PORT OF SEATTLE
MEMORANDUM
DATE: November 1, 2011
TO: Audit Committee
FROM: Joyce Kirangi, Internal Audit Director
SUBJECT: Risk Survey Among Key Port Leaders for Internal Audit 2012 Risk Assessment
Internal Audit conducts a variety of procedures to prepare its annual risk assessment. Included are a series
of interviews with key Port leaders across five divisions to obtain management perspectives on the current
business environment and to assess risk landscape in their respective responsibility areas and for the Port
as a whole. Specifically, the following two questions were posed to each interviewee:
1. What risk do you see in your area to which Internal Audit can add value through an independent
and objective review?
2. Considering the Port as a whole, what areas (e.g., systems, processes, departments, etc.) do you
see a risk of negative impact?
We began the interviews some 90 days ago and have recently completed the process. We have met with
the following key leaders:
•
Commissioner Creighton
•
Colleen Wilson
•
Linda Styrk
•
Commissioner Tarleton
•
Joe McWilliams
•
Peter Garlock
•
Tay Yoshitani, CEO
•
Dave Soike
•
Ralph Graves
•
Kurt Beckett, Chief of Staff
•
Vickie Rawlins
•
Rudy Caluza
•
Dan Thomas
•
Gary Buchanan
•
Mark Reis
•
Borgan Anderson
•
Elizabeth Leavitt
•
Wendy Reiter
•
Jeff Hollingsworth
•
Mike Ehl
•
Luis Navarro
•
Jim Schone
•
Patricia Akiyama
•
Deanna Zachrisson
•
James Jennings
The following are not all-inclusive but represent common areas of concern among interviewees. They are
not listed in any order of importance.
• Compliance cost regarding CPO policies and procedures (efficiency)
• Electronic Technician (ET) at Aviation Maintenance being a de facto second IT department
(efficiency)
• Hiring practices in regard to minimum qualifications
• Business continuity including succession planning to minimize “brain drain” and/or loss of
institutional memories due to staff turnover and retiring baby boomers
• Use of service or PTO days following a separation announcement
• 3
rd
party management agreements
• Accuracy and completeness of airline and lessee self-reported information, especially in regard to
revenue calculations
• Consistency and enforcement of insurance and indemnity provisions in various contracts
• Rightsizing ICT as it relates to FTEs and budget – also cost effectiveness and efficiency as it relates
to ICT technology operation and delivery of service
• New policy and/or process reviews (e.g., P-card, ERM, LEAN, etc.)
• Cost allocations, including revenue diversion concerns from the airport
• Commission Office Departmental Audit
• Seaport Division air emission programs--compliance and monitoring of the programs
• Performance audit of Port employees head counts -- ~1800 in 2012 budget
1/4
Survey Results September 2011
* = Port Authorities
Internal Audit Department
Internal Audit Department
Question # 1. Does
your internal audit group
audit both the traditional
organization internal
controls and ALSO audit
lease and concession
contract compliance?
Question # 2.
Does your oganization
have two separate and
distinct audit groups? One
for the traditional internal
controls and another
group for lease and
concession audits?
Other Comments
Organization and Types of Audits conducted
Alaska Department of Transportation & Public
Facilities
YES NO
We conduct all types of audits for the State DOT. We also
audit highways, ferries, and public buildings.
Athens International Airport YES NO
We conduct both types of audits, athough we have one
employee who is kind of specialized in concession audits.
Austin-Berstrom International Airport YES NO
Our airport is owned by the City of Austin. The Austin Office of
the City Auditor audits the whole city departments. The City
Aviation Division runs the airport and has auditors who conduct
concession audits, parking, IT, internal controls, and conduct
risk assessment.
City of El Paso YES NO
We conduct Performance Audits, Compliance, Financial Audits,
and Operational Audits on all City departmenta. In addition, we
do Airport Concessions and Vendor Contracts Audits.
Functionally, we report to the City Manager, and
Legistrativelyto the Internal Audit Committee (4 members of
City Council).
City of Phoenix - Sky Harbor International Airport YES NO
We have a team of 6 auditors and I audit manager assigned to
the Airport. This team conducts both internal control audits and
airport lease and concession. We report to the City Manager.
CVG - Cincinnati/Northern Kentucky International
Airport
YES NO
We conduct both types of audits. We administratively report to
the CEO and functionally to the Audit Committee.
Dallas/Fort Worth International Airport YES NO
Our 15 auditors perform all types of audits - Financial,
Operational, Compliance, IT, Revenue, and Contract audits.
The department is indepent of management and reports to the
Board of Directors.
Denver International Airport YES NO
We conduct both internal controls and concession audits.
Internal controls is a newer audit activity for our group.
Greater Orlando Aviation Authority YES NO
The airport facilities are owned by the City of Orlando, but the
airport itself is a special district (airport authority) and has a
sepate governing board.
Greater Rochester International Airport N/A N/A Our Internal Audit Function is outsourced.
2/4
Survey Results September 2011
* = Port Authorities
Internal Audit Department
Internal Audit Department
Question # 1. Does
your internal audit group
audit both the traditional
organization internal
controls and ALSO audit
lease and concession
contract compliance?
Question # 2.
Does your oganization
have two separate and
distinct audit groups? One
for the traditional internal
controls and another
group for lease and
concession audits?
Other Comments
Greater Toronto Airports Authority - Cananda NO YES
There are two separate and distinct audit groups - one for
internal controls and the other group for lease concession and
compliance.
Hartisfield - Jackson Atlanta International Airport YES NO
Internal Audit conducts both types of audits - internal controls
and lease and concession. We also outsource some audits to
private CPA firms if needed.
Hillsborough County Aviation Authority, Tampa
International Airport
YES NO
We are independent of management. We have passed two
peer reviews in accordance with the Yellow Book.
Honolulu International Airport YES NO We perfom both audit functions
Jacksonville Aviation Authority YES NO
We perform both organization internal control audits and the
airport lease and concession arrangements. Internal Audit is
independent of management and reports to the Board of
Directors.
John Wayne Airport - California YES NO
The County Internal Audit Function conducts
concession/lease/license audits and other county functions
and/or internal controls. The airport intenal audit functions
concentrates on construction auditing and providing consulting
services to PARCS/parking system
Lambert- St. Louis International Airport YES NO
Lee County Port Authority YES NO One of the auditor is assigned primarily at the airport.
Los Angeles World Airports - Los Angeles
International Airport, LA/Ontario International
Airport, and Van Nuys Regional Airport)
NO YES
Revenue auditors are under the Controller. They are
responsible for auditing Airport Lease and Concessions. Our
audit group reports to the Deputy Executive Director of
Administration. We make our audit presentation to the Audit
and Ethics Committee bi-monthly.
Louisville Regional Airport Authority YES NO
Lusaka International Airport YES NO
Performs both internal controls and lease and concession
audits.
Maryland Aviation Administration - Baltimore YES NO
We have a staff of 4 auditors, and we conduct all types of
audits - whatever needs to be done we do.
Operational/organization audit reports are issued to the CEO,
and tenants/concession, and contractor audit reports are issued
to the related party.
Massachusetts Port Authority /Logan International
Airport
YES NO
We conduct both types of audits, including construction and
system audits.
3/4
Survey Results September 2011
* = Port Authorities
Internal Audit Department
Internal Audit Department
Question # 1. Does
your internal audit group
audit both the traditional
organization internal
controls and ALSO audit
lease and concession
contract compliance?
Question # 2.
Does your oganization
have two separate and
distinct audit groups? One
for the traditional internal
controls and another
group for lease and
concession audits?
Other Comments
McCarran Internaltional Airport - Las Vegas YES NO
McCarran International Airport is part of the Clark County of
Nevada. The County has another audit group that audits the
rest of the County government, but all airport activities are
audited by the airport auditors. The types of audits which
include contract compliance (lease/concession), and internal
control audits. We just recently added the internal control
audits.
Metropolitan Washington Airports Authority YES NO
We conduct both types of audits -- traditional internal controls
and lease and concession audits. Internal Audit is independent
of management and reports to the Board of Directors.
Niagara Frontier Transportation Authority (NFTA) YES NO All auditors share in the types of audits that we do.
Port Authority of New York & New Jersey
(JFK, Newark, and LaGuardia airports etc.)
YES
NO. We have one Audit
Group with various work
groups within it.
Our Audit Department is organized by major types of audits.
We have the following 8 divisions within Internal Audit.
Construction Audits, Coporate Audits, Information Systems &
Technology Audits, Mainytenance & Service Agreements
Audits, Operational Audits Percentage Agreements Audits,
Revenue Audits, and World Trade Audits. All auditors reveiw
internal controls applicable to their audits. However, the more
traditional agency-wide internal controls is conducted by the
Corporate Audits divsion. We are independent from
management. We report directly to the Port authority's
Inspector General and have a dotted line to the Audit
Committee. We average approx. 10-13 auditors per airport.
Port of Oakland - Port Authority YES
No. We have one Audit
Group. Some audit staff
concentrate on lease and
concession audits
The Audit Department reports directly to the Board.
Port of Portland - Port Authority YES NO
We conduct both types of audits. We also have a seaport that
we audit as well. Audit staff conducts all types of audits.
4/4
Survey Results September 2011
* = Port Authorities
Internal Audit Department
Internal Audit Department
Question # 1. Does
your internal audit group
audit both the traditional
organization internal
controls and ALSO audit
lease and concession
contract compliance?
Question # 2.
Does your oganization
have two separate and
distinct audit groups? One
for the traditional internal
controls and another
group for lease and
concession audits?
Other Comments
Port of Seattle - Port Authority YES NO
The authority is comprised of an airport, seaport, and real
estate. Internal Audit Department reports to the Audit
Committee and administratively to the CEO.
Raleigh-Durham Airport Authority YES NO
We have one audit group that conducts both audits - process (
internal controls) audits, and compliance audits that include
lease and concessions.
Reno-Tahoe Airport Authority YES NO
We conduct both types of audits, but one auditor is specialized
in auditing parking revenue.
Salt Lake City Intenational Airport YES NO
For a long time, the focus of our audit function was contract
compliance, but we have transformed to internal controls, now
conducting both types of audits.
San Diego County Regional Airport Authority YES NO
Our audit group performs audit of airport Internal Control
Processes, Leases & Concessions, Contract Payments, and
Construction Activitity.
San Antonio Airport System YES NO Our group performs both types of audits
Spokane International Airport YES NO
We conduct both internal controls, and lease and concession
audits.
Tucson Airport Authority YES NO
Internal Audit is independent of management. We report to the
Board through the Audit Council.
Wayne County Airport Authority (WCAA) in Detroit YES NO
We conduct both internal controls and lease concession audits.
We also outsource some of our audits to private CPAs when
needed.
39