1. Organizational Risk Assessment: Austin’s Strategic Audit Plan
Corrie Stokes and Patrick Johnson
July 2013

2. Background: Austin City Auditor
City Auditor appointed by Council for a 5-year term
26 permanent staff, divided into two units:
Audit Services (4 managers, 14 auditors):
Conduct planned performance audits and respond to special requests from Council (~30 per year)
Integrity Services (1 manager, 3 investigators)
Conduct investigations of allegations of fraud, waste, and abuse by City employees or contractors (~60 cases each year)
Conduct risk response and other integrity projects as time permits

3. Background: City of Austin
One of America’s fastest growing cities
Approximately 12,000 employees in 40 departments:
Location of the University of Texas
Home to 1.5 million Mexican free-tailed bats
Live Music Capital of the World
Electric Utility
Traditional City Services
Water Utility
Public Safety
Airport
Infrastructure
Health
Convention Center
Housing
Parks
Libraries
Trash & Recycling
Planning/Development

4. Prior Risk Assessment & Audit Plan Process
Used significant resources to conduct a 3-year comprehensive risk assessment of all City activities
Developed an annual audit plan with general audit topic areas and broad objectives

5. Current Risk Assessment & Audit Plan Process
Risk assessment is conducted and audits are identified annually through the Strategic Audit Plan process

6. Current Risk Assessment & Audit Plan Process

7. Current Risk Assessment & Audit Plan Process
The “environmental scan” is our risk assessment

8. Environmental Scan:
Expectations from outside constituents: Citizen survey

9. Environmental Scan:
Expectations from outside constituents: Peer audit groups

10. Environmental Scan:
Expectations from outside constituents: Current events

11. Environmental Scan:
Expectations from inside the City: City risk managers

12. Environmental Scan:
Expectations from inside the City: budget/planning info

13. Environmental Scan:
Expectations from inside the City: Other City audit groups

14. Environmental Scan: Identify cross-cutting issues
Past audit performance
Identify cross-cutting issues
Contracts/grants
Security
Financial controls in non-financial areas
Review past recommendations
Issues for further study from recent audits

15. Environmental Scan: risk situation and forecast

16. Prioritize risk areas: select audits
Risk level
Coverage
Office competencies
Identified audits prioritized based on:
≈ 38 audits
≈ 12 audits
≈ 176 audits

17. Prioritize risk areas: select audits
The Annual Service Plan reflects one year of high-risk audits
Try to include very specific objectives (rationale) in the Plan

18. Prioritize risk areas: select audits
The Horizon plan has projects that are:
high risk but can’t be covered with existing resources
expected to be high risk in the near future

19. Wrap-up
Transition from metrics-based risk assessment to an integrated strategic planning approach:
Helps us adapt to a rapidly changing audit environment
Less labor intensive (more time to audit!) and work is spread throughout the year
Able to align our risk assessment with Citywide priorities
Includes a longer-term horizon of projects to help us plan for needed competencies
Results in many high risk, high impact projects