HomeMy WebLinkAboutFCS-17-197 - External Audit Plan for Fiscal 2017
REPORT TO: Audit Committee
DATE OF MEETING: December 11, 2017
SUBMITTED BY: Corina Tasker, Internal Auditor, 519-741-2200 ext. 7361
PREPARED BY: Corina Tasker, Internal Auditor, 519-741-2200 ext. 7361
WARD(S) INVOLVED: ALL
DATE OF REPORT: December 1, 2017
REPORT NO.: FCS-17-013
SUBJECT: 2018 Internal Audit and Service Review Work Plan
___________________________________________________________________________
RECOMMENDATION:
That the 2018 Internal Audit work plan be approved as outlined in report FCS-17-
013 dated December 1, 2017.
BACKGROUND:
Under the Audit Committee terms of reference it is the Audit Committee’s responsibility
to provide recommendations for areas of focus and types of audits as well as approve
the annual internal audit work plan.
The integrated service review work plan encompasses not only the work of Internal
Audit but also that of other staff across the corporation with responsibility for service
review work. By planning service review work corporately it ensures that there is no
duplication of effort and that work is integrated across departments where required.
This comprehensive approach also ensures that all service areas will be reviewed at
some point over approximately a six year period.
This report shows the 2018 integrated service review work plan as well as the Internal
Audit work plan. Only the Internal Audit work plan requires Audit Committee approval.
*** This information is available in accessible formats upon request. ***
Please call 519-741-2345 or TTY 1-866-969-9994 for assistance.
2 - 1
REPORT:
Service Review Goal
The Effective and Efficient City Services priority within the City’s Strategic Plan (2015 -
2018) places a priority on improving the design and delivery of city services, responsible
stewardship of public funds and accountability, among other things. The overarching
goal of service reviews is to protect the City’s assets and interests, which supports
these priorities. This includes, but is not limited to, protecting the long term health of the
organization, its financial and physical assets, its reputation, its ability to perform critical
services and the safety and well-being of employees and citizens.
The way that staff achieves this goal is through three main categories of review work:
1. Ensuring operations are efficient and effective as possible
Are we doing the right things?
Are we doing things in the right way?
Are we making the best use of our limited resources?
Are we meeting customer or citizen needs?
2. Ensuring controls are adequate to protect assets from loss
Have risks been adequately identified and mitigated?
Are there structures and processes in place to prevent or detect loss,
theft, fraud?
3. Monitoring compliance with policy, procedures and legislation
Has staff been adequately trained on what is expected of them?
Are staff following the rules to ensure work is accurate, reliable, timely,
efficient, effective, safe, and legal?
Are staff putting the corporation at risk in any way through their actions or
inactions?
This review work is carried out by internal audit, along with staff in the City’s various
departments, to review both internal and customer facing services using a variety of
tools. These may include:
Service delivery reviews
Lean tools and techniques including process mapping and assessing adequacy
of controls
Time studies
Value for money analysis
Organizational structure review
Review of workplace culture
Risk assessments
Policy review
Compliance audits; and
Physical inventory and cash counts
2 - 2
2018 Internal Audit Work Plan
The 2018 internal audit work plan includes service reviews as well as controls audits
and recurring internal audit activities. Audit Committee is asked to approve the 2018
Internal Audit work plan shown below as per the Audit Committee terms of reference. A
description of the types of review is included in Appendix A.
The service review portion of the work plan is typically composed of a combination of
services chosen from the prioritized list of services and Council requests. This year
neither of those factors has influenced the content of the work plan. This is because
there is considerable work from the 2017 work plan which will carry over into 2018 and
will consume resources in the first half of the year. This is due to two of the service
improvement resources being temporarily assigned to other special projects, and the
extra time that was required to perform the Lean process review of the Revenue division
which was not originally factored into the work plan schedule.
The CAO has also committed to conducting a development service review which will be
supported by Internal Audit and the other city staff. The process review component of
this service review will start in the second half of 2018 and will be a very complex and
lengthy review.
In addition to these known work plan items, there may be additional work required to
perform organizational reviews at the division or section level in some areas following
the larger corporate organizational review which will be completed early in 2018. As
such, staff needs to maintain some capacity in the work plan for this potential work.
Internal audit will continue to conduct the annual physical inventory, and any
confidential investigations as required. Other small controls or compliance reviews
could be done on an ad hoc basis as time permits such as regular cash, employee
expenses or VISA card audits.
The Council priorities for service reviews that were solicited during the September 2017
Audit Committee meeting can, however, be advanced in other ways outside of the
internal audit or service review work plans. The following priorities were identified by
Council:
Special Events – workload, capacity
Economic Development – workload, capacity, process
Facility Planning – capital costing process
INS Administration – organizational structure
Parking Enterprise – technology utilization, revenue maximization
The Economic Development division is recently under new leadership. As part of the
new Executive Director’s initial activities, a review of division capacity and resourcing is
2 - 3
being done. This includes the Special Events section. Therefore, it is considered
redundant to initiate a separate audit or service review at this time.
Regarding the request for a review of facility planning, it is understood that Council was
looking for a condition assessment of city facility assets as input into the business plan
for next year. Due to the specialized skill set required for this work it is not possible to
complete it with internal resources. Facilities Management is in the process of
conducting a condition assessment of the top 3 building assets and there will be further
work conducted through the Leisure Facilities Master Plan to evaluate facility renewal
requirements.
Concerns around the interim nature of the INS Administration team will be resolved
through the corporate organizational review. Additional analysis related to the
effectiveness and capacity of INS support services is being reviewed internally and
therefore a separate internal audit is not required at this time.
The Parking Enterprise has been exploring a number of new parking technologies
throughout 2017 (listed below). Staff do not feel a separate review is required.
A new Pay by Mobile parking application is planned to be implemented in early
2018 complementing the City’s existing surface parking lot pay & display ticket
system. The Pay by Mobile parking app will provide customers the ability to pay
for parking via their cell phones and will offer a greater user experience by
offering the ability to extend parking space use remotely and on-line receipts for
parking payments.
The newly installed LED street lighting and associated narrowband smart control
infrastructure platform provides the opportunity for potential applications that
could result in significant operational and economic improvements including
Smart Parking. This opportunity will be explored more fully as part of the Digital
Kitchener Innovation lab. Smart Parking includes parking management systems
such as parking displays and guidance systems that enable users to find
convenient and available parking.
A new night-time user rate is also planned to be offered before 2019 allowing
residents in the downtown area the ability to park their vehicles overnight in
secured parking garage facilities for a reduced monthly fee over the existing day
time monthly fee.
In summary, all of the areas of Council interest are being addressed in some form within
the corporation. If staff have misinterpreted Council’s direction regarding these topics,
further clarification can be provided during the Audit Committee meeting. However,
there is a very limited amount of capacity available for new work in 2018.
2 - 4
Listed below is the proposed Internal Audit work plan:
Audit Area Type of Review Notes
Service Reviews
Operations – Winter Comprehensive Review Carried over from 2017
Maintenance
Fire – Administration Process (Lean), Capacity Carried over from 2017
By-law Enforcement – Workload, Capacity, Process Carried over from 2017
Property Standards (Lean)
DevelopmentComprehensive
Controls Audits
SAP – User Profiles Separation of DutiesCarried over from 2017
Recurring Internal Audit Activity
Physical Inventory Count verification
Confidential Investigations As required
2018 Integrated Service Review Work Plan
The 2018 integrated service review work plan is for information only. In addition to the
service reviews from the internal audit work plan above, the following reviews are also
included in the integrated service review work plan:
Service Type of Review Resource(s)
Benefits and Pensions Capacity, process (carried over FCS
Administrationfrom 2017)
Utilities Risk assessment (carried over INS
from 2017)
Use of Consultants Value for money (carried over INS
from 2017)
Volunteer Resources Capacity, process CSD
Reporting
All service reviews assigned to Internal Audit will be brought forward through the Audit
Committee in audit status reports on a quarterly basis. All service reviews assigned to
other resources will be brought forward through the Audit Committee in an annual
summary report in conjunction with Internal Audit’s year in review report. The report will
contain the status of the reviews and any major findings or recommendations but will be
much smaller in scope and detail than the internal audit reports. If further explanation or
detail is required by Council this can be provided upon request.
Any reports which require a decision by Council will be brought forward to the
appropriate committee with a detailed report.For example, if recommendations within
the report indicate that a service should be discontinued, changed significantly or
additional funding is required then it would be brought forward for Council approval.
2 - 5
ALIGNMENT WITH CITY OF KITCHENER STRATEGIC PLAN:
This report supports the achievement of the city’s strategic vision through the delivery of
core service.
FINANCIAL IMPLICATIONS:
There are no financial implications related to this report.
COMMUNITY ENGAGEMENT:
INFORM – This report has been posted to the City’s website with the agenda in
advance of the council / committee meeting.
ACKNOWLEDGED BY: Lesley McDonald, Acting Deputy CAO, Finance and Corporate
Services
2 - 6
APPENDIX A: TYPES OF REVIEWS
TypeofReviewDefinition
CapacityAreviewoftheactualtransactionorworkvolume,theaverage
timetocompleteeachtransactionandtheestimatedrequired
resourcingcomparedtotheactualresourcing.
ComplianceAtesttodetermineifstaffisfollowingallrules,regulationsand
policiesassociatedwiththeservice.
ComprehensiveAnallencompassingreviewofthedivisionorserviceincluding
thingslikeprocessreview,organizationstructurereview,controls,
compliance,riskassessment,servicedelivery,customer
satisfaction,valueformoney,capacity,benchmarkingandany
otheranalysisrequired.
ControlsAnanalysisandtestofcontrolpointswithinaprocesstoensure
thatfraudulentactivitycanbeeliminatedormitigated.
CostanalysisAdetailedanalysisofdirectandoverheadcostsofaserviceand
analysisofchargeoutratesifapplicable.
CustomersatisfactionAreviewofcustomersatisfactionwithaserviceandwhere
improvementscouldbemade.
FollowupAnadditionalreviewofanytype,notsoonerthan1yearafterthe
"___________"originalreviewinordertoassesstheimpactoftheoriginal
recommendationsandproactivelyidentifyanynew/emerging
risks.
ProcessAnanalysisofhowaprocessisdoneandwhereefficiency&
effectivenessimprovementscouldbemade,including
considerationofallstakeholdersrelatedtotheprocess.
RiskassessmentAnidentificationofallofthepossiblerisksthatcouldaffecta
serviceincludingratingtheprobabilityandimpactoftheriskusing
thecorporateriskmatrix.
RoleclarificationClarification,documentation,andcommunicationofrolesand
responsibilitiesofsimilarrolestoensurethereisnooverlapin
duties.
ServicedeliveryAreviewtodeterminetheoptimalmethodofdeliveringaservice
includingexploringoptionsofcontractingoutornotdeliveringthe
serviceatall.
ValueformoneyAcomparisonofthefullyburdenedcostofprovidingaservice
(includingalldirectcostsplusoverhead)comparedtothecostof
obtainingtheservicefroma3rdparty.
2 - 7
PLAN
AND
WORK
AUDIT
REVIEW
INTERNAL
013
17
FCS 2018SERVICE
2 - 8
efficient
protect
&
procedures
to
źƓƷĻƩĻƭƷƭ
Reviews
policy,
ğƓķ
effective
adequate
with
are
ğƭƭĻƷƭ
are
Service
of
/źƷǤƭ
loss
operationscontrolscompliance
ƷŷĻ
from
Goal
legislation
ƦƩƚƷĻĭƷ
EnsuringEnsuringassetsEnsuringand
ƚƷŷƩƚǒŭŷʹ•••
2 - 9
years
based
review
on
six
the
last
review
over
of
based
corporate
work
for
ofapprove
date
to
Process
created
only
reviewed
and
services
priorities,
plan
allprogram
plan
Plan
areas
required
budget
work
Council
work
service
list,
prioritize
Work
consistent
Audit
all
to
expense
review
Committee
risk,
Processon
ServiceprioritizedprioritiesOngoing,EnsuresAuditInternal
•••••
2 - 10
other
starting
2018
work
of
drive
in
review
half
may
to:
first
currently
due
review
into
(not
Process
Development
work
over
projects
of
Revenue
new
reviews
special
for
Plan
organization
carrying
add
to
level
to
2018
complexity
review
of
year
reviews
assigned
Work corporate
and
Lean
section
half
/
of
this of
2017
scope
ResourcesLength
second
––
capacity
plan)Largein
SeveralOutcomedivisional
No•••
2 - 11
ways:
structure
other
process
process
in
utilization,
capacity
costing
ΑĭğƦğĭźƷǤͲ
Priorities
addressed
be
ΑƚƩŭğƓźǩğƷźƚƓğƌ
ΑƷĻĭŷƓƚƌƚŭǤ
ΑĭğƦźƷğƌ
will
ΑǞƚƩƉƌƚğķͲ
Council
Development
maximization
Enterprise
Events
Planning
priorities
Administration
EconomicFacilityINS
SpecialParkingrevenue
Council•••••
2 - 12
Plan
Capacity
Work
(Lean),(Lean),Capacity
Review
of
2)
ProcessComprehensive
Process
of
1
approval:
Audit
(page
your
For
MaintenanceComprehensive
ΑtƩƚƦĻƩƷǤ
Internal
ΑźƓƷĻƩ
Reviews:
Enforcement
AreaType
Α!ķƒźƓźƭƷƩğƷźƚƓ
law
2018
Audit Service OperationsFireByStandardsDevelopment
2 - 13
Plan
duties
of
Work
Review
of
required
2)
CountverificationAs
of
2
approval:
Audit
(page
your
For
Activity
Internal
Investigations
profilesSeparation
InternalAudit
Audits:
Inventory
AreaType
2018
Α
ƭĻƩ
Audit Controls SAP Recurring PhysicalConfidential
2 - 14
Plan
plus:
plan
Work
work
moneyINS
capacityFCS
ReviewResources
for
Audit of
assessmentINS
information
Internal
Review
the
your
of
all
For
Includes
AdministrationProcess,
Service
Pensions
and
AreaType
2018
Service BenefitsUtilitiesRiskConsultantsValueVolunteerResourcesCapacity,processCSD
2 - 15