1. March 9, 2016

2. Keys to an Effective Internal Audit Function 2 1. Enhance accountability 2. Earn and increase taxpayer confidence and respect for government 3. Provide an independent and objective assessment of performance

3. Risk-Related Standards 3 IIA Standard 2210 Government Auditing Standards

4. RISK: a situation involving exposure to danger 4

5. Risk Assessment Process 5 Identifies the threats associated with the area or activity under review; Determines the inherent risk associated with the identified threats; and Assesses whether the existing internal controls will prevent, detect, or correct instances when threats actually occur.

6. Develop Threat List 6 Threat T-1 The number of high-priority (ie. Health and safety or major environmental issues) violations that can be investigated is limited because code enforcement officers spend time investigating low-priority violations. T-2 The response time for high-priority violations is unnecessarily high because code enforcement officers investigate low-priority violations before high-priority violations. T-3 Code enforcement officers focus on completing tasks (such as inspections) quickly, rather than achieving compliance. T-4 CED's staffing model and processes are inefficient, resulting in a high cost per case. T-5 Some code enforcement officers give violators excessively long 'compliance periods' before issuing fines or penalties, reducing the compliance rate and lengthening the amount of time needed to achieve compliance. T-6 Code enforcement officers cite low-priority violations that are 'pet peeves' rather than focusing on higher-priority violations. T-7 Code enforcement officers are inconsistent in their use of administrative citations and civil penalties, which reduces the effectiveness of enforcement efforts and may create an equity issue.

7. Identify Actual and Potential Controls 7 C-1 CED assigns a priority to each violation type, with a policy of inspecting higher-priority (ie., health and safety or major environmental issues) violations more quickly. C-2 PTS assigns faster inspection due dates for high-priority violations than low-priority violations. C-3 Supervisors regularly review staff work to ensure that staff are appropriately prioritizing and responding to violation complaints. C-4 CED has performance metrics that measure response times and compliance rates by type of violation. C-5 CED has performance metrics that measure the efficiency of operations (cost per violation, etc.) C-6 PTS automatically generates reports that supervisors and managers can use to monitor inspection on-time rates, compliance rates, and efficiency.

8. Risk Matrix 8

9. 9

10. Vulnerability Assessment 10 ThreatControls Threat's Inherent Risk Internal Control Rating Vulnerability Assessment T-1 The number of high-priority (ie. Health and safety or major environmental issues) violations that can be investigated is limited because code enforcement officers spend time investigating low-priority violations. 1-4, 6HighWeakHigh T-2 The response time for high-priority violations is unnecessarily high because code enforcement officers investigate low-priority violations before high-priority violations. 1-4, 6HighWeakHigh T-3 Code enforcement officers focus on completing tasks (such as inspections) quickly, rather than achieving compliance. 3-4, 6, 9HighWeakHigh T-4 CED's staffing model and processes are inefficient, resulting in a high cost per case. 5HighModerateModerate to High T-5 Some code enforcement officers give violators excessively long 'compliance periods' before issuing fines or penalties, reducing the compliance rate and lengthening the amount of time needed to achieve compliance. 3-4, 7, 9HighWeakHigh

11. Contact Information 11