Loading...
HomeMy WebLinkAboutF0115 PH Follow Up Report (PUBLISHED 11-4-25)To request this information in an alternate format, please call (541) 330- 4674 or send email to internal.audit@Deschutes.org Public Health Integrated Audit Follow-up: Strong commitment to employee performance reporting, exploring department reporting improvements November 2025 Our 2024 audit of Public Health found compliance with procurement policies, grant requirements, and safety meeting standards. However, several areas presented risks to operational efficiency, transparency, and accountability. Nine months later, the Department emphasized the importance of annual employee evaluations with supervisors but were still working to update cash control procedures and performance reporting. Staff committed to reporting Human Resources data errors that impacted operations but not to tracking and reporting data about errors. Deschutes County Office of the Internal Auditor Page 1 of 4 Audit Follow-up Report: November 2025 Public Health Integrated Audit Recommendation Status Key: Initial finding: Employee evaluations serve as an important tool to enhance employee engagement, satisfaction, and retention. County personnel rules and most union agreements require employee evaluations in a timely manner. Though the County as a whole faced persistent delays in completing employee evaluations, the Public Health completion rate was lower. Recommendation: Public Health management should lead by example by completing annual performance evaluations for all direct reports promptly and setting a division-wide expectation for timely completion of evaluations. Update: The Public Health Director shared the audit results and set clear expectations for evaluation completion at a January 2025 management meeting. A goal related to annual performance evaluation completion has been added to each supervisor’s own evaluation. Initial finding: Performance measures help guide decisions, drive improvements, and enhance understanding. Outcomes often trigger evaluations to identify root causes and solutions. The 1 Resolved 4 In Process 1 Accept Risk Management addressed risk. Auditors will no longer monitor. progress. Auditors will continue to monitor. not implementing the recommendation. Clear expectations for completing employee performance evaluations in place. performance reporting. Deschutes County Office of the Internal Auditor Page 2 of 4 Audit Follow-up Report: November 2025 Public Health Integrated Audit Public Health division had numerous performance measures, but they were scattered across various reporting platforms, hindering a clear understanding of the department's overall objectives. Recommendation: The Public Health division should improve performance reporting by developing a unified, public-facing report that aligns measures with the updated strategic plan goals. Update: Public Health is continuing to explore the best approach to implement this recommendation, including the possibility of creating a consolidated public-facing dashboard as recommended within the constraints of available, curated data and capacity to respond to numerous reporting requirements. Initial finding: Cash controls practices were in place to prevent theft, but incomplete procedures weakened these controls by relying solely on staff experience and training rather than documented expectations. There were some inconsistencies among Public Health sections when documenting cash received by mail, and staff used a generic receipt book as a backup when the receipting system was down. Recommendation: Public Health should strengthen controls over mailed payments and accounts receivable oversight and get receipt books that meet county policy. Update: Staff stated that all Public Health sections were using Health Services receipt books that meet county policy. The department will update its cash control procedure, including receiving by mail, by February 2026. Plans to update cash control procedures. Deschutes County Office of the Internal Auditor Page 3 of 4 Audit Follow-up Report: November 2025 Public Health Integrated Audit Initial finding: Health Services policies guided revenue collection procedures, but they lacked detailed steps for funds security, accounts receivable write-offs, and did not fully address segregation of duties. Fraud risk assessments are the first step in designing effective controls, as they identify, evaluate, and address vulnerabilities where fraud could occur. Health Services completed an annual comprehensive risk assessment but overlooked the role of written procedures as a key tool to mitigate fraud risk, minimizing their importance. Recommendation: Public Health should revise current procedures to incorporate cash collection practices, workflows, and defined responsibilities, and ensure these procedures are reflected in the annual risk assessment. Update: Staff said they planned to update revenue collection procedures by February 2026. Initial finding: Health Services considers gift cards to be a cash-equivalent asset. Cash assets require strict controls to avoid fraud, waste, and abuse. However, Health Services gift card logs showed several inconsistencies when compared to physical count audit records. Recommendation: Public Health should reinforce accountability expectations and practices for prepaid gift cards either through training, monitoring, or revising procedures. Update: Staff said that they audited gift cards in January and June of 2025. Staff reported that the department was undergoing an evaluation of practices against procedures, with planned updates to procedures expected by June 2026. Deschutes County Office of the Internal Auditor Page 4 of 4 Audit Follow-up Report: November 2025 Public Health Integrated Audit Initial finding: Data inconsistencies in the enterprise information system exposed the Public Health division to risks. One staff member's financial system access was not revoked after their role changed, and the system inaccurately reflected which managers were responsible for employee supervision. Allowing staff more privileges than required weakens authorization controls and increases fraud risks. Inaccurate organizational structures in the information system may have also contributed to the low completion rate of employee evaluations. Recommendation: Public Health should establish a tracking system to monitor the extent and frequency of data errors in the enterprise information system. If significant errors are identified, they should be reported to the Human Resources Director for resolution. Update: Public Health agreed with reporting data errors to Human Resources and said that they did so on a regular basis. However, they declined to implement a recommendation to track and monitor data entry errors occurring in another department. Next Steps: We will continue to report on the status of in-process audit recommendations in our Global Follow-up Report at the end of each calendar year. Will report but not track or monitor Human Resources data errors. Deschutes County Office of the Internal Auditor Audit Follow-up Report: Public Health Integrated Audit The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Jodi Burch – Public member Email: internal.audit@deschutes.org Joe Healy – Public member Steve Dennison, County Clerk If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.