2023 Audit Plan

The Denver Charter states the Auditor shall conduct:

• Financial and performance audits of the City and County of Denver in accordance with generally accepted government auditing standards;

• Audits of individual financial transactions, contracts, and franchises; and

• Audits of financial and accounting systems and procedures, including records systems, revenue identification, and accounting and payment practices, for compliance with generally accepted accounting principles, best financial management practices, and any applicable laws and regulations governing the financial practices of the City and County of Denver.

The 2023 Audit Plan ensures broad audit coverage throughout the city while also addressing specific performance, financial, contractual, information technology, and regulatory risks. According to the charter, the ultimate decision to perform any audit shall be at the sole discretion of the Auditor. Our approach to scheduling audits is flexible and subject to change throughout the year based on newly identified risks.

Integrated audits incorporate elements of performance, financial, and information technology auditing. This produces a more effective outcome through a holistic audit approach with a focus on improving governance, compliance, performance, and operations.

Integrated auditing incorporates diverse approaches, including:

• Performance Auditing – We identify opportunities to improve the efficiency and effectiveness of city activities. Our performance audits also assess the viability or strength of the internal control environment of the city’s agencies and programs. We conduct policy analysis and evaluation and may assess the city’s ability to mitigate risk. We also conduct prospective analysis to help agencies complete their policies and procedures and mitigate future risk.
  
  
• Financial Auditing – The 2023 Audit Plan continues our focus on the overall financial management and fiscal activities of the city. These audits will assess the financial internal control environment, compliance with city polices, financial governance, accounting and reporting practices, and high-risk financial transactions.
  
  
• Information Technology Auditing – Our audits will continue to address identified information technology risks by focusing on the effectiveness of cybersecurity defenses, data protection, data privacy, and management of critical systems and applications.
  
  
• Contract Compliance Auditing – The 2023 Audit Plan reflects a continued emphasis on auditing city contracts for compliance with contract terms and fulfillment of the scope of work.

As part of Auditor O’Brien’s original vision for the Auditor’s Office, the Audit Analytics Program expands the office’s risk assessment and auditing capability and continues leading- edge audit practices to provide greater value and impact. Using data science tools, auditors sorts through large numbers of transactions and entire data sets to identify the highest risks, instead of relying entirely on sampling.

• Audit Analytics – The Auditor’s Office uses quantitative and qualitative risk-finding analytics of audit-related data and applies survey and sampling methodologies to support audits of city processes and internal controls. Audit analytics can be used to ensure data is accurate, consistent, and complete; to identify, analyze, and create graphic visual representations of anomalies and patterns; to build statistical models; and synthesize analytical results in audit reports.
  
  
• Continuous Auditing – Continuous auditing is an audit analytics method that allows auditors to directly connect with city data systems, use an entire data population rather than samples, and automate ongoing analyses of that data. These ongoing analyses of data systems are used to identify high-risk areas and test controls in the city’s financial and operational systems in a timely fashion. The information gained from continuous auditing helps inform audits and the annual risk assessment. It can help audit teams to improve efficiencies in planning and fieldwork by identifying trends and exceptions earlier than through traditional methods.

The city’s management is responsible for establishing internal controls to detect and prevent fraud for each city entity. Although fraud detection is not a primary responsibility of the Auditor’s Office, our audits consider the possibility that fraud, waste, or abuse may be occurring.

Audit follow-up activities are conducted for every audit to assess whether city personnel implemented the agreed upon audit recommendations for improvement and impact.

The Auditor’s Office regularly issues follow up audit reports to the Audit Committee and the City and County of Denver’s operational management on the status of audit findings and our recommendations for improved business practices.

Our office measures the audit recommendation acceptance rates and recommendation implementation rates as indicators of the degree to which the city is using information provided by our audit reports to mitigate identified risks and to enhance efficiency, effectiveness, and economy of operations.

Although the Auditor’s Office operates independently from other city entities, Auditor O’Brien and Auditor’s Office leadership meet regularly throughout the year with City Council members, the mayor, the clerk and recorder, city agency leaders, neighborhood groups, and civic leaders to solicit input regarding risks. Our objective is to improve services and stewardship of city resources.

Developing the annual Audit Plan is an ongoing process including: assembling ideas from a variety of internal and external sources, examining a broad range of city activities and data, and then assessing risk severity and other considerations. This approach results in a diverse list of agencies, programs, activities, services, systems, grants, and contracts that auditors examine to determine whether these are operating efficiently, effectively, and in accordance with both the law and any defined requirements. 

In developing a list of potential audits and other types of analyses, risks to prioritize come from a variety of sources:

• Assessments of operations and controls in previous internal and external audit reports, including independent audits of the city’s Comprehensive Annual Financial Report, single audits, and audit management letters.
• Input from community members, elected officials, Audit Committee members, external auditors, and agency managers and staff.
• Consideration of current local events, financial conditions, major capital projects, and public policy issues.
• Consideration of risks identified in other government audits that could emerge in Denver.

A robust audit plan assesses a broad range of city activities including:

• Organizational units within a city agency, such as a division or a department;
• Individual city programs and offices.
• Transaction cycles or processes that affect more than one city function or agency, such as contract procurement, purchasing, cash handling, fines, taxes, and assessments or key technology processes.
• Individual financial statement accounts or transactional activities, such as grant programs, construction in progress, tax- funded programs, and special revenue funds.
• City functions that operate like for-profit entities, such as Denver International Airport.
• Contracts and agreements between the city and third parties.