Editor’s note: The author of this article does not have an accounting degree and is not a Certified Public Accountant. Nevertheless, he is capable of reporting about these subjects.
In May, Riverside County Superior Court issued a grand jury report criticizing how the county’s Auditor-Controller’s Office (ACO) conducts its internal audits and how county officials respond to those audits.
“The Board, Executive Office, and ACO have known about the issues surrounding internal audits for many years. Now, they have the opportunity to demonstrate their leadership abilities by rectifying issues. The question is, ‘Will they?’” was how the grand jury summarized its report.
In the first paragraph of his response to the grand jury, Auditor-Controller Paul Angulo opined, “The grand jury’s report dated May 27, 2022 ought to function as a prime example of broken government, or as Johann Wolfgang von Goethe said, ‘There is nothing more frightful than ignorance in action.’”
The grand jury made 12 findings, leading to 13 recommendations. Angulo “completely disagreed” with all 12 findings and rejected most of the recommendations. He believes a separate third-party review prior to the grand jury report corroborates his views.
From November 2021 through January 2022, ACO had an outside auditor, David S. Marshall, CEO of Infotech Global, conduct a peer review of ACO operations. His summary was, “We conclude that the ACO Internal Audit operation ‘Generally Conforms’ to internal auditing professional standards as prescribed by the Institute of Internal Auditors’ ‘Internal Professional Practices Framework,’ and employs many best practices for auditing. ‘Generally Conforms’ is the highest ranking on a three-point scale.”
For example, the grand jury’s first finding was that ACO was not in compliance with the state’s Government Code section 25250 regarding government audits. But Marshall’s report found that ACO conducted audits according to section 25250 and in compliance with Government Code section 1236, which requires audits to be conducted under “… the general and specified standards prescribed by the Institute of Internal Auditors or the Government Auditing Standards.”
But Marshall did assess several activities as partially conforming. This included a recommendation to separate the “Internal Audit” from the “Specialized Accounting” units. The grand jury also made this recommendation.
The response to Marshall was simple and direct, “As noted, the current responsibilities and tasks performed under the Specialized Accounting Unit is not audited by the Internal Audit Unit. Furthermore, most of the work performed under Specialized Accounting is audited by State Agencies thus at this time the department will maintain the structure.”
But in his retort to the grand jury, Angulo stated, “Splitting the two Divisions would require another set of supervisors, mid-level managers and Chief… The ACO does not serve the grand jury, the ACO serves the people — 2.5 million residents — and will not fix what is not broken.”
Engagement planning and monitoring progress were the other two partially conforming areas.
Despite his overall “Generally Conforming” conclusion, Marshall did offer 13 other recommendations. Many of these correspond or overlap with the grand jury’s recommendations.
Angulo agreed with almost all of Marshall’s suggestions (except for splitting the Specialized and Internal Audit units) while rejecting the grand jury’s perspective.
For example, the grand jury recommended establishing an Audit Oversight Committee, whose members would include representatives from the board, the Executive Office, ACO, the private sector and the five supervisory districts. The purpose was to ensure that high-risk areas were covered.
Angulo described this idea as “straight out of the Communist manifesto.” He argued that only a professionally licensed accountant could appropriately lead the county’s audit function. Further, departmental representatives would not voluntarily suggest topics that might identify risks under their management.
Yet, Marshall’s first recommendation suggested, “More interaction with the Board of Supervisors and Department Heads.” At these sessions with the board of supervisors and each department head, Marshall suggested the AC or staff present information to encourage engagement and transparency. Among the subjects the AC could address are the value of internal audits, their methodology, selection and testing of transactions and controls; a tracking system that summarizes the audits, their status and communication of results; and significant changes and risks, including board and department head solicitation of risks.
Marshall’s report included the AC’s responses and comments on his recommendations. This is the AC’s response to this recommendation, “We concur with the recommendation. Assistant Auditor-Controller and Chief Internal Auditor plan to meet with County officials to discuss the value we can bring through internal audits, perspectives on risk at department and county level, communicate high materiality audit results, and other of the items recommended.”
The grand jury’s second recommendation was treated similarly. The grand jury proposed a policy to audit all departments every two years “with an emphasis on high-risk financial and operational topics.”
In his second suggestion, Marshall acknowledged that state law requires biannual audits, with limited resources to focus exclusively on high-risk areas. Nevertheless, he urged, “… consider limit
ing the scope of certain audits to the highest risks with the audited departments. By employing ‘limited scope’ audits, more of them could be performed within a given year … to target the functions and transactions whose controls are most likely to break down (ex. misuse of funds, theft of assets, operational inefficiencies, cybersecurity beaches, etc.). Active participation from the Board of Supervisors and department heads would be needed to help achieve the effectiveness of this approach.”
The AC concurred with Marshall and noted that it was preparing a county-wide risk assessment so it could focus on high-risk areas. The biannual audit requirement still had to be met.
But Angulo’s response to the grand jury was less conciliatory. He noted that Marshall described his audit planning as a “leading practice,” while ignoring his later recommendation.
A final example is the response to the grand jury recommendation that ACO annually provide information such as systemic audit findings, internal audit status reports and a risk management dashboard.
Angulo’s response was “The ACO will not waste the taxpayer’s money formulating and managing more paperwork that require more staff. The information that is needed is in the reports that are already submitted.”
Yet Marshall’s eighth suggestion was for the audit staff to consider compiling a list of control deficiencies from each audit and present them to the board of supervisors on an annual basis.
And the AC’s comment was, “Concur with the recommendation. This will be a beneficial report for the Board of Supervisors and County Department Heads.”
Angulo concluded his response with further denigration of the grand jury report, calling its intent, “To degrade the staff who outperform other regional counties” and a “Political hit on the current Auditor Controller …”
He did state that the ACO will take “the recommendations of a Certified Auditor firm who conducts professional, qualified assessments, and who has reported as March 22 that the ACO is in full compliance with the law and professional standards.”
While Angulo is completely affronted by the grand jury report and its recommendations, he is willing to consider and to implement suggestions from Marshall’s report. The grand jury had access to this report and included it in its extensive bibliography at the end of its report.
While the grand jury and Marshall’s reports were not identical, there is significant overlap and similar recommendations. If Marshall’s suggestions are addressed and implemented, then much of the grand jury recommendations will be accomplished, too.
