2011 installation

• Fleet Management has a large number of key functions centered on one person

Other Audits UnderwayAudit of GRU SAP Implementation – Interim Report II

Audit of GPD Use of Force

Audit of Human Resources Hiring Cycle

Audit of Equal Opportunity and Small Business Purchasing Process

Future Goals to Pursue Continue to build the organizational risk model, updating continuously

Continue implementing the COSO internal control plan across the organization

Continue performing risk based audits

Complete audit staffing by adding the right person to the 2017 budgeted Senior Auditor position07

08

CITYAUDITOR’SMISSION

To promote honest, efficient, effective, transparent, and fully- accountable government by providing value-added, informationally-rich products to the citizenry, City Commission, and City Management.

ACCOMPLISHMENTHIGHLIGHTSFOR FY2016

Category Activity Significance Impact

Received 35 contacts during the fiscal year, stopped or prevented several misconduct type issues and protected misused assets

Fleet, Fuel, and SAP audits had significant IT findings. SAP has a $32 million procurement at stake as well as the functionality of GRU finances

1. Discontinued voluminous/ costly paper records for all audits and other projects.2. Supervisory sign-offs now documented as per profession-al requirements

FY 16 Annual Audit Plan is focused to areas of

1. Used on health dependent eligibility audit to sort and sample (found >2% not eligible)2. Used on fuel audit to determine indicators of waste and theft

Direct Impact with citizens, employees, and suppliers through third party

Previous year’s audits had little to no IT element to ensure data, processing, access, permissions, etc. were effective

The office was likely one of the last few remaining manual work paper audit offices in government.

Allows audit resources to be targeted toward areas of greatest risk vice rotational methods

Allows increasing use of big data sets to be analyzed by efficient methods

Implemented third party Fraud, Waste, and Abuse Hotline (Jan 2016) that is up 24/7 by phone and online, multiple languages.

Created position and hired IT auditor (June 2016)

Implemented automated work papers (Oct 2015)

Created model of organizational risk (Jan 2016)

Implemented data analysis tools for big data

Internal/External Communication

Personnel

Information Technology

Information Technology

Information Technology

09

Category Activity Significance Impact

More formalization of controls to address risks in some departments

Not yet started, hiring to take place end of Nov 2016

Timely information provided on Fleet Vehicles, revenue verf. FY16, Policies and Procedures related to ethics issues and C of G funds, Historic Preservation Bd., Health Depn. Eligibility FY17, GRU SAP, Vehicle Fuel.

Allowed CCOM to move on several issues that they required more information.

Several reputable firms made proposals, which are being evaluated at this time.

Areas of concern were address by the external auditors and clean opinions were obtained.

Result of investigation into both matters (crime stats and Reichert House) determined that the allegations in both matters were unsubstantiated.

Required for publicly held corporations and the federal government, the framework is a way to put controls in place and monitor them.

Ensure staff at professional standards level suggested by IIA and ALGA

Essential to the basic function of the audit office

Confidently related results by meeting and/or presentation so that information request-ers can feel assured that they had the right information.

External audits are one of the most important pieces of information for a government entity. Borrowing limits, bond ratings, public perception, and other important matters are directly affected by the Financials.

Without proper continuing communication and oversight, the financial audit.

An internal investigative function for F, W, A and misconduct allows prompt resolution of allegations.

Began implementation of 2013 COSO Internal Control Framework

Created position for one additional Senior Auditor, obtained increment from CCOM

Released seven perfor-mance audits that complied with government auditing standards

Provided assurance and research services to the CCOM on such topics as:Hippodrome, GREC, ethical requirements of CCOM, QTIs, size of GF assigned fund balance, metrics for size of police force, others.

Created RFP for external audit function for GRU and CoG, set parameters for evaluation, and chose two 3- member teams to evaluated proposals.

Oversight over external auditors work, approving invoices at various stages.

Completed two significant effort internal investigations from hotline matters.

Organizational Risk Model

Personnel

Audits (see summary of each below)

Assurance Services

Procurement

External Audit

Fraud, Waste, Abuse, Investigations

0610

EXHIBIT ACITY OF GAINESVILLE

OFFICE OF THE CITY AUDITORFISCAL YEAR 2017 ANNUAL AUDIT PLAN

A. Audit Projects Carried Forward from the 2016 Annual Audit Plan

Human Resources Hiring Cycle 450

GPD Use of Force 320

GPD Ammunition Controls 400

SAP Upgrade Monitoring/Status - Ongoing 480

Estimated Hours

B. Audit Projects for 2017GRU Non-pension Investments 440 Citywide Overtime 320 RTS Fare box Revenues 320 Dignity Village Inputs 360 Vendor File Match 320 Landlord Registration Fee Compliance 360 Take-Home Vehicles 380 RTS Fuel 340 Grants Management GG 320 Small Business Purchasing compliance 220Annexed Property Fee Collection 420

Estimated Hours

C. Follow-up on Status ofPrevious Recommendations* Follow-up on Recommendations 160

Estimated Hours

D. Other ProjectsHotline Implementation, Inquiries and Research* 220 GRC Implementation* 380 Annual Validation of GG Projected Revenues** 220 CCOM/Management Referrals* 80

Estimated Hours

TOTAL FY17 AUDIT STAFF PROJECT HOURS 6,510

Audit Classifications per Government Auditing Standards:* Non-audit Services, ** AttestationsAll others are performance audits

06

CITY OF GAINESVILLEOffice of the City Auditor

352-334-5020

352-334-2096

auditors@cityofgainesville.org

www.cityofgainesville.org

P.O. Box 490, Station 17Gainesville, Florida 32627-0490