Loading...
HomeMy WebLinkAbout2425-7 Follow-up Fair and Expo Cash Handling (Final 12-6-24) Audit Follow-up Report Fair and Expo Cash Handling To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor Table of Contents: 1. Introduction ....................................................................................... 1 Background on Department and Original Audit ......................................................... 1 2. Follow-up Results .............................................................................. 2 3. Appendix A: Updated workplan (status as of November 2024) .. 3 4. Appendix B: Objective, Scope, and Methodology .......................... 4 Objective and Scope ....................................................................................................... 4 Methodology ................................................................................................................... 4 Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor 1. Introduction The Deschutes County Audit Committee has suggested that follow-ups occur within nine months of the report. The Audit Committee would like to make sure departments satisfactorily address recommendations. Background on Department and Original Audit The Fair and Expo Center is a County-operated 320-acre facility located in Redmond. Fair and Expo’s largest event is the annual Deschutes County Fair, but it also hosts over 400 events annually with an emphasis on events supporting youth, agriculture, and community. In addition to events, Fair and Expo operates a 105- space RV park, which is open year-round. Fair and Expo supports County operations by acting as a response and evacuation center, as well as a staging area for fires and other disasters. Most recently, it served as the host site for the Deschutes County Circuit Court during the Covid-19 pandemic. The County classifies Fair and Expo finances as an enterprise fund due to the department’s business-like operations aimed at generating revenue to sustain its operations. In addition to revenue generated directly by Fair and Expo, operations are supplemented by County transient room tax. As a money-making County enterprise, Fair and Expo has a higher revenue-related risk-profile than other County departments. We found that Fair and Expo did not have complete policies and procedures to ensure that revenue due to the organization was received and deposited. Fair and Expo had not conducted assessments to document risks in areas such as: • overall fraud risks, • segregation of duties within financial processes, • risks associated with using separate financial information systems, and • information system user access and transaction authority. Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor Despite a vulnerable control environment, we did not observe any instances of fraud or theft. 2. Follow-up Results The follow-up included five outstanding recommendations agreed to by the Fair and Expo Center. Figure I provides an overview of the resolution status of the recommendations. Figure I: How were recommendations implemented? With this follow-up, sixty percent (60%) of the outstanding recommendations have been fully addressed. As indicated in the provided responses, they plan to document a fraud risk assessment and update fiscal procedures. Progress has been made on documentation of roles. The details of the follow-up are included at the end of the report in Appendix A. In interpreting the status, Internal Audit may sometimes raise or lower the status provided by the department based on communication received from the department. Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor 3. Appendix A: Updated workplan (status as of November 2024) Recommendation Status Target Date Updated Comment Fair and Expo management should conduct a fraud risk assessment and document outcomes. Underway May-25 Moving forward, a formalized and documented fraud risk Assessment will be conducted on a regular basis. Fair and Expo management should document procedures to address the risks identified in the fraud risk assessment. Underway May-25 Moving forward, a formalized and documented fraud risk assessment will be conducted on a regular basis. This documentation will be utilized to formulate, or update documented financial procedures. When designing procedures, Fair and Expo management should outline major financial processes, along with staff assigned to specific activities, and determine whether any roles are conflicting. Completed May-25 Fair & Expo has worked to create separation or clarity and/or documented steps between assigned financial duties. In the current system, while an individual employee may perform multiple duties, multiple parties have access to/or awareness of the activities to provide additional layers of oversight and to identify any item that may be out of compliance. Fair and Expo management should design and document an efficient reconciliation process across systems. It might be helpful to create a log of unique identifiers from each system to record how records relate to one another. Completed Aug-24 Fair & Expo has worked to create a reconciliation process across existing systems. Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor 4. Appendix B: Objective, Scope, and Methodology Objective and Scope Objective: The objective was to follow up on recommendations from the original audit. Scope and timing: The follow-up included five recommendations from the internal audit report for Fair and Expo Center Cash Handling #23/24-8 issued in February 2024. The original internal audit report should be referenced for the full text of the recommendations and associated discussion. The follow-up reflects the status as of November 2024. Methodology The follow-up report was developed from information provided by Geoff Hinds, Fair and Expo Director. Follow-ups are, by nature, subjective. In determining the status of recommendations that were followed up, we relied on assertions provided by those involved and did not attempt to independently verify those assertions. The updates received were included in Appendix A. Recommendation Status Target Date Updated Comment Fair and Expo management should document data security controls for all financial information systems including who has access to data and rights to execute transactions. Each user should have unique access credentials. Completed Aug-24 During the audit it was discovered that the software utilized had made updates, allowing for new controls to be put in place. Fair & Expo worked with Deschutes County Finance to adjust software, and shared passwords are no longer utilized. “Audit objectives” define the goals of the audit. Fair and Expo Center Cash Handling Follow-up 2425-7 December 2024 Deschutes County Office of the Internal Auditor Since no substantive audit work was performed, Government Auditing Standards issued by the Comptroller General of the United States were not followed. The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair - Public member Aaron Kay – Performance Auditor Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Joe Healy - Public member Email: internal.audit@deschutes.org Summer Sears – Public member Web: www.deschutes.org/auditor Kristin Toney - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.