supervisor campos: good morning, everyone, and welcome to the thursday, july 28, a meeting of the government and -- government

audit and oversight committee. we are joined today by committee vice chairman, mike farrell and david chiu. the clerk of the committee is andrea laws va ausberry. adam clerk, the we have any announcements? >> yes, we do. please turn off all ringer on cell phones. if you wish to speak during public comment, please turn in your speaker card. items acted upon today will appear on august 2 board of supervisors agenda unless otherwise stated. >> thank you. >> item number one, a hearing on implementation of audit recommendation by the city services auditor. supervisor campos: this is an item that i introduced, and the purpose of this item is we recognize that many audits are

conducted by the comptroller's office and other agencies within the city and county of san francisco, but there are times when there is no follow-up in terms of whether or not some other recommendations of these audits and reviews have been implemented. we will hear from the status on the implementation of the recommendations that have been made. with that, i will turn it over to the audit director for the comptroller's office. >> good morning. board of supervisors, today we're going to talk about otter recommendations that have been implemented, what the process is, and how we go through that process.

the importance of audit follow- up is one of the benefits is not just on that finding, but the recommendations, and those recommendations been implemented. we do take seriously once we have done the audit work and issue a draft request and request an ex bonds -- response by the department, which initially goes into the audit report and republish that. six months later, we request where the department is in the follow-up process. for one year after that we do another follow-up, and then we do a third notice for a two-year follow-up if the items are still open. in the audit follow-up process, while we do send out requests to understand where the departments are, once received information we actually analyze the documentation to determine if that information or the prop frigid process their

implementing is sufficient. once we determined it is sufficient, then we deemed that recommendation our audit-finding ". there are times in the year that we actually go out and do additional taxation work to determine the implementation has been -- recommendation has been implemented and the fallout is in working place. as you noted with the agenda on our sheet listing each of the audit that we're following up on, we have a follow-up status column, one that is active, open, and closed. active means we have sent out notifications requesting a response and have not received a response from the department. open means we have received a response, and some of the items remain open. closed means they have closed

and met expectations. for this time we have six departments -- human rights department, public health, laguna hospital, meant a transportation agency, the police department, and airport. we have a total of 10 closed on a report. a total of 10 open audit reports into active reports for a total of 22 audit. subsequently, after the agenda was published for this meeting, we had additional work that came in. we looked at the work and were able to close the additional audits that are noted here on our sheets. i will quickly go over the closed audit summary. for the arts commission, under the african american arts and culture complex, there were systemic issues such as

expenditures, reimbursements paid on eligible expenses. there was not clarity about the eligibility of expenses for certain types of the agreement. expenditures occurring before budget approval by the arts commission and inadequate controls over pay roll. additionally we found inadequate oversight over compliance with regards to required issuance and timely and accurate reporting to the arts commission. for the mta audit return, that is managed by the mta and the police department. the book cover role in the audit return contract. we found sufficient implementation without inclusion of the contract notification. clerical errors resulting in undercharging fees, non- enforcement of contract requirements with regard to contract oversight. for the police department we

asked the odder return program. what we found overall were inaccurate records, and for audit returned we found the police database showed 8000 cars being held went on a return showed 752 cars being held. we also found insufficient tracking of cash fees as part of the forfeiture program. inconsistent application waivers. the airport, there were six of its of airline concessions. generally what we find our that there is non enforcement of requirement of tenants for certain reports that must be submitted, such as accurate activity reports and cpi reports that required within 90 -- 90 days of the lease period. we also find out there are a lot of under and over payments that have not been resolved.

so i shared earlier, there are 10 open audits, and within hrc lagunda hospital, san francisco's center garage, air canada, a concession audit of smart cars, the shuttle bus company, the airport has an on the open as it relates to improving key computer controls of its accounting system, and concession audit for bank of america and cash handling audit for security access office. >> i will talk about those audits a little bit later. we have to act on it, and that is with the police department -- two active audits with the police department. this is in relation to overtime pay.

for the human rights commission, they have two outstanding on their recommendations for the total of eight that they have. one is in process, and in one that nature see has decided not to implement due to the lack of resources. -- the hrc has decided not to implement due to lack of resources. we would like the department to find a way from a statistical stamping methodology or risk ratings methodology to determine how they actually can go out and look at the various contracts to ensure that we do have proper controls in place as it relates to subcontracting. we fully recognize it is not feasible to do all 100% sample. for the hospital, there are five outstanding recommendations that are in process.

we found an audit that over a six-year time, they spent $432,000 more than the fund received. therefore we believe this recommendation will protect the long-term solvency of the fund. we are asking them to be considered -- reconsider implementing some sort of process to ensure the fund is reviewed on a quarterly basis at least. with regards to the art commission, there are two outstanding recommendations that are partially implemented. they are regarding contract issues. again, the department does have responsibility for oversight of the organization and to ensure that contracts are being properly utilized and that the contents of that contract are being abided by pearso.

for mta on the stand francisco's center garage, there are two remaining outstanding recommendations that are in process. in they are working on these implementations, and they are diligently working to resolve the issue that relates to the tracking vehicles parked overnight. with the police department, we will cleat -- quickly go through these slights. -- slides. for the pay roll audit, there are 16 remaining outstanding recommendations. as we know, there are four in process. there are five that the police department has decided not to implement. they have two that are still

considered outstanding. basically, we have not received any additional formal responses on the majority of their findings. they are here today, and they will be able to speak to where they are moving forward as it relates to pay roll and premium pay. >> can you provide information on when the audit was conducted and where there has been no response? how long that has been? -- supervisor campos: can you provide information on and audit was conducted and where there has been no response? how long has that been. >> good morning, supervisors. mark tipton. the premium overtime pay was completed on august 18, 2010. at that time, as with all of our audit reports, we have the

police department's response as part of the report. six months thereafter, in early 2011, we sent another response. we did request for response. we did not get it then. very soon, next month, it will be the one-year anniversary of this report. that would be our respective schedules follow-up. -- that would be our second scheduled follow-up. supervisor campos: there was no response? >> is no response. and >> they are having a change in leadership. it is clear in speaking with one of the captains that they are working on moving forward in these areas and will provide a written response.

there are seven recommendations that need to be implemented, and there are simple resolutions. simply that the department needs to issue bulletins, update policies and procedures for existing procedures that they have in place. that would at least take care of seven of the 28. if we look at the property controls unit audit, there are 12 recommendations that are outstanding of the 19. eight are in process, and four

have not yet been implemented. we have not received a formal response, and we did request are six-month response in february. we did speak with the department, and their goal is to provide us with an adequate response in the upcoming week. supervisor campos: what was the date of that audit report? was that may? >> may 20, 2010. supervisor campos: over a year? >> yes. as it relates to the airport for the audit of air canada, there is one outstanding recommendation that is in process, and currently we have uncovered $24,000 in underpaid fees and interest during the two-year audit. we are asking that the department research their records and determine if any additional under reporting has

occurred with regards to landing weight. as it relates to the audit of smart cart, there are two outstanding recommendations. again, our expectation is that the airport will look at those and continuing -- continue to look at those items. they are looking into it and plan on doing something. that would be satisfactory. the sfo shuttle bus company contract stated that it need to be improved significantly. there are eight outstanding recommendations. one is in process. the department started out to implement five. for call for amendments to the contract that expires in december. -- four call for amendments to the contract that expires in december.

while we know they will not implement this issue, we ask that they take some of these things into consideration as they make the new contract. we also have a landing on it that we did. we look dickie computer controls for the accounting system. there are two remaining outstanding recommendations. they are both in progress. we are confident they will implement a corporate procedures. the final -- a corporate procedures. there are two outstanding recommendations for bank of america. but asked for changes to the lease, which is scheduled to expire august 16, 2011. cash handling audit of security office -- access office.

there are three outstanding recommendations. the airport has decided not to fully implement two of them due to staffing constraints. one of them is inadequate activation of duty. while again we understand we have limited resources, we are asking that the airport confined other mitigating ways to assist in this area. thank you very much, sir. supervisor campos: thank you. if i may, i just have a general question about the process. once you complete an audit, how is the process supposed to work in terms of a response from a department? >> once we complete an audit and we issue the draft audit, we are requesting a response.

once we have issued the draft audit and we're all in agreement or we agree to disagree that this is what is going into the report. at the time of receiving that, generally the department has two weeks to respond to the audit. once we receive the audit, we then publish it with their initial response. six months after the initial response, we issue a memo that request an update of the recommendation of the implementation of the recommendation. after six months, another six months goes by, one year later, if there are outstanding recommendations, we then again ask a year later for an update. it continues up to two years. in that process, depending on the associated risk of a particular audit, the findings, we then determine do we need to go back out into the field and

do additional testing of the work that should have been completed by the department as they reported on -- in their responses to the recommendation and how they will implement those. some of the recommendations are purely administrative and we do not necessarily say can we see the manual, can we see the bulletin? we do ask for those types supporting documentation. supervisor campos: supervisor farrell, the you have a question? supervisor farrell: this is obviously have to -- after working with the department. there are no surprises and there, correct? >> correct. we work very diligently to make sure they are not surprised. we work with them throughout the entire process and hold many conferences with the individuals we are working with in terms of

staff, and eventually, depending on what it is, our expectation is whoever the point of contact is, they are actually convey the message to the appropriate management level, and at the conclusion of the audit, once we have all of the findings documented and ready to go, then we will hold an exit conference. at that time our expectation is the appropriate level of management is involved in that. i intersupervisor farrell: i understand the six-month process you articulate it, but bringing back to the police department, did i hear you right saying it has been one year and have not heard a response from them? >> correct. we will send out the first noticed in february. we did send out a notice. -- we will send out the first noticed, for instance, in february.

always those notices are sent directly to the appointing authority, the director of the department head, with the cc to the point of contact within the organization. supervisor farrell: obviously with the police department this year we have had a new chief who is doing a great job here yet at the same point in time, i want to ask what is the norm? that strikes me to be a year of non responsiveness. that strikes me to be unacceptable, but what is your experience with other departments? there is a lot of records, but how do you typically handle that? i want to understand whether this is something to be really flag or something that in your estimation is not malicious /understandable. >> as it relates to the transition in the police department, i think it is