You have just been appointed the Finance Director or CFO of a local government!  First of all, congratulations!  After a short celebration, reality starts to set in.  Now what?  How do I hold together the finance department staff; maintain the government’s internal controls; meet the deadlines for payroll, payables, financial reporting; keep the CEO and board/council happy; and make it all look easy? 

Your Role As CFO
First, you must recognize the most important elements of your new job: 

1. Manage the finance department
2. Provide financial information to others
3. Participate with senior management as financial expert

 
Manage the finance department - Managing the finance department entails making sure that your employees are working productively.  If they are not productive and effective, you cannot succeed.  They do the important financial work every day.  You will need to help them set priorities, meet deadlines, clear roadblocks and stay motivated.  You will need to make sure that important deadlines are met for payroll, payables, billing and financial reporting.  Determine the appropriate frequency of meetings with individuals and teams in the finance department.  You will need to make sure that communication with your staff is thorough, frequent, appropriate and timely.

Provide financial information to others - Your department (and therefore you) plays the key role in providing financial information to senior management, the board/council and management of other departments.  And not just providing financial reports but helping them to understand, interpret and use financial information.  Your role also calls for you to understand the financial information needs of your “customer” departments well enough to anticipate the financial information that is available to help them manage their department and budget and help them access/understand it.  It also includes advising others in the organization about their role in internal controls and protecting the government’s assets from loss or fraud.
​
Participate with senior management as financial expert - Most every decision that is made by senior management and the board/council has financial ramifications.  Your job is to help them understand those ramifications.  This is done by participating in the decision-making process and quantifying the related costs/revenues.  It includes performing multi-year financial projections, what-if analysis and risk analysis as needed to show whether or not current decisions can be afforded in the future.
 
The First 30 Days
Since you have taken over as CFO recently, the rest of the organization is wondering whether the timeliness or quality of services from the Finance Department will suffer or improve.  It is important for you to show them that things are under control.  But you will have a small grace period in the eyes of your customer departments that you should use in the most productive manner.  Therefore, you should make a plan for what you will do during the first 30 days.  Don’t jump into fighting fires immediately.  Take this grace period to consciously determine what are the most important things that need to be done.  You don’t need to resolve problems in the first 30 days, but you should identify what the main issues are. 

For example, your 30-day plan may include something like the following:

Week 1 – Meet with management and board/council
Meet with each member of senior management team and each member of board/council.  Ask them what their priorities and concerns are.  What is their experience working with the Finance Department in the past?  How can you best be of assistance to them?  Don’t promise anything yet, just hear what they have to say.

Week 2 – Meet with Finance Department employees
Meet with each member of the Finance Department.  Ask them what their career goals are and what concerns they have.  How can you best help them do their job effectively?

Week 3 – Review internal controls
Review the main internal controls for the key business processes—payroll, billing/collections, purchasing/payables, budgeting, general ledger/financial reporting, capital assets, treasury.  If your government hasn’t documented these controls yet, ask your auditors for a copy of their write ups.  Sit with the employee experts in your department and walk through typical transactions to understand how they are authorized, posted, reviewed and documented.  You won’t become an expert on controls over each process in such a short time, but focus on this to identify obvious problems.  For example, you may identify individuals who have access to both an asset and the related accounting records.  Such inadequate segregation of duties screams for attention because they allow an individual to steal an asset and hide the theft by manipulating the accounting records.  Examples:

• An analyst in an operating department prepares and sends a request for payment on government letterhead to a citizen or vendor.  Since the analyst can tell the citizen or vendor where to send the payment, he/she has access to assets as well as making the initial accounting record (the invoice).
• A public works clerk collects cash and checks for various permits and fees.  He reconciles collections to the financial system at the end of each day.  He has access to assets (cash) and the initial accounting record (input into the financial system).
• A maintenance worker uses a purchasing card to buy supplies at Home Depot.  She has access to assets (the P-card purchasing power) and the initial accounting record (the store receipt).  She could steal the asset, submit a different receipt, etc.

Again, you don’t necessarily need to resolve internal control issues as soon as you find them.  But you need to know where the weaknesses are so you can prioritize what you will focus on.  If you can’t fully segregate access to assets from access to the related accounting records, then at least put into place a periodic review of vulnerable transactions to identify a theft if it did occur. 

Week 4 – Review department deliverables and deadlines
Become familiar with the primary reports and deliverables produced by the Finance Department, and their deadlines.  This includes payroll, payable, grantor reports, monthly/quarterly budget vs. actual financial reports, budgets, mid-year reports, financial projections, audit, etc.  How well are these reports produced, and are they timely?  Are the staff responsible for preparing them knowledgeable and cognizant of the deadlines?

Establish Your Priorities
In the first 30 days you have gained a preliminary understanding of your government’s financial needs and goals.  Now what do you do with this knowledge?  You set your priorities.  If you don’t set these priorities, you will spend your time fighting fires—in other words, you will spend your time working on other people’s priorities.  There are plenty of CFO’s working very hard just holding their departments together.  A good CFO, though, makes time to plan and implement improvements to operations and controls.  This reduces future fires she/he will need to resolve.

You will be successful if you see what needs to be done, decide how to improve it, and then do it.  For example, if your government doesn’t have a good multi-year financial plan, prioritize making one.  If it doesn’t have good internal controls over cash collections, prioritize making improvements in the process and training.  If financial policies and procedures aren’t documented, prioritize that. 

For each issue you decide to prioritize, make a project plan that details the steps that need to be taken to further understand the problem and remedy it, who will be responsible for each step and the date by which each step will be accomplished.  Attached is an example of a project plan for developing a written grants management policy.

Once you have established your priorities, communicate them to the CEO, Finance Department staff, and any others in the organization that will need to be involved.

If you follow this 30-day plan, you will be well on the way to a successful role as CFO of your government. 

 

 
 
Example Project Plan:  Develop a Written Grants Management Procedure
  
Task                                                                Responsible       Date

1. Research Uniform guidance and best practices.

Obtain sample policies and procedures of other
governments                                                     J. Nunez     11/1/2024
 
2. Interview employees in finance and operating
departments that have grants management duties
to understand current practices, historical
concerns, information needs and documentation
available                                                          J. Nunez  11/15/2024     
3. Draft grants management procedures            J. Nunez     12/15/2024

4. Review draft policies and procedures with other
departments and senior management                J. Nunez       1/15/2025

5. Revise policies and procedures. Issue in
final form                                                        J. Nunez       1/31/2025

6. Incorporate new procedures into Accounting
Manual                                                            R. Chang     2/15/2025

7. Train finance personnel on new procedures     T. Williams   2/15/2025

8. Develop training for other departments           P. Proude     2/15/2025

9. Schedule and deliver training for other
departments                                                    P. Proude     2/28/2025

Having a written code of ethics is an important part of an effective system of internal control.  A code of ethics guides how you want employees to behave in situations that may be morally complex.  A code of ethics should comprehend the following:

• Personal responsibility;
• Compliance with the law;
• Relation with the public;
• Limitation in accepting gifts, rewards, hospitality and discounts;
• Conduct in money matters;
• Confidentiality and use of official information;
• Use of official property and services;
• Private purchase of government property by employees; and
• Work environment.

Related to ethics, below we review how a code of ethics fits into the COSO internal control framework, what California State law requires, and the responsibilities of the governing body and the Chief Executive Officer.  We also provide a sample code of ethics that can be used as a starting point to tailor a code of ethics for your government. 
 
COSO
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) develops guidelines for organizations to design and implement systems of internal control over financial reporting and to assess their effectiveness.  In 1992 (re-released in 2013), COSO published Internal Control - Integrated Framework, commonly referenced as the “COSO Framework”.  The first and most important element of the COSO control framework is the “control environment”.  (The other elements of COSO are not contemplated by this discussion).
 
The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The control environment has a pervasive impact on the overall system of internal control.  The control environment comprises the:

• Integrity and ethical values of the organization;
• Parameters enabling the governing body to carry out its governance oversight responsibilities;
• Organizational struc­ture and assignment of authority and responsibility;
• Process for attracting, develop­ing, and retaining competent individuals; and
• Rigor around performance measures, incentives, and rewards to drive accountability for performance.

Tone at the top is the most important element of the control environment.  The governing body and senior management establish the “tone at the top” regarding the importance of inter­nal control including expected standards of conduct. “Tone at the top” refers to an organization’s leadership and their commitment to being honest and ethical.  Tone at the top sets forth the organization’s control environment and values.  Management reinforces ethical and behavioral expecta­tions at the various levels of the organization.
 
California State Law
The State of California requires most public officials to file annual conflict of interest statements with the Fair Political Practices Commission. Public officials so required include members of planning commissions, members of the board of supervisors, district attorneys, county counsels, county treasurers, and chief administrative officers of counties; mayors, city managers, city attorneys, city treasurers, chief administrative officers and members of city councils of cities; public officials who manage public investments; and candidates for any of these offices.  The conflict of interest statements require filers to list the companies they own or have invested in, real estate owned, and gifts received.  [Note: conflict of interest statements required by State law do not qualify as a code of ethics because conflict of interest is only one part of an ethical environment.]
 
Governing Body
Tone at the top is ultimately the responsibility of the governing body.  The governing body must ensure that ethical objectives are built into the actions and the strategy of the government, and that they are not merely a statement of good intentions.  The governing body is responsible for hiring the CEO (City Manager, County Executive, General Manager, Executive Director), approving strategy, monitoring execution of the plan, setting risk appetite, and exercising appropriate oversight regarding risk mitigations.  Although each of these responsibilities impact tone at the top, no single decision drives tone at the top more than the selection of the CEO. That selection focuses on competence, character, and chemistry of the candidates, but frequently places too much emphasis on competence and not enough on character.
 
CEO
Although the governing body has ultimate responsibility for tone at the top, the CEO is responsible for day-to-day activities that implement and support the governing body’s tone.  Establishing the right tone fortifies the organization’s reputation and its relationship with stakeholders. Many governments perform poorly when CEOs fail to prioritize the development of a culture of integrity. Since the CEO is the face of the organization to whom employees look for vision, guidance, and leadership, the CEO must openly and continually communicate their values, using different communication methods. While communicating about values is critical, a CEO’s behavior also tells employees what behavior is rewarded and punished. Unfortunately, many governments under-communicate values by a significant factor.
 
Summary
Creating and maintaining the right tone at the top is an essential first step in creating an effective control environment.  A written code of ethics is an important element in establishing the tone because it describes in very clear terms the standard of behavior for all employees. 
 
Therefore all governments that don’t already have a written code of ethics should develop and adopt one right away.
 
Attached is a simple example of a code of ethics that can be tailored to your government’s circumstances.
 

 
Sample Code of Ethics 
Adopted _____, 2023
 
Purpose
 
The public and stakeholders of the City are entitled to responsible, fair and honest government that operates in an atmosphere of respect and civility. Accordingly, the City Council adopts this code to:

• Describe the standards of behavior to which its officials and employees aspire;
• Provide guidance to officials and employees in their day-to-day activities; and
• Promote and maintain a culture of ethics.

 
This Code of Ethics applies to all City appointed officials and employees, and members of any of its boards, commissions, committees, and task forces (collectively hereafter, “staff”).
 
        Ethics and Conduct
 
To ensure that the City operates in a fair, ethical and accountable manner, staff shall:

• Comply with both the letter and spirit of the laws and policies affecting the operations of the City;
• Are independent, impartial and fair in their judgment and actions;
• Use their public office for the public good, not for personal gain; and
• Conduct public deliberations and processes openly, unless required by law to be confidential, in an atmosphere of respect and civility.

 
Therefore, staff shall conduct themselves in accordance with the following ethical standards:
 

1. Act in the public interest. Recognizing that stewardship of the public interest must be their primary concern, staff will work for the common good of the public and not for any private or personal interest, and they will assure fair and equal treatment of all persons, claims and transactions coming before them.
2. Comply with laws and policies. Staff shall comply with both the spirit and the letter of the laws of the nation and the State of California, and with policies of the City in the performance of their public duties.
3. Conduct at public meetings. When participating in public meetings, staff shall prepare themselves for public issues; listen courteously and attentively to all public discussions before the body; and focus on the business at hand.
4. Conflict of Interest. The professional and personal conduct of staff while exercising their office must be above reproach and avoid even the appearance of impropriety. Staff shall not use their official positions to influence government decisions in which they have (a) a material financial interest, (b) an organizational responsibility or personal relationship which may give the appearance of a conflict of interest, or (c) a strong personal bias.
5. Gifts and favors. Staff shall not take any special advantage of services or opportunities for personal gain, by virtue of their public office that is not available to the public in general. They shall refrain from accepting gifts, favors or promises of future benefits which might compromise their independence of judgment or action or give the appearance of being compromised.
6. Confidential information. Staff must maintain the confidentiality of all written materials and verbal information provided to members which is confidential or privileged. Staff shall neither disclose confidential information without proper legal authorization, nor use such information to advance their personal, financial or other private interests.
7. Use of public resources. Staff shall not use public resources which are not available to the public in general (e.g., City staff time, equipment, supplies or facilities) for private gain or for personal purposes not otherwise authorized by law.
8. Positive work environment. Staff shall support the maintenance of a positive and constructive work place environment for employees and the public.  Staff shall refrain from abusive conduct, personal charges or verbal attacks upon the character or motives of other staff or members of the public.
9. Lobbying.  Staff shall not, for a period of two years following the termination of their office or employment, represent, appear or lobby before any City body, agency, official or employee.  "Lobby" shall mean making any oral or written communication directly or indirectly to an official of the City, in an effort to influence or persuade the official to favor or oppose, recommend or not recommend, vote for or against, or take or refrain from taking action on any public policy issue of a discretionary nature.
10. Future employment.  Staff shall not, for a period of two years following the termination of their office or employment, accept employment or otherwise receive compensation from a person or organization that entered into a contract with the City within one year prior to the termination of the office or employment, where the former official or employee personally and substantially participated in the award of the contract.  Staff shall not, for a period of two years following the termination of their office, participate as a competitor in any competitive selection process for a City contract where the former official or employee recommended or approved the project or the work that is the subject of the contract, nor shall any City contract be awarded to such a former official or employee.  The provisions of this section shall not preclude the hiring of a former City employee as a consultant, provided that such hiring is approved in advance by the Commission.
11. Whistle blower protection.  To the extent not otherwise prohibited by State law, staff shall not use or threaten to use any official authority or influence to discourage, restrain or interfere with or to effect a reprisal against any person, for the purpose or with the intent of preventing such person from acting in good faith to report or otherwise bring to the attention of the City or other appropriate agency, any information that, if true, would constitute a gross waste of City funds, a gross abuse of authority, a specified and substantial danger to public health or safety due to any act or omission of a City official or employee, or the use of a City position or resources for personal gain.

Acknowledgement
All current City employees and officials including members of boards, commissions, committees, and task forces, will be given a copy of this Code of Ethics and asked to sign an Acknowledgement of Receipt form (see Attachment).
 
All new employees of the City will be given a copy of the Code of Ethics and asked to sign an Acknowledgement of Receipt form (attached) as part of their new employee orientation.  Each new member of a board, committee, or task force will be given a copy of the Code of Ethics and asked to sign an Acknowledgement of Receipt form at their first meeting.
 
Acknowledgment of Receipt forms for officials, employees and members of boards, committees and task forces shall be maintained on file by the City.

                                                                                                                                                                                              ATTACHMENT
CODE OF ETHICS
ACKNOWLEDGMENT OF RECEIPT FORM
 
Name: ________________________________________                     
 
Title: _________________________________________                                                                                                          
Department/Position: ____________________________
                                                                                                    Signature: _____________________________________                                                                       
Date: _________________________________________   

In its Best Practices, the Government Finance Officers Association recommends:

“…that all governments prepare and maintain a long-term financial plan that projects revenues, expenses, financial position, and external factors for all key funds and government operations at least five years into the future. Governments that utilize debt financing and/or utility rate setting should consider a long-term financial plan greater than five years. The plan should be reviewed on an annual basis and updated as needed or as major assumptions change. Long-term financial planning should be the starting point for capital planning, developing operating budgets, estimating revenue, and other planning processes.”
​
(Source: https://www.gfoa.org/materials/long-term-financial-planning) 

The GFOA lists the benefits of long-term financial planning as:

To view and download a Long-Term Financial Planning Policy Sample, which can be tailored to your government’s circumstances and priorities, please click here (sample will download in editable Word format).

For any questions about your government's long-term financial planning, feel free to reach out to kevin directly:
​​
Kevin Harper, CPA
kharper@kevinharpercpa.com
(510) 593-503

One of the primary responsibilities that governmental Chief Financial Officers (CFOs) are often tasked with is to ensure the adequacy of the government’s internal controls. But governmental operations are large, complex, and continually changing because of staff turnover, technology improvements, changing regulations, and new programs/services. 
​So how does a CFO know whether internal controls are adequate?

The best way to assess the adequacy of internal controls is to first identify the largest risks to the government. These are unfavorable things that, if they occurred, would have a huge negative impact on the government’s finances and/or ability to provide services. 

You can view this Generic Risk Framework which may help you begin the process of identifying your government’s primary risks (click this link to view and download the framework in editable Word format). The risk topics listed in the generic framework can be used to brainstorm risks specific to your government.

In tailoring the generic risk framework to your government, it is helpful to think about risks in the following categories:  

Once your management identifies the major risks, specific groups of employee experts should be asked to validate that all risks have been identified. These groups can also help your management rank all risks based on their likelihood of occurrence and the potential damage they might cause.

Starting with the highest-ranked risks, management should determine whether controls that are already in place are adequate to lower the risk to an acceptable level. If they are not, appropriate action plans should be developed to further mitigate the risk to a more acceptable level.
​

If you have more questions about the Generic Risk Framework or how to assess your government’s internal controls, feel free to reach out to Kevin directly:
​
Kevin Harper, CPA
kharper@kevinharpercpa.com
(510) 593-503

Your Finance Department has many roles. But one of the most crucial roles is to maintain your organization’s official accounting records. This also gives it a unique opportunity to provide relevant information and assistance to other departments. However, the role of financial accountants requires deep technical knowledge and skills, and there’s added pressure as many of their tasks have strict deadlines. Therefore, questions from operating departments are sometimes seen as distractions to accountants rather than as part of their key job responsibilities.  
 
Operating departments frequently come to the Finance Department with technical questions intended to help them better operate their programs or spend money more cost-effectively. These questions may range from simple (“Has this invoice been paid?”, or “How do I log into the financial system?”) to the complex (“Can you help us determine whether the fees we are charging for our services are fair?”).
 
The Finance Department also provides monthly or quarterly budgeted vs. actual revenues and expenditures financial reports to departments, as well as financial information to elected officials, senior management, the public, granting agencies, regulatory bodies, bondholders, and others. Some of this information is used in evaluating the performance of operating departments.
 
Accordingly, operating departments expect financial information coming from Finance to be accurate, complete, and timely. If Finance does not meet this expectation, it will lose credibility in the organization. When this happens, dire consequences can follow. Departments have to guess at what to do instead of asking, leading to more errors.

​Take, as an example, this story:

​The credibility of the Finance Department throughout the organization is important to its success, and indeed, to the success of the government itself. This credibility needs to be nurtured through good relations with other departments. The good news is that it is not difficult.
​

If you have more questions on how to manage or improve your Finance Department's credibility, feel free to reach out to Kevin directly:
​
Kevin Harper, CPA
kharper@kevinharpercpa.com
(510) 593-503

​Does your government receive rental revenue? Most governments have small amounts of rental revenue or similar receivables. Sources can include low-cost housing, rental of unused office buildings, monthly rental of parking spaces, and concessionaires. Because most governments typically don’t have huge amounts of receivables to report (besides those that are due from other governments or from utility customers), they often do not have adequate receivable modules in the financial system and may not have staff that are adequately trained to track and manage tenant rental receivables. This can become a problem.
​

​One of our clients experienced a fraud related to its rental revenue (see this blog post about Minimizing Your Government’s Risk to Billing Fraud for more). This client is a state agency that owns an office building. It rents the ground floor of the building to various retail tenants and rents excess space on other floors to office tenants. The Rental Manager was responsible for billing and collecting tenant revenue. She submitted checks collected to the Finance Department for deposit. The Finance Department did not track whether amounts were billed timely nor whether billed amounts were collected. Over the course of several years, the Rental Manager embezzled several hundred thousand dollars. She did this by writing “/PLOT” on the payee line after the name of the government and was able to deposit stolen checks via ATM into a not-for-profit bank account that used the acronym PLOT. She served as volunteer treasurer for PLOT and from there she was able to access the funds.

This fraud highlights two things:

1) You cannot rely on bank internal controls to assure checks written to your government are not cashed by others; and
​
2) separating the billing and collection of rental revenue tasks is the single most control to ensure is in place.

Even if your government’s rental revenue is small, it is important to for the Finance Department to adequately segregate billing and collection duties. Using the attached sample tenant rental ledger is a good start to encourage adequate Finance Department oversight.

If you have more questions on how to manage your government’s tenant rental receivables better, feel free to reach out to Kevin directly:
​
Kevin Harper, CPA
kharper@kevinharpercpa.com
(510) 593-503

​​Recently, I was engaged to audit the effectiveness and efficiency of a City’s payroll process. I asked the payroll clerk whether employees submitted timesheets on time:

Having an inefficient payroll process can be costly and burdensome for a city to manage.
​
The main negative consequences of payroll processes are:
​

1. It takes more manpower to process payroll every pay period.
2. It increases the risk of being late paying payroll.
3. It fails to take advantage of available technology.
4. It encourages continued poor communication between Payroll/Finance, HR, and departments.
5. It fails to follow (or it highlights the inadequacies of) written payroll policies and procedures.

Unfortunately, the city in the example above is not doing anything to address this inefficiency; they are just finding ways to work around the problem. Worse, managers in the position to be able to improve the situation are apparently not even aware of the problem.
​
Payroll is a complex business process requiring the cooperation of all employees, and with many continually changing elements (e.g., new laws, accounting standards, policies, technology, stakeholder expectations, etc.). Because of this, the effectiveness and efficiency of the payroll process (like any complex process), is deteriorating unless efforts are underway to improve it.

One good way to monitor whether your payroll process is improving or deteriorating is to keep an error log. Every transaction that causes personal intervention should be logged and later reviewed to identify trends and to develop action plans to improve significant recurring inefficiencies. This error log should be simple enough to maintain and include the following:

1) just enough information to allow the transaction to be located in the accounting records; and
2) an error code to allow sorting of errors by type.

​For example, error codes may include:

• Timesheet not received by deadline
• Timesheet incorrect (mathematical or account coding error, or not signed)
• Leave time (vacation, sick, holiday) incorrect
• Pay amount calculated incorrectly (including overtime, termination pay)
• Payroll Change Notice not accurate or not complete
• Incorrect classification of employee (exempt vs. non-exempt, employee vs independent contractor)
• Incorrect withholding or deduction

​

If you have more questions about the payroll process or error logs, feel free to reach out to Kevin directly:
​
kharper@kevinharpercpa.com
(510) 593-5037

Finance departments are being asked to conduct risk assessments more frequently these days. It may be because of:

​​Regardless of whether the risk assessment being conducted is at the entity-wide level or for a particular business process, department, or program, the process for conducting it is the same. The steps to go through can be more or less formal depending on the importance of the risk assessment and who the ultimate users are. Some steps can even be handled on a “gut feel” basis.
 
The steps to go through are the following:

(For an in-depth explanation on how to conduct proper risk assessment for implementation projects, see this blog post.)

1. Identify objectives: For every objective that a government sets, there are risks that must be managed to maximize the probability of meeting that objective. For example, a government’s objective to provide daycare services will expose it to risks (such as threats to health and safety of children, non-compliance with state laws, and inability to collect fees) that are far different from those it would be exposed to if its objective is to improve the condition of roads (safety of workers, environmental safety, engineering design safety, compliance with grant provisions).

2. Identify risks: Once you know your objectives, brainstorm the related risks. What could keep you from accomplishing the objectives?  Identification of risk is best done by the “employee experts”.

3. Research risk history, controls, and consequences: Once you have identified the risks, you will need to understand each risk thoroughly. Therefore, you will need to research the following:

• Has this risk occurred before?  If so, what were the consequences? Have internal controls been improved since then that reduces the likelihood of recurrence?
• What internal controls are in place that help to reduce each risk?
• What are the likely consequences if this risk occurs?  How bad would it be?

You should then be able to document your risks and related controls like shown in the diagram below:

4. Determine impact and likelihood: In order to identify which risks are most in need of being managed, you need a way to quantify (or at least prioritize) those risks. A common method is to ask employee experts (after they have fully understood the risk history, consequences, and controls) to rank on a scale of 1 – 10 the likelihood of each risk occurring and then to rank on a scale of 1 – 10 the impact that risk would have if it occurred. The resulting rankings can be graphed on a chart like this:

​5. Determine whether the exposure is acceptable: For each risk, consider whether internal controls in place reduce the risk to an acceptable level of exposure.

This is done by thinking/discussing/understanding the risk’s likelihood of occurring, impact, and internal controls. This step is frequently conducted in a facilitated meeting with employee experts to assure all knowledge and points of view are considered.

6. Develop a risk mitigation plan: For any risks that management considers the exposure to be unacceptable, an action plan should be developed to reduce the exposure to an acceptable level. Below is a list of actions that can be taken to reduce exposure to a risk:

Once you go through the six steps above, you will have a good understanding of your primary risks, controls, and exposures. You will know which risks are being effectively managed and, for the risks not being effectively managed, you will have a high-level action plan to improve the management of those risks.

For an in-depth explanation on how to conduct proper risk assessment for implementation projects, please see this blog post.

​Local governments get audited all the time – by the annual independent auditors, the internal auditor, various granting agencies, and various taxing and regulatory agencies. No matter how competent your Finance Department is, it is inevitable that some of its various auditors will issue audit findings.

The most frequent audit findings are from the annual independent auditors.
​
Their findings are categorized as
a) material weaknesses in internal control,
b) significant deficiencies in internal control, and
c) other matters of interest to governing officials.
​

​If the annual independent auditors conduct a single audit of federal financial assistance programs, additional categories of findings are

a) non-compliance with laws and regulations that are material to the financial statements, and
b) non-compliance with federal grant regulations that are material to a federal financial assistance program.
​
Audit findings are generally accompanied by recommended corrective action.

1. ​Usually, the auditor will share findings with the auditee before the audit report is issued. This is your opportunity to understand what the auditor observed, including what they believe is the exact regulation, policy, or internal control not being followed. This is also your opportunity to help the auditor understand anything they missed. If you disagree with the finding, provide documentary evidence of why the auditor has misinterpreted or misunderstood, and attempt to negotiate having the finding removed or reworded. Even if you agree with the finding, you may be able to negotiate wording of the finding or the recommended corrective action.
2. After the wording of the finding is finalized, the auditors will usually ask for management’s response to each finding, which is typically included along with the finding in the audit report. This management’s response is generally a short statement that you either agree with the finding and will fix the problem, or that you disagree with the finding. If you disagree, you will need to provide details about why. It is generally better to say you agree (even if you don’t totally agree) and what you will do to improve the situation instead of disagreeing, because audit findings are viewed as an independent assessment and carry significant weight by stakeholders. Disagreements with the auditors are frequently viewed as defensive maneuvers or nitpicking by management.
3. Next, you should write a corrective action plan. This plan should include the steps that need to be taken to fix the issue that was noted in the finding, and to fix the internal controls to assure the issue does not recur. The person who will be responsible as well as the deadline date should be identified for each step.
4. You should inform appropriate senior management, governing board officials, and stakeholders about the finding. Be sure to share the corrective action plan, so they know you are proactively addressing the issue.
5. You should assure them the corrective action plan is accomplished because the auditors will generally follow up during their next visit to verify resolution.​

​

Click here to see an example of a common finding, an example of an appropriate management response to the finding, and an example of an appropriate corrective action plan:

​When you receive an audit finding, don’t overreact. An audit finding is not a report card. At best, it is an opportunity to learn and improve. At worst, it is an opportunity to demonstrate professionalism and responsiveness to independent criticism.
​

​If you have more questions about how to respond to an audit finding, feel free to reach out to Kevin directly:

kharper@kevinharpercpa.com
(510) 593-5037

​We frequently hear the importance of being accountable, or of holding others accountable. Your government might even have a strategic objective of being more accountable to constituents.

But – what does being accountable actually mean? Just because the root of the word “accountability” is the same as the root of “accountant”, that doesn’t mean accountants have any inherent understanding of this concept. 


Definition of accountability
Webster’s Dictionary defines "accountable" as "subject to giving an account" or "capable of being explained". The Cambridge Dictionary defines it as "responsible for what you do and able to give a satisfactory reason for it". Thus, to be accountable you must explain why you did what you did, especially when the results were not as good as expected. Explaining what happened, why it happened, what you learned, and what you will do differently next time is a good recipe for dealing with an unhappy boss, spouse, co-worker or elected official.


So, what should you do as a leader to hold your employees accountable?

Before we lay out the proposed steps, there are a couple of things you need to keep in mind:

​If you have more questions about accountability in business, feel free to reach out to Kevin directly:

kharper@kevinharpercpa.com
(510) 593-5037
 

If you'd like to get more free tips, as well as downloadable tools and templates for your agency, please join our mailing list here!
​
(We’ll send you a monthly curated selection of our blog posts. You can unsubscribe at any time.)