Organizational Risk Assessment: Austin’s Strategic Audit Plan Corrie Stokes and Patrick Johnson July 2013

Background: Austin City Auditor City Auditor appointed by Council for a 5-year term 26 permanent staff, divided into two units: Audit Services (4 managers, 14 auditors): Conduct planned performance audits and respond to special requests from Council (~30 per year) Integrity Services (1 manager, 3 investigators) Conduct investigations of allegations of fraud, waste, and abuse by City employees or contractors (~60 cases each year) Conduct risk response and other integrity projects as time permits

Background: City of Austin One of America’s fastest growing cities Approximately 12,000 employees in 40 departments: Location of the University of Texas Home to 1.5 million Mexican free-tailed bats Live Music Capital of the World Electric Utility Traditional City Services Water Utility Public Safety Airport Infrastructure Health Convention Center Housing Parks Libraries Trash & Recycling Planning/Development

Prior Risk Assessment & Audit Plan Process Used significant resources to conduct a 3-year comprehensive risk assessment of all City activities Developed an annual audit plan with general audit topic areas and broad objectives

Current Risk Assessment & Audit Plan Process Risk assessment is conducted and audits are identified annually through the Strategic Audit Plan process

Current Risk Assessment & Audit Plan Process

Current Risk Assessment & Audit Plan Process The “environmental scan” is our risk assessment

Environmental Scan: Expectations from outside constituents: Citizen survey

Environmental Scan: Expectations from outside constituents: Peer audit groups

Environmental Scan: Expectations from outside constituents: Current events

Environmental Scan: Expectations from inside the City: City risk managers

Environmental Scan: Expectations from inside the City: budget/planning info

Environmental Scan: Expectations from inside the City: Other City audit groups

Environmental Scan: Identify cross-cutting issues Past audit performance Identify cross-cutting issues Contracts/grants Security Financial controls in non-financial areas Review past recommendations Issues for further study from recent audits

Environmental Scan: risk situation and forecast

Prioritize risk areas: select audits Risk level Coverage Office competencies Identified audits prioritized based on: ≈ 38 audits ≈ 12 audits ≈ 176 audits

Prioritize risk areas: select audits The Annual Service Plan reflects one year of high-risk audits Try to include very specific objectives (rationale) in the Plan

Prioritize risk areas: select audits The Horizon plan has projects that are: high risk but can’t be covered with existing resources expected to be high risk in the near future

Wrap-up Transition from metrics-based risk assessment to an integrated strategic planning approach: Helps us adapt to a rapidly changing audit environment Less labor intensive (more time to audit!) and work is spread throughout the year Able to align our risk assessment with Citywide priorities Includes a longer-term horizon of projects to help us plan for needed competencies Results in many high risk, high impact projects