11 years as auditor and countingThe town's current outside audit firm, Heinfeld Meech, has been auditing the town's books for 11 years. That's a long time. Too long, in fact. Not because the firm may or may not have been doing a good job. But because 11 years is just too long a time period to have the same firm audit the same town staff.
Though the auditor does report to the council, they have to work with town staff for 11 years. It's really the same town staff in place. The auditor has developed relationships over 11 years with them. At this point, they trust town staff. That's nice. However, trust is not an auditing standard!
The same firm auditing the work of the same people simply does not provide the critical eye and independent thinking that is required in today's compliance oriented world.
After the Enron financial fiasco, public company best practices regarding auditors changed. It was no longer wise is to keep the same auditor forever, as Enron had done. The auditor, regardless of who it is, gets too comfortable with staff. Post Enron, it is a best practice to change auditors every 4 to 6 years.
Trust is not an audit standard
During last week's meeting, Corey Arvisu, partner in the Heilfeld firm, responded to several probing questions by council member Nicolson. Nicolson wanted to know how the firm detected the error and whether or not they extended their audit procedures. The auditor did not know exactly how the error had been detected. He surmised that it was detected through conversations with town staff. Really, trust town staff to tell you what may be wrong?
The auditor should have known this was an area ("Developer Credits") to be investigated since it was the result of a change in policy the town in 2016. The auditor should have known of this change. They should have developed audit procedures to test that this change is being properly recorded. They did not. Instead, they trusted staff. The auditor also did not extend their audit procedures to identify all possible errors, in this year or by looking into the past.
Being the best of the worst is not good enough for Oro Valley
In continuing his response to Nicolson, the auditor went out of his way to point out that the $3 million reporting error which his firm detected (see our posting last week) and identified as "significant" was "... not a significant concern at this point." His said that his firm has found worse in other places. So what?
Being best of the worst is not good enough. This isn't other municipalities. This is Oro Valley. The auditor's point of reference (worse communities) is simply not good enough.
Take it behind closed doors
The council did not but should have met with the auditor is special session, with no town staff, no public attending. This has three advantages:
- The auditor can speak freely without having to temper comments because staff is watching
- Council members can ask any question they want to ask, without fearing that they are going to "offend" or in some way "impugn" town staff
- Showboating is eliminated. There is no need for any council member to use the discussion as a vehicle for pointing out how great the town is doing financially or how great the staff is.
---
