Loading...
HomeMy WebLinkAbout2425-2 Public Health Integrated Audit (Final 12-17-24) Audit Report Public Health Integrated Audit To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Take survey by clicking here Public Health Integrated Audit 24/25-2 December 2024 Table of Contents: 1. Introduction ....................................................................................... 1 Background on Deschutes County Public Health ....................................................... 2 Leadership ................................................................................................................... 2 Organization ................................................................................................................ 2 Staffing ......................................................................................................................... 3 Funding ........................................................................................................................ 5 2. Findings and Observations .............................................................. 6 Findings ........................................................................................................................... 6 County faces persistent delays in employee evaluations: Public Health completion rates contribute to the issue. ................................................................ 6 The Public Health division had numerous performance measures, but they were scattered across various reporting platforms, hindering a clear understanding of the department's overall objectives. .......................................... 8 Despite generally strong control practices, Public Health's documented fiscal procedures were incomplete. ................................................................................. 10 Prepaid gift card oversight: a persistent high-risk concern. ................................. 11 Data inconsistencies in the enterprise information system exposed the Public Health division to risks. ............................................................................................ 12 Observations ................................................................................................................. 14 Health Services established clear procedures to meet Public Health’s procurement needs and objectives efficiently. ..................................................... 14 Public Health met all grant requirements through an effective management process....................................................................................................................... 15 Planned upgrades will increase Public Health’s physical and electronic accessibility................................................................................................................ 15 3. Conclusion ........................................................................................ 16 4. Management Response .................................................................. 17 Public Health Integrated Audit 24/25-2 December 2024 5. Appendix A: Objective, Scope, and Methodology ........................ 20 Objectives and Scope ................................................................................................... 21 Methodology ................................................................................................................. 22 Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Highlights: Why this audit was performed: A periodic review of administrative practices. What was recommended: We recommended that Public Health: • Complete performance evaluations and set expectations for timely completion. • Create a single source of performance reporting information. • Strengthen fiscal controls and incorporate cash collection practices, workflows, and responsibilities. • Monitor and report information system data errors. Public Health Integrated Audit Our overall objective was to conduct a survey-level assessment of administrative practices at Deschutes County Public Health. The audit objectives were to identify and evaluate key areas of administrative risk. As a division of the Health Services Department, Public Health delivers a broad range of services aimed at protecting and promoting the health and well-being of Deschutes County residents. Public Health demonstrated compliance with procurement policies, grant requirements, and safety meeting frequency standards. However, several areas presented risks to operational efficiency, transparency, and accountability. Key areas for improvement included: • Employee evaluations: 63% of scheduled evaluations were not completed, limiting formal feedback on performance and employee growth. • Performance reporting: Metrics were spread across multiple platforms, hindering public accessibility and reducing the effectiveness of performance reporting for stakeholders. • Fiscal controls: Cash handling procedures were incomplete and did not reflect practice, while gift card accountability was reduced when confirmed solely by the custodian. • Data integrity: Errors within the County’s information system elevated fraud risks and did not reflect an accurate organizational structure. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 1 of 22 1. Introduction The Deschutes County Audit Committee authorized the review of the Health Services Department’s fiscal controls in the Internal Audit Program Work Plan for 2024-2025. Internal audits of administrative controls are routinely performed for identified County departments, elected offices, and functions. The last cash handling audit at the Department was performed in 2018. This is part of an effort to have regular audits done on a recurring cycle. Audit objectives, scope, and methodology can be found in Appendix A. The Office of Internal Audit is expanding the scope of its traditional cash handling audits to include a high-level risk survey of administrative functions in each department or office. We are making this transition because the move towards electronic transactions has shifted risk away from cash handling to information security. We are also including other administrative risks such as performance reporting, procurement, and health and safety. Health Services is the largest department in the County, and due to its extensive scope and complexity, we have decided to conduct the audit in phases to optimize our available resources. The first report of our integrated audit approach will focus on Public Health. Future audit phases will be determined by the Audit Committee during the development of the 2026-2027 Work Plan. The United States Government Accountability Office’s Standards for Internal Control outlines management's responsibilities for risk management. According to the Standards, management is responsible for designing, implementing, and operating an effective internal control system. This includes establishing control activities to mitigate risks, ensuring compliance with relevant laws and regulations, and achieving the organization's objectives efficiently and effectively. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 2 of 22 Background on Deschutes County Public Health Deschutes County Public Health works to protect and improve the health of everyone in the community by preventing and managing diseases, ensuring food and water safety, and promoting overall well-being. They prepare for emergencies, ensure equitable access to health services, and support policies and systems that reduce unhealthy behaviors and healthcare costs. Through community engagement, they foster sustainable changes that enhance health for all. The division was the County service most directly impacted by the challenges of the COVID-19 public health emergency. Public Health experienced significant changes in leadership, staff levels, and organizational structure. As the emergency eased, Public Health has adjusted its practices and structure to better meet community needs and align with available resources. Leadership Hillary Saraceno served as Deputy Director when the pandemic began and worked for the county for 35 years before leaving in March 2020. She was succeeded by Naha Sadr-Azodi, who held the position for 27 months. After Sadr-Azodi's departure in July 2022, the division had an eight-month vacancy until Heather Kaisner was appointed in March 2023. Organization During the pandemic, the division expanded its sections to strategically allocate resources, establishing teams like Data for Action and COVID Response and Recovery to meet the rapidly changing demands. An audit report on case investigation and contact tracing highlighted these efforts, showing that Deschutes County achieved faster response times than other counties, even during higher surge periods. Post-pandemic, Public Health reorganized its operations into four sections of statutorily/contractually required services or grant funded programs: Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 3 of 22 • Prevention and Health Promotion Programs in this section lead work with community partners to promote and ensure practices that improve health and well -being and prevent negative conditions that are harmful to our community both socially and financially. • Clinical and Family Services These programs are focused on providing safety -net public health services to individuals and families seeking reproductive health care, perinatal education and care coordination, nurse home visiting, nutrition education, breastfeeding support, and referrals to needed resources. • Communicable Disease Prevention and Management These programs prevent and control the spread of communicable diseases and mitigate health threats through surveillance, education, investigation, outbreak control and immunizations. They assure access to public health services and conduct community outreach providing immunizations, infection prevention consultation, and communicable disease testing and treatment. • Preparedness Engagement and Environmental Health This section focuses on modernizing public health by improving emergency preparedness, disease monitoring, health equity, community partnerships, and communication. The Environmental Public Health Program plays a key role in protecting the community by ensuring food, air, and water safety through education and inspections, demonstrating a strong commitment to preventing disease and promoting health. Staffing In 2019, staffing in the division was stable, with only two individuals leaving. However, the pandemic introduced unprecedented pressures, leading to a significant increase Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 4 of 22 in staff departures. To meet the demands of its role as the County's public health authority, the division intensified hiring efforts, as illustrated in Figure II. Figure I: Public Health experienced changes in staffing, sections, and deputy directors. Figure II: The staffing patterns experienced in 2019 have not yet returned. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 5 of 22 This turnover persisted as the division adjusted its operations to meet current needs and available funding. It eliminated vacant positions added during the pandemic when funding ended. More recently, some staff left after Public Health discontinued reproductive and sexual health services at its downtown Bend location. Funding Over the last five fiscal years, the division's revenue grew, driven largely by grants. In Fiscal Year 2024, grants made up 44% of its revenue and played a key role in supporting various initiatives to improve public health. However, grants came with risks like uncertain renewal and restricted use. Recent opioid settlement funds, classified as ‘Other Payments’ in Figure III, helped support its operational needs. Figure III: Grant funding was critical to meeting the division’s operational needs.1 1 Other Payments are made up of settlement funds, commercial insurance payments, client service charges, and vital records payments. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 6 of 22 2. Findings and Observations Our overall objective was to conduct a survey-level assessment of administrative practices at Public Health. The audit objectives were to identify and evaluate key areas of administrative risk. For a detailed list of audit objectives, see Appendix A. Public Health managed procurement and grant compliance effectively and planned activities to improve physical and electronic accessibility. However, turnover at all levels over the past five years led to inconsistencies in employee records, and annual employee evaluations were overlooked amid organizational changes. The division could also enhance its performance reporting methods and strengthen documented fiscal procedures. Findings County faces persistent delays in employee evaluations: Public Health completion rates contribute to the issue. In the first eight months of 2024, Public Health completed employee evaluations for only 37 percent of its staff scheduled to receive one. During the same period, the County as a whole completed evaluations for 52 percent of its employees. Figure IV: Public Health’s 63% annual evaluation incompletion rate exceeds the County’s rate. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 7 of 22 County personnel rules and most union agreements require employee evaluations in a timely manner. Instructions for evaluation forms further indicate these are due on or before the due date. Employee evaluations serve as an important tool to enhance employee engagement, satisfaction, and retention. Public Health managers emphasized the importance of regular daily or weekly employee check-ins to improve performance and set clear expectations. They documented these check-ins in internal records but placed less emphasis on documented annual evaluations. While managers recognized the need to record employee performance, they described the annual evaluation forms as outdated and repetitive. The division suspended employee evaluations during the pandemic as the emergency took priority. Now, as the division continues to adjust and restructure, ongoing staff changes have created uncertainty about supervisory organization and annual evaluation expectations. A 2019 audit report highlighted poor evaluation compliance across the County, but the implementation of corrective actions have been slow. In May 2023, County Human Resources started a project to update the County’s evaluation process and tools. This project included a complete redesigning of the evaluation form, exploring integration with the County enterprise information system, and launching a department pilot program. Human Resources management planned to rollout the new evaluation process by May 2025. Health Services executive leadership reported frustration with the delayed rollout, noting the desire to streamline the process but acknowledging the need to wait for countywide changes. Recommendation 1: Public Health management should lead by example by completing annual performance evaluations for all direct reports promptly and setting a division-wide expectation for timely completion of evaluations. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 8 of 22 The Public Health division had numerous performance measures, but they were scattered across various reporting platforms, hindering a clear understanding of the department's overall objectives. Performance measures help guide decisions, drive improvements, and enhance understanding. Poor outcomes often trigger evaluations to identify root causes and solutions. However, inadequate performance measures hinder these processes. Public Health collected some measures to meet funding requirements and others to evaluate the performance of its services. The division used multiple systems to collect, organize, and report these measures. Compared to other public health agencies in Oregon counties, Deschutes County reported its measures more comprehensively, however the division shared performance measures through various channels, including the County’s online performance measure dashboard, the department's annual report, and the quarterly communicable disease report. The Government Finance Officers Association recommended that governments identify, track, and communicate performance measures as a best practice. These measures should be useful, relevant, reliable, adequate, collectible, and consistent. However, Public Health did not fully follow these best practices: • Relevant measures: Relevant measures clearly link to the program outcomes they assess. Each section was anticipated to include outcome-focused performance measures, like patient satisfaction or outreach effectiveness. However, actual outcome measures were limited to suicide rate reductions and family services. • Useful measures: Useful measures support decision- making, improve understanding, and enhance accountability. While the annual report presented measures in a simple format (see Figure V), the dashboard descriptions were overly complex. Additionally, some Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 9 of 22 workload measures were labeled as outcome measures. • Collectible measures: Collectible measures should be readily available without requiring excessive time or effort to gather. Public Health fragmented its measures across multiple platforms, making the information less accessible to stakeholders. Figure V: Public Health’s measures in the Annual Report were easier to understand. Performance measures set expectations that decisions are informed and supported by evidence. None of the division's assessments or plans had been updated since before the pandemic, with the last strategic plan dating back to July 2016. Strategic plans should be living documents, reviewed annually to ensure the division is meeting its goals or adapting to changing priorities. The pandemic disrupted long-term planning, highlighting the need for the division to realign its goals and establish performance measures to guide outcomes. Additionally, Deschutes County Performance Measures Online Dashboard Health Services Fiscal Year 2025 Annual Report Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 10 of 22 transitions in the Deputy Director role, as shown in Figure I, may have further impacted long-term planning. The Deputy Director stated that they were developing a new strategic plan. Recommendation 2: The Public Health division should improve performance reporting by developing a unified, public-facing report that aligns measures with the updated strategic plan goals. Despite generally strong control practices, Public Health's documented fiscal procedures were incomplete. Cash controls practices were in place to prevent theft, but incomplete procedures weakened these controls by relying solely on staff experience and training rather than documented expectations. No fraud was identified. Practices change over time. The absence of detailed written procedures for cash and other payment types can result in poorly planned controls, insufficient supervision, inadequate staff training, and failure to consistently follow established control procedures. Public Health generally followed best practices for controlling incoming revenue. However, there were some inconsistencies between division sections when documenting cash received by mail, and staff used a generic receipt book as a backup when the receipting system was down. Health Services policies guided these procedures, but they lacked detailed steps for funds security, accounts receivable write-offs, and did not fully address segregation of duties. In the Environmental Health unit, segregation of duties posed a significant challenge. Staff often worked across both State and County systems, handling entire transactions independently, which increased the risk of errors or misuse. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 11 of 22 Fraud risk assessments are the first step in designing effective controls, as they identify, evaluate, and address vulnerabilities where fraud could occur. Health Services completed an annual comprehensive risk assessment but overlooked the role of written procedures as a key tool to mitigate fraud risk, minimizing their importance. The assessment also failed to document areas where management chose to accept risk. Recommendation 3: Public Health should strengthen controls over mailed payments and accounts receivable oversight and get receipt books that meet county policy. Recommendation 4: Public Health should revise current procedures to incorporate cash collection practices, workflows, and defined responsibilities, and ensure these procedures are reflected in the annual risk assessment. Prepaid gift card oversight: a persistent high-risk concern. Health Services considers gift cards to be a cash-equivalent asset. Cash assets require strict controls to avoid fraud, waste, and abuse. However, Health Services gift card logs showed several inconsistencies when compared to physical count audit records: • Inventory sequence gaps: Out of 150 $25 gift cards purchased in 2021, 41 gaps were identified in the sequence of recorded card numbers. For instance, the sequence jumped from card 17 of 120 to card 51 of 120, leaving intermediate cards unaccounted for. These sequence gaps appeared between November 2022 and July 2023. 36 cards were still on hand at the time of the audit. • Unrecorded distribution: Two $10 gift cards were missing from physical counts but had no record as being distributed. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 12 of 22 • Inventory inaccuracy: Seventy-two $10 gift cards appeared on the logs in 2024 even though they were distributed in 2023. • Lack of independent verification: In several instances, physical counts were verified solely by the custodian, which undermines the purpose of an impartial third-party review and increases the risk of mismanagement. Gift cards are utilized as client engagement incentives to reduce barriers to accessing services and encourage participation in healthy activities. While staff appear to be following department procedures for purchasing, storing, and issuing gift cards for clients, accounting and auditing processes were not ensuring accountability. Effective control design requires monitoring results to confirm that the system is functioning as intended. A 2018 audit report recommended improvements in gift card controls. Although the department enhanced its procedures, these measures may not be sufficient to effectively reduce the risk of misuse or theft. The department was scheduled to review its gift card procedure in November of 2024. Recommendation 5: Public Health should reinforce accountability expectations and practices for prepaid gift cards either through training, monitoring, or revising procedures. Data inconsistencies in the enterprise information system exposed the Public Health division to risks. The audit found data variances in both the Financial and Human Resources modules of the County enterprise information system. One staff member's financial system access was not revoked after their role changed, and the system inaccurately reflected which managers were responsible for employee supervision. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 13 of 22 Table I: Accurate organizational structure was not reflected in the County’s Human Resources information system. Program Manager Information System Direct Reports Actual Direct Reports Manager A 4 6 Manager B 6 8 Manager C 3 4 Manager D 7 Unknown2 Allowing staff more privileges than required weakens authorization controls and increases the fraud risks. Inaccurate organizational structures in the information system may have also contributed to the low completion rate of employee evaluations. Public Health continued to adapt to best fit the needs of the community. When employee positions or program team structures changed, the division used an employee status change form to notify County Human Resources. Human Resources then updated the information in the enterprise system. Managing change effectively is critical to protecting financial data and business processes during these transitions. The noted data inconsistencies suggested possible isolated errors or larger systemic issues. Health Services management acknowledged that data inconsistencies had been a longstanding problem and had reported these concerns to Human Resources. Although Health Services tracked personnel changes to maintain an accurate organizational chart, they did not record how often they found and reported data inconsistencies to Human Resources. 2 The program was actively undergoing changes during the audit that made it difficult to determine the supervisory reporting structure. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 14 of 22 Recommendation 6: Public Health should establish a tracking system to monitor the extent and frequency of data errors in the enterprise information system. If significant errors are identified, they should be reported to the Human Resources Director for resolution. Observations Health Services established clear procedures to meet Public Health’s procurement needs and objectives efficiently. We reviewed Public Health's procurement practices by examining the selection procedures and documents for its top five vendors. In 2024, Health Services revised its procurement procedures to ensure full compliance with County Code and Oregon law. Management took on the vital role of monitoring internal controls regularly, reflecting their commitment to maintaining a robust internal control environment. Public Health works with a wide range of vendors, from temporary staffing agencies to providers of student and family services in school-based health centers. The division used a variety of procurement methods, including direct appointments via purchase orders and intergovernmental agreements, tailored to meet diverse service needs. Competitive procurement is crucial for local governments as it ensures fairness, transparency, and accountability in the use of public funds. By fostering competition, it enables the government to secure the best value for taxpayers, reducing costs while improving the quality of goods and services. It also helps safeguard against favoritism, fraud, and corruption, providing equal opportunities for all qualified vendors. This process not only promotes ethical standards but also strengthens public trust in government decisions. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 15 of 22 Public Health met all grant requirements through an effective management process. As seen in Figure III, the division relied heavily on grant funding, with more than half of its revenue sourced from grants. We reviewed the grant agreements for the division's top five revenue sources, focusing on the specific requirements outlined in each agreement and the related documentation. Public Health allocated sufficient resources to effectively manage and administer these grants as they became available. Management ensured grant reporting and performance requirements through the use of custom developed software. Financial reports were reported quarterly, and performance reports were generated in compliance with grant agreements. Planned upgrades will increase Public Health’s physical and electronic accessibility. More than one in four Americans live with some form of disability. By failing to make services accessible, there is a risk creating unintended barriers for current and potential public health clients. Public Health complied with Occupational Safety and Health Administration safety meeting rules and had a well-developed safety policy. However, there were no directional touch signs on the first floor of the Courtney Avenue Public Health clinic designed to accommodate individuals with visual impairments. Health Services executive leadership was aware of the issue and planned to improve directional signage in the public areas of the Courtney Avenue building. The Public Health website landing page scored 67 out of 100 for accessibility, citing improvements in contrasting colors, heading order, the ability to freeze moving objects, and weblinks distinguished by something other than color. The website is part of the larger Health Services department and ultimately the County website, designed to be cohesive and Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 16 of 22 consistent for web users. A County website accessibility update is planned with the current vendor that is expected to bring the Public Health site into compliance. The Public Health division should consider client accessibility when working with the Information Technology department on any website updates. 3. Conclusion The survey-level assessment of administrative practices at Public Health highlighted a mix of strengths and areas requiring improvement. While Public Health demonstrated effective grant management, procurement processes, and planned upgrades to enhance accessibility, persistent challenges—such as delays in employee evaluations, fragmented performance measures, incomplete fiscal documentation, and high-risk concerns around gift card oversight—hampered operational efficiency. Furthermore, data inconsistencies in the County enterprise information system exposed the division to avoidable risks. Addressing these issues will be critical to aligning administrative practices with the division’s broader objectives and ensuring sustained effectiveness in delivering public health services to the County. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 17 of 22 4. Management Response Date: December 13, 2024 To: Deschutes County Internal Auditor From: Deschutes County Health Services – Public Health Re: Response to Public Health Integrated Audit 24/25-2 ------------------------------------------------------------------------------------------------------------------------ Thank you for the opportunity to provide a response to the DCHS - Public Health Integrated audit. We appreciate your time in conducting this audit. Public Health strives for excellence and continuous improvement, and we welcome feedback on where we can improve. Below, please find Public Health’s responses to audit recommendations: Recommendation 1: Public Health management should lead by example by completing annual performance evaluations for all direct reports promptly and setting a division-wide expectation for timely completion of evaluations. We agree with this recommendation. Public Health leadership recognizes the importance of improving our performance evaluation processes to align with county policies and support staff engagement, satisfaction, and retention. We are committed to prioritizing annual employee evaluations moving forward and setting supervisory expectations. As noted in the audit, Public Health has been through a tumultuous time responding to the COVID-19 pandemic and navigating several key leadership transitions. Public Health is in a more stable state as of this year, has re-organized into a more sustainable organizational structure and is in a good place to focus on internal improvements. Many managers and supervisors are new to their role. We have recently completed new supervisor training in which we emphasized regular check-ins with employees to maintain engagement, set clear goals, and address any performance issues. We learned from this audit that we will also need to focus on annual documented employee evaluations, which are critical for consistency, transparency, and feedback to employees. HEALTH SERVICES Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 18 of 22 Steps we will take to ensure evaluations are conducted promptly moving forward, include: • Effective immediately, Public Health Management will prioritize completing overdue evaluations for direct reports and will work with supervisors to ensure timely completion of evaluations. • The Public Health Director will share the audit findings during the January Public Health manager and supervisor meeting and will set clear expectations for timely completion of employee evaluations. This will include a requirement that each manager and supervisor have a goal in their annual evaluation that states: Complete all staff Performance Evaluations on time. Managers will also have an action plan under the goal for how they will support their supervisors in assuring staff evaluations are completed. • Managers and supervisors will be provided with training to document and integrate weekly check-ins into the annual evaluation process, demonstrating how regular interactions inform performance reviews. Emphasis will continue to also be placed on regular and documented check-ins as well as annual performance reviews. While we await the rollout of the redesigned evaluation tools from Deschutes County HR, Public Health will utilize the current form and streamline internal processes where possible. To address concerns about outdated forms, we will provide feedback to County Human Resources to advocate for changes that reflect the needs of our division. Recommendation 2: The Public Health division should improve performance reporting by developing a unified, public-facing report that aligns measures with the updated strategic plan goals. We mostly agree with this recommendation. We agree that unified and outcome-focused performance measures are critical for guiding Public Health’s objectives, driving improvements, and ensuring accountability to our stakeholders. However, Public Health tracks and reports numerous performance measures through multiple channels, many of which are required. These include, BOCC metrics dashboard, DCHS Annual Report, Communicable Disease Surveillance reports, Healthy Schools Annual Report, and Public Health Modernization metrics. These performance measures are not on one public facing dashboard, but the majority are all accessible on our website. As stated in the Audit Report, Public Health is undergoing a new strategic planning process to be implemented by July 1, 2025, ensuring it reflects current public health priorities and key process and outcome performance measures. Public Health will also explore the possibility of creating a consolidated public-facing dashboard as recommended if feasible within the constraints of available, curated data and capacity to respond to numerous reporting requirements. Recommendation 3: Public Health should strengthen controls over mailed payments and accounts receivable oversight and get receipt books that meet county policy. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 19 of 22 Recommendation 4: Public Health should revise current procedures to incorporate cash collection practices, workflows, and defined responsibilities, and ensure these procedures are reflected in the annual risk We agree with recommendation 3 & 4. The following will be implemented within the next 6 months: - Update Cash Deposit Policy/Procedure to meet County Policy F-7. This will include workflow of responsibilities, accounts receivable reconciling and posting to Munis, and conducting a quality improvement process specific to Environmental Health. - Create segregation of duties document to support workflow outline in procedures - Purchase and distribute Deschutes County specific receipt books to Vital Records and Environmental Health, the two teams still using receipt books. Recommendation 5: Public Health should reinforce accountability expectations and practices for prepaid gift cards either through training, monitoring, or revising procedures. We agree with this recommendation. DCHS has a detailed procedure for gift card monitoring and auditing. However, this audit revealed that these procedures have not all consistently been enforced. DCHS will include the addition of new reconciliation procedures, including reconciliation with Munis expenses, and enforcement of procedures as an action step in the Strategic Plan. It is estimated that at minimum it will take through July 2025 to implement all changes. This will include, but not be limited to: - Confirm all programs who have purchased gift cards in FY25 via Munis expense reports - HS Business Manager conducts meetings with all programs to identify custodians, purchasers, program log review, program’s current procedures, and review current HS policy/procedures and identify areas programs are currently not adhering to - Present at Manager/Supervisor meetings to review all policy/procedures and outline plan for enforcing gift card purchase approvals, including notifying Business Manager, quarterly log audits by programs, and at minimum bi-yearly on-site gift card audit counts by Business Manager - Business Manager will complete an on-site gift card audit reconciliation in January to identify current. Part of this audit will include reconciling with Munis purchases, to identify gaps in our ability to reconcile gift card logs with Munis - Monthly budget reviews will also be used as a check point with program managers on gift card processes, reminders on audits, etc. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 20 of 22 Recommendation 6: Public Health should establish a tracking system to monitor the extent and frequency of data errors in the enterprise information system. If significant errors are identified, they should be reported to the Human Resources Director for resolution. We agree with the recommendation that data errors and anomalies be reported to Human Resources when identified. We disagree with the recommendation that Health Services create an additional tracking system to monitor errors in data entry occurring in another department. Health Services’ current process is to complete onboarding and offboarding documents for all employees when they arrive, depart or change roles. In addition, we complete employee status and position change forms for the same processes and submit them through a central function in the Director’s Office. Employee Organizational charts are double-checked and updated every two weeks. Finally, monthly budget meetings with managers include review of position control and FTE information and any errors are noted and communicated. DCHS feels this constitutes appropriate due diligence and is not in agreement with adding an additional internal step. 5. Appendix A: Objective, Scope, and Methodology The Office of County Internal Audit was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. Management has responsibility for the system of internal controls, including monitoring internal controls on an ongoing basis to ensure that any weaknesses or non-compliance are promptly identified and corrected. Internal controls provide reasonable but not absolute assurance that an organization’s goals and objectives will be achieved. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 21 of 22 Objectives and Scope Objectives included: 1. Identify the number of active employees and demographic information; vacancy rate (current and historic); current turnover rate; employee evaluation completion. 2. Review of internal controls for cash handling with Public Health as outlined in County Finance policy for cash handling (F-7). Identify areas to improve efficiency and effectiveness. Additionally, review management of any change cash, petty cash, receipts, credit cards, judgements, collections, and billings, as applicable. 3. Identify top five vendors for the division. Verify audit clause, licensing requirements, current insurance record. Review payment methods for vendors. Test against County Policy regarding payments to suppliers (F-15) and Deschutes County Code 2.37. 4. Determine budgetary significance of grants for the agency. Review selected grant agreements. Test against County Policy for grant applications and administration (GA-20). 5. Use an Information security checklist to test information security controls. Check against standards in the Federal Information Security Controls Audit Manual. 6. Review performance reporting from County dashboard and compare measures to prior reporting. Test against Government Finance Officers Association standards. Request back-up materials supporting reported goals and measures. 7. Review safety committee meeting materials for compliance with Occupational Safety and Health Administration rules. Review any safety training records for regularity and compare them to active roster. Complete an Americans with Disabilities Act checklist. Test against County policy for Americans with Disabilities Act notice and grievance policy (GA-13). 8. Be aware of any issues with compliance with federal and “Audit objectives” define the goals of the audit. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor Page 22 of 22 state regulations and requirements, as may be applicable. Scope and timing: The audit occurred in September and October 2024. It included activity from January to August 2024. Scope was limited to a high- level risk survey of business operations for Deschutes County Public Health and did not assess internal controls for the Health Services department overall or programmatic objectives. Methodology Audit procedures included: • Interviewing staff about cash handling, information systems, purchasing, performance measurement, and physical security and safety. • Reviewing documents provided including policies and procedures, performance measures, vendor contracts, and purchasing card documentation. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) Audit procedures are created to address the audit objectives. Public Health Integrated Audit 24/25-2 December 2024 Deschutes County Office of the Internal Auditor The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair - Public member Aaron Kay – Performance Auditor Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Joe Healy - Public member Email: internal.audit@deschutes.org Summer Sears – Public member Web: www.deschutes.org/auditor Kristin Toney - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director Please take a survey on this report by clicking this link: https://forms.office.com/g/WLcbPwr2bt Or use this QR Code: If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.