HomeMy WebLinkAbout2324-17 Follow-up Continuity Of Operations Plans (Final 4-15-24)Continuity of Operations Plans follow-up #23/24-17 April 2024
Follow-up Report
County continuity of operations
plans – initial assessment
(Internal audit report #22/23-6 issued June 2023)
The Office of County Internal Audit:
Elizabeth Pape, CIA, CFE – County Internal Auditor
Aaron Kay – Performance Auditor
Audit committee:
Daryl Parrish, Chair - Public member
Jodi Burch – Public member
Joe Healy - Public member
Kristin Toney - Public member
Summer Sears – Public member
Stan Turel - Public member
Patti Adair, County Commissioner
Charles Fadeley, Justice of the Peace
Lee Randall, Facilities Director
To request this information in an alternate format, please call (541) 330-4674
or send email to internal.audit@Deschutes.org
Recommendations
6
Continuity of Operations Plans follow-up #23/24-17 April 2024
Table of Contents:
1. Introduction ....................................................................................... 1
Background on the Original Audit .................................................................................. 1
2. Follow-up Results .............................................................................. 2
3. Appendix A: Updated workplan (status as of April 2024) ............ 3
4. Appendix B: Objective, Scope, and Methodology .......................... 4
Objective and Scope ........................................................................................................ 4
Methodology ..................................................................................................................... 5
Continuity of Operations Plans follow-up #23/24-17 April 2024
Deschutes County Office of the Internal Auditor Page 1 of 5
1. Introduction
Audit Authority
The Deschutes County Audit Committee has suggested that
follow-ups occur within nine months of the report. The Audit
Committee would like to make sure departments satisfactorily
address recommendations.
Background on the Original Audit
The focus of the audit was to provide an initial assessment of the
County’s continuity of operations (COOP) plans to meet
acceptable levels of service delivery and essential functions
following a disruption when compared to industry best practices.
The assessment score of 4.9 out of ten indicated moderate
progress towards creating a comprehensive COOP plan. The
County has taken significant steps to establish COOP plans,
identify essential functions, and consider critical operational
capacities. Planning efforts were hindered because of the use of
the State-contracted software system to guide individual
office/department COOP development. The system contained
conflicting directions and limited user options, so several aspects
of planning were absent or insufficiently developed. The State is
transitioning to a new software system provider, but the details of
the system capabilities are unknown.
During the COVID-19 pandemic and its subsequent disruptions
the County successfully applied some planned COOP strategies,
such as remote work, yielding a more agile work environment.
However, County COOP plans were not formally activated as
guidance to navigate the pandemic largely due to the absence of
pandemics in the activation scenarios and lack of overall staff
awareness.
Continuous improvement of the County’s COOP plans was
hampered by the pandemic as it impacted regular evaluations
and planned exercises. Assessments found a consistent need for
additional COOP training to effectively increase staff awareness
and understanding of the plans.
Continuity of Operations Plans follow-up #23/24-17 April 2024
Deschutes County Office of the Internal Auditor Page 2 of 5
2. Follow-up Results
The follow-up included six outstanding recommendations agreed
to by County Administration and the Deschutes County Sheriff’s
Office. Figure I provides an overview of the resolution status of
the recommendations.
The details of the follow-up are included at
the end of the report in Appendix A. In
interpreting the status, Internal Audit may
sometimes raise or lower the status
provided by the department based on
communication received from the
department.
With this follow-up, none of the
outstanding recommendations have been
fully addressed. While this outcome was
not entirely unexpected, given the timing
and coordination required to evaluate the
new State-procured continuity software
platform and reengage in planning efforts,
it remains concerning. Without
comprehensive continuity of operations
plans in place, the County is susceptible to
heightened risks, potentially leading to
delays or suspensions of essential services
during disruptive events.
Figure I –
How were
recommendations
implemented?
Continuity of Operations Plans follow-up #23/24-17 April 2024
Deschutes County Office of the Internal Auditor Page 3 of 5
3. Appendix A: Updated workplan (status as of April 2024)
Recommendation Status Resolution
Goal
Updated Comment
It is recommended
the County
determine whether
the capabilities of
the new COOP
software system
meet their
requirements or
explore other
viable alternatives.
Underway September
2024
Staff evaluated the new State-procured
software and along with a few other
jurisdictions determined it was not the
ideal option for implementation. Staff
have been in discussions with technical
staff (IT) to develop a product in-house
with current resources. Due to limited
staff time and competing projects, the
design process is just now underway.
It is recommended
the County direct
staff to complete
comprehensive
COOP planning
documentation
with the support of
DCSO-ESU.
Planned December
2025
Dependent on the outcomes from re-
establishing regular COOP planning
meetings.
It is recommended
the County re-
establish regular
COOP planning
meetings to review
and revise COOP
plans.
Planned December
2024
DCSO Emergency Management and
County Administration have a planned
meeting to identify roles, responsibilities,
capacity, and next steps for a COOP
transition.
It is recommended
the County review
and update its
COOP activation
scenarios to
include pandemics
and other potential
crises.
Planned December
2025
No new update.
Previous comments were received from
County Administration and Deschutes
County Sheriff’s Office:
Administration will defer to the expertise
of the DCSO Emergency Services on
activation scenarios included in the COOP
plan. Based on preliminary discussions,
Continuity of Operations Plans follow-up #23/24-17 April 2024
Deschutes County Office of the Internal Auditor Page 4 of 5
4. Appendix B: Objective, Scope, and Methodology
Objective and Scope
Objective:
The objective was to follow up on recommendations from the
original audit.
Recommendation Status Resolution
Goal
Updated Comment
this may include broader language such
as “any event that impacts people,
infrastructure locations or vital records.”
DCSO Emergency Management, in
cooperation with the County offices and
departments, is willing to facilitate, plan
and coordinate regular scenarios, to
include those of a pandemic nature, in
order to vet the current processes
included in the COOP.
It is recommended
the County
establish a COOP
training program
for all personnel.
Planned December
2025
This will be secondary to establishing the
updated COOP program.
It is recommended
the County
conduct regular
COOP exercises
and make
necessary
improvements
identified as
weaknesses.
Planned December
2025
COOP Exercises will be planned within a
plan update/exercise schedule.
“Audit objectives”
define the goals of
the audit.
Continuity of Operations Plans follow-up #23/24-17 April 2024
Deschutes County Office of the Internal Auditor Page 5 of 5
Scope and timing:
The follow-up included six recommendations from the internal
audit report for County continuity of operations plans – initial
assessment #22/23-6 issued in June 2023. The original internal
audit report should be referenced for the full text of the
recommendations and associated discussion. The follow-up
reflects the status as of April 2024.
Methodology
The follow-up report was developed from information provided
by Sgt. Nathan Garibay, Deschutes County Sheriff’s Office
Emergency Manager. Follow-ups are, by nature, subjective. In
determining the status of recommendations that were followed
up, we relied on assertions provided by those involved and did
not attempt to independently verify those assertions. The
updates received were included in Appendix A.
Since no substantive audit work was performed, Government
Auditing Standards issued by the Comptroller General of the
United States were not followed.
If you would like to receive future reports and information from Internal Audit or
know someone else who might like to receive our updates, sign up at
http://bit.ly/DCInternalAudit.