PORT OF SEATTLE MEMORANDUM DATE: November 1, 2011 TO: Audit Committee FROM: Joyce Kirangi, Internal Audit Director SUBJECT: Risk Survey Among Key Port Leaders for Internal Audit 2012 Risk Assessment Internal Audit conducts a variety of procedures to prepare its annual risk assessment. Included are a series of interviews with key Port leaders across five divisions to obtain management perspectives on the current business environment and to assess risk landscape in their respective responsibility areas and for the Port as a whole. Specifically, the following two questions were posed to each interviewee: 1. What risk do you see in your area to which Internal Audit can add value through an independent and objective review? 2. Considering the Port as a whole, what areas (e.g., systems, processes, departments, etc.) do you see a risk of negative impact? We began the interviews some 90 days ago and have recently completed the process. We have met with the following key leaders: • • • • • • • • • Commissioner Creighton Commissioner Tarleton Tay Yoshitani, CEO Kurt Beckett, Chief of Staff Dan Thomas Borgan Anderson Jeff Hollingsworth Jim Schone James Jennings • • • • • • • • Colleen Wilson Joe McWilliams Dave Soike Vickie Rawlins Gary Buchanan Elizabeth Leavitt Mike Ehl Patricia Akiyama • • • • • • • • Linda Styrk Peter Garlock Ralph Graves Rudy Caluza Mark Reis Wendy Reiter Luis Navarro Deanna Zachrisson The following are not all-inclusive but represent common areas of concern among interviewees. They are not listed in any order of importance. • • • • • • • • • • • • • • Compliance cost regarding CPO policies and procedures (efficiency) Electronic Technician (ET) at Aviation Maintenance being a de facto second IT department (efficiency) Hiring practices in regard to minimum qualifications Business continuity including succession planning to minimize "brain drain" and/or loss of institutional memories due to staff turnover and retiring baby boomers Use of service or PTO days following a separation announcement 3rd party management agreements Accuracy and completeness of airline and lessee self-reported information, especially in regard to revenue calculations Consistency and enforcement of insurance and indemnity provisions in various contracts Rightsizing ICT as it relates to FTEs and budget - also cost effectiveness and efficiency as it relates to ICT technology operation and delivery of service New policy and/or process reviews (e.g., P-card, ERM, LEAN, etc.) Cost allocations, including revenue diversion concerns from the airport Commission Office Departmental Audit Seaport Division air emission programs--compliance and monitoring of the programs Performance audit of Port employees head counts -- ~1800 in 2012 budget Survey Results September 2011 Internal Audit Department Organization and Types of Audits conducted Internal Audit Department Question # 1. Does your internal audit group audit both the traditional organization internal controls and ALSO audit lease and concession contract compliance? * = Port Authorities Question # 2. Does your oganization have two separate and distinct audit groups? One for the traditional internal controls and another group for lease and concession audits? Other Comments Organization and Types of Audits conducted Alaska Department of Transportation & Public Facilities YES NO Athens International Airport YES NO Austin-Berstrom International Airport YES NO City of El Paso YES NO City of Phoenix - Sky Harbor International Airport YES NO CVG - Cincinnati/Northern Kentucky International Airport YES NO Dallas/Fort Worth International Airport YES NO Denver International Airport YES NO Greater Orlando Aviation Authority YES NO Greater Rochester International Airport N/A N/A We conduct all types of audits for the State DOT. We also audit highways, ferries, and public buildings. We conduct both types of audits, athough we have one employee who is kind of specialized in concession audits. Our airport is owned by the City of Austin. The Austin Office of the City Auditor audits the whole city departments. The City Aviation Division runs the airport and has auditors who conduct concession audits, parking, IT, internal controls, and conduct risk assessment. We conduct Performance Audits, Compliance, Financial Audits, and Operational Audits on all City departmenta. In addition, we do Airport Concessions and Vendor Contracts Audits. Functionally, we report to the City Manager, and Legistrativelyto the Internal Audit Committee (4 members of City Council). We have a team of 6 auditors and I audit manager assigned to the Airport. This team conducts both internal control audits and airport lease and concession. We report to the City Manager. We conduct both types of audits. We administratively report to the CEO and functionally to the Audit Committee. Our 15 auditors perform all types of audits - Financial, Operational, Compliance, IT, Revenue, and Contract audits. The department is indepent of management and reports to the Board of Directors. We conduct both internal controls and concession audits. Internal controls is a newer audit activity for our group. The airport facilities are owned by the City of Orlando, but the airport itself is a special district (airport authority) and has a sepate governing board. Our Internal Audit Function is outsourced. 1/4 Survey Results September 2011 Internal Audit Department Organization and Types of Audits conducted Internal Audit Department Question # 1. Does your internal audit group audit both the traditional organization internal controls and ALSO audit lease and concession contract compliance? * = Port Authorities Question # 2. Does your oganization have two separate and distinct audit groups? One for the traditional internal controls and another group for lease and concession audits? Greater Toronto Airports Authority - Cananda NO YES Hartisfield - Jackson Atlanta International Airport YES NO YES NO YES NO Jacksonville Aviation Authority YES NO John Wayne Airport - California YES NO Lambert- St. Louis International Airport Lee County Port Authority YES YES NO NO Los Angeles World Airports - Los Angeles International Airport, LA/Ontario International Airport, and Van Nuys Regional Airport) NO YES Louisville Regional Airport Authority YES NO Lusaka International Airport YES NO Maryland Aviation Administration - Baltimore YES NO Massachusetts Port Authority /Logan International Airport YES NO Hillsborough County Aviation Authority, Tampa International Airport Honolulu International Airport Other Comments There are two separate and distinct audit groups - one for internal controls and the other group for lease concession and compliance. Internal Audit conducts both types of audits - internal controls and lease and concession. We also outsource some audits to private CPA firms if needed. We are independent of management. We have passed two peer reviews in accordance with the Yellow Book. We perfom both audit functions We perform both organization internal control audits and the airport lease and concession arrangements. Internal Audit is independent of management and reports to the Board of Directors. The County Internal Audit Function conducts concession/lease/license audits and other county functions and/or internal controls. The airport intenal audit functions concentrates on construction auditing and providing consulting services to PARCS/parking system One of the auditor is assigned primarily at the airport. Revenue auditors are under the Controller. They are responsible for auditing Airport Lease and Concessions. Our audit group reports to the Deputy Executive Director of Administration. We make our audit presentation to the Audit and Ethics Committee bi-monthly. Performs both internal controls and lease and concession audits. We have a staff of 4 auditors, and we conduct all types of audits - whatever needs to be done we do. Operational/organization audit reports are issued to the CEO, and tenants/concession, and contractor audit reports are issued to the related party. We conduct both types of audits, including construction and system audits. 2/4 Survey Results September 2011 Internal Audit Department Organization and Types of Audits conducted Internal Audit Department McCarran Internaltional Airport - Las Vegas Question # 1. Does your internal audit group audit both the traditional organization internal controls and ALSO audit lease and concession contract compliance? YES * = Port Authorities Question # 2. Does your oganization have two separate and distinct audit groups? One for the traditional internal controls and another group for lease and concession audits? Other Comments NO McCarran International Airport is part of the Clark County of Nevada. The County has another audit group that audits the rest of the County government, but all airport activities are audited by the airport auditors. The types of audits which include contract compliance (lease/concession), and internal control audits. We just recently added the internal control audits. Metropolitan Washington Airports Authority YES NO We conduct both types of audits -- traditional internal controls and lease and concession audits. Internal Audit is independent of management and reports to the Board of Directors. Niagara Frontier Transportation Authority (NFTA) YES NO All auditors share in the types of audits that we do. YES Our Audit Department is organized by major types of audits. We have the following 8 divisions within Internal Audit. Construction Audits, Coporate Audits, Information Systems & Technology Audits, Mainytenance & Service Agreements Audits, Operational Audits Percentage Agreements Audits, NO. We have one Audit Revenue Audits, and World Trade Audits. All auditors reveiw Group with various work internal controls applicable to their audits. However, the more groups within it. traditional agency-wide internal controls is conducted by the Corporate Audits divsion. We are independent from management. We report directly to the Port authority's Inspector General and have a dotted line to the Audit Committee. We average approx. 10-13 auditors per airport. Port of Oakland - Port Authority YES No. We have one Audit Group. Some audit staff The Audit Department reports directly to the Board. concentrate on lease and concession audits Port of Portland - Port Authority YES Port Authority of New York & New Jersey (JFK, Newark, and LaGuardia airports etc.) NO We conduct both types of audits. We also have a seaport that we audit as well. Audit staff conducts all types of audits. 3/4 Survey Results September 2011 Internal Audit Department Organization and Types of Audits conducted Internal Audit Department * = Port Authorities Question # 1. Does your internal audit group audit both the traditional organization internal controls and ALSO audit lease and concession contract compliance? Question # 2. Does your oganization have two separate and distinct audit groups? One for the traditional internal controls and another group for lease and concession audits? Port of Seattle - Port Authority YES NO Raleigh-Durham Airport Authority YES NO Reno-Tahoe Airport Authority YES NO Salt Lake City Intenational Airport YES NO San Diego County Regional Airport Authority YES NO San Antonio Airport System YES NO Spokane International Airport YES NO Tucson Airport Authority YES NO Wayne County Airport Authority (WCAA) in Detroit YES NO Other Comments The authority is comprised of an airport, seaport, and real estate. Internal Audit Department reports to the Audit Committee and administratively to the CEO. We have one audit group that conducts both audits - process ( internal controls) audits, and compliance audits that include lease and concessions. We conduct both types of audits, but one auditor is specialized in auditing parking revenue. For a long time, the focus of our audit function was contract compliance, but we have transformed to internal controls, now conducting both types of audits. Our audit group performs audit of airport Internal Control Processes, Leases & Concessions, Contract Payments, and Construction Activitity. Our group performs both types of audits We conduct both internal controls, and lease and concession audits. Internal Audit is independent of management. We report to the Board through the Audit Council. We conduct both internal controls and lease concession audits. We also outsource some of our audits to private CPAs when needed. 39 4/4