Internal Audit

Many City and Hartford Public Schools (HPS) departments and operations are responsible for receiving and processing cash and/or checks.  It is important to make sure that money received is adequately controlled, accurately accounted for and promptly deposited in a designated City or HPS bank account and recorded in the Financial Management System so that the Treasurer’s Office can maximize the amount of City funds available for investment and meet daily payment obligations. Failure to adequately control and promptly record and deposit cash and checks can result in the misplacement or misappropriation of funds and/or lost revenues including investment income. The following are some key controls regarding cash receipt processing.

• There should be an adequate segregation or separation of duties over related processes. One individual should not be responsible for all aspects of the cash receipt process (receiving, recording, depositing and reconciling).
• There should be a control mechanism including budgets and accounts receivable ledgers in place to make sure that the City and HPS receive all monies due. Any differences between amounts expected and received should be identified and investigated.
• Cash and checks received should be immediately recorded in a log, cash register or a similar means of control.
• Checks received should be restrictively endorsed immediately upon receipt with a stamp indicating that they are for deposit only to a designated City or HPS bank account.
• When dealing with the public, receipts should be issued as documentation in support of all transactions paid with cash or check. Ideally cash registers should be used to record payments and receipts generated to support the transactions. Where cash registers are not available, pre-numbered, multi-ply receipt forms should be used with one copy going to the customer and one copy retained by the operation.
• Ideally, cash and checks received should be deposited the same day whenever possible. Any cash or checks not deposited the same day should be maintained in a securely locked location with limited access until deposited.
• Records (logs, adding machine tapes, cash register tapes) of cash and checks received should be reconciled to the related transactions that generated the receipts. For instance, if ten fishing licenses are issued, there should be cash and checks equal to ten times the license fee.
• Cash and checks should be separately accounted for and reconciled to related cash register or system control totals where possible.
• After receipts have been counted, reconciled to control totals and deposited, a report of receipt must be completed and recorded immediately in the Financial Management System.
• There should be designated custodians responsible for cash and checks in each operation. Whenever cash and checks are transferred from the custodian to another responsible person or entity the cash and checks should be recounted and the dollar amount transferred signed off on by the two involved parties.
• Records of cash and checks received should be independently reconciled between the control source such as the cash register, the bank deposit and the report of receipt to ensure that they have been properly accounted for throughout the cycle.
• Cash processing policies, procedures and controls should be documented for each operation or unit responsible for handling cash receipts.
• Department management should periodically verify that cash processing policies, procedures and controls are being followed as required.

All of these conditions may not apply to your particular operation. If you have any questions or concerns regarding cash controls in your operation contact Internal Audit, the Finance Department or the Treasurer’s Office.

System and Application access capabilities are designed to allow users to log on to a system and/or application to perform functions or tasks necessary for them to do their jobs. There are varying degrees of access that can be granted to users from inquiry only to the ability to update and change system and application programs and data. By not adequately administering and controlling system security and access capabilities, system and application programs and data can be compromised and inappropriate transactions can be processed. System and application owners should develop and implement policies and procedures and adequately train users to ensure that system and application security and access controls are adequate. The following are general guidelines to follow to help in this regard.

1. System users should be trained to secure their access identifications (IDs) and passwords. They should not be written down and left in a location that that is not properly secured. MOST IMPORTANTLY, ACCESS IDS AND PASSWORDS SHOULD NEVER BE SHARED WITH OR USED BY OTHER EMPLOYEES.
2. Individual access IDs and passwords should be unique to the user and should be unusual enough so that others cannot guess what a user's access ID or password may be. For instance do not use your name or the name of a child, telephone extensions, initials, birth dates or other commonly known information. Ideally, access IDs should be at least four digits long and contain both alpha and numeric characters.
3. When users are first granted access to a system or application or when a system or application is upgraded, system administrators may assign users generic passwords.For instance, an administrator may give a new user with the name John C. Doe an ID of JCD1 and will assign them the same password. When Financial Management Systems upgraded, users maybe assigned "password" as their password. Users should change these generic passwords to unique self-assigned passwords immediately.
4. Each user should have only one ID and password. We have noted instances where certain users have two or more IDs and/or passwords.This is redundant and unnecessary and can cause problems with administering and controlling system and application access.
5. When systems or applications are being developed and implemented or upgraded, it is not unusual to provide programmers and consultants with access capabilities that allow them to perform most if not all functions. It is important that the access IDs and passwords for these individuals are terminated prior to putting the system, application or upgrade into production.
6. Throughout the City and the Hartford Public School System (HPSS), employees are regularly being hired, retiring or changing positions and/or responsibilities. It is imperative that, when these employee changes occur, system owners determine the extent of any related changes that are required to access IDs and passwords. When an employee retires or is no longer employed by the City or HPSS all of their access IDs and passwords should be immediately deactivated in all systems and/or applications.In addition, when an employee changes jobs or responsibilities, system owners need to determine if they still need the same access capabilities in their new position and make changes as deemed appropriate. In certain instances, the responsibility for system security administration is shared with the system owner and Metro Hartford Information Services (MHIS). In addition, the Personnel department regularly notifies MHIS of personnel changes including new hires, terminations and moves. It is very important that both MHIS and system owners are notified of any and all employee changes in a timely manner so they can update system security and access accordingly.
7. Many systems and applications have options that provide a certain level of control over access IDs and passwords. These options should be utilized to the greatest extent possible. Some of these options are as follows:
   1. A requirement that users periodically change their passwords. Many systems and applications automatically require users to change their passwords at least annually.A certain amount of time is allowed by the system for users to go in and change their passwords. When passwords are not changed as required, the system may automatically disable the password thereby terminating the user's access to the system or application. If the system or application does not have this option then the system owner should encourage users to change their passwords periodically.
   2. An option that will automatically disable user IDs and passwords if not used for a predetermined period of time. If the system does no do this automatically, then the system administrator should monitor use and delete or change access capabilities as deemed necessary.
   3. The ability to disable a user's access ID and/or password after someone has tried unsuccessfully three or more times to enter a password.

8. Two individuals should be trained to be able to administer system security and access capabilities for each system or application.

To ensure the integrity of the City's/HPSS's systems, applications, programs and data is maintained, it is imperative that system and application owners develop, implement and maintain adequate policies, procedures and controls regarding system security and access.

If you have any questions or concerns regarding security and access controls for any system or application please contact Internal 

The City of Hartford Municipal code, Section 2-41 establishes the Internal Audit Commission and grants authority to the Internal Audit Department as follows:

Sec. 2-41. - Internal audit commission.

(a) Established. There shall be an internal audit commission.

(b) Purpose, responsibility, and authority. The commission shall conduct independent examinations and evaluations of city financial activities to assure the integrity, efficiency, and efficacy of the government of the city, including the board of education. Such examinations and evaluations may involve investigations of accounting irregularities, mismanagement or fraud and such independent staff, consultants and counsel necessary to achieve the purposes of the Charter. The commission shall direct staff and consultants of the internal audit unit established pursuant to section 2-41.1 of this Code. The commission shall give due consideration to requests from the council or any member thereof and from the mayor, in establishing and modifying the audit plan of the commission or the work plan of the staff of the internal audit unit. This shall not prevent the commission from giving due consideration to any complaint by any employee or citizen of the city with regard to use or misuse of city funds. In carrying out its duties, the commission, and the internal audit unit, acting pursuant to direction of the commission, shall perform activities such as, but not limited to, the following:

(1) Ascertaining the extent of compliance with established policies, plans, procedures and legal requirements;

(2) Reviewing and appraising the soundness, adequacy and application of accounting, financial, operating and systems controls;

(3) Ascertaining the extent to which city assets are accounted for and safeguarded from losses of all kinds; and

(4) Ascertaining the reliability of management data developed within the city departments and offices and the board of education.

(c) Membership.

(1) The commission shall consist of three (3) members, no more than two (2) of whom are members of the same political party. Each member of the commission shall have professional or equivalent experience in at least one (1) of the following fields; accounting, management, or financial analysis. As to issue of politically partisan activities or financial matters, members of the commission will be subject to the same requirements as members of the ethics commission of the city.

(2) No member shall:

a. Hold or campaign for public office;

b. Have held or been a candidate for public office during the three-year period prior to appointment;

c. Hold office in any political party or political committee;

d. Be a city employee;

e. Employ or be employed as a person required to register as a lobbyist.

(3) The membership of the commission shall be as follows:

a. One (1) member of the commission shall be appointed by majority vote of the council;

b. One (1) member of the commission shall be appointed by the city treasurer; and

c. One (1) member of the commission shall be appointed by majority vote of the council from the two (2) individuals nominated by the owners of taxable property who are the ten (10) highest-paying taxpayers (hereinafter referred to as "certified tax payers") in the city as determined by the most recent grand list, as certified by the city assessor.

(4) Each member shall comply with the Code of Ethics as set forth in Chapter 2, Article XIX of the Municipal Code.

(d) Nomination of taxpayer member. The city assessor shall ask the certified tax payers to convene for the purpose of nominating the two (2) individuals to be presented to the council, one (1) of whom shall be appointed by the council to the internal audit commission, as described in subsection (c)(3)c. of this section. The certified taxpayers shall forthwith nominate the two (2) individuals and forward the nominations to the council.

(e) Term of office.

(1)    a. The member first appointed by a majority vote of the council, as specified in subsection (c)(3)a. shall serve a four-year term.

b. The member first appointed by the city treasurer, as specified in section (c)(3)b. of this section, shall serve a three-year term.

c. The member first appointed by the council, in accordance with subsection (c)(3)c. of this section shall serve a two-year term.

(2) On and after January 1, 2006, members appointed to the commission shall serve a term of four (4) years beginning January 1 and expiring after December 31 of each fourth year after January 1, 2006. A member of the commission whose term has expired shall serve on the commission until the successor of the member has been appointed. Commissioners may serve multiple terms.

(f) Chair. The members of the commission shall elect one (1) of its members to serve as chair.

(g) Residency requirement. The residency requirements of Chapter VII, section 1(e) of the Charter do not apply to members of the commission.

(h) Vacancy. In the event of a vacancy on the commission a successor may be appointed for the unexpired term of office by the appointing authority of the member whose position is vacant. If the vacancy is in the position of taxpayer member appointed pursuant to the provisions of subsection (c)(3)c. of this section, the council shall appoint the member from a new list of two (2) nominees created pursuant to the provisions of subsection (d) of this section.

(i) Removal. The appointing authority of commission members may initiate proceedings to remove a member of the commission for any of the following reasons:

(1) Misconduct in the performance of duties;

(2) Persistent absence;

(3) Conviction of a felony;

(4) Conviction of a misdemeanor that would undermine the public confidence in the member's ability to perform the duties of office;

(5) Appointment or election as an officer or employee of the city.

Seven votes of the council shall be required to remove a member of the commission. The procedure for such removal will be in accordance with the relevant language of Chapter IV, Section III, paragraph "a" of the Hartford City Charter.

(j) Meetings. The internal audit commission shall meet as often as it deems necessary, but at least once each quarter. The business of the internal audit commission shall be recorded in official minutes, which shall be "public documents" within the meaning of the Freedom of Information Act of the State of Connecticut. The said meeting minutes shall be filed with the town and city clerk within two (2) weeks following each meeting. Staff of the internal audit unit, established pursuant to the provisions of section 2-41.1 of the Code, shall serve as staff to the commission and shall record the minutes of the internal audit commission at each meeting.

(k) Annual internal audit budget. The internal audit commission shall adopt and forward to the mayor, in accordance with the procedures and timetable established for other city departments, a proposed annual budget. Unless the commission requests a smaller amount, the mayor's budget shall include, and the council shall appropriate, for support of the internal audit commission and internal audit unit at least the amount necessary to maintain the staffing and the operating expenses of the unit as approved in the previous annual budget.

(l) Audit plan, procedures, and reports. The commission shall prepare an annual audit plan; prepare and submit to council a quarterly activities report each July first, October first, January first, and April first; and establish standard operating procedures for the commission and the internal audit unit. Any employee of the city, the head of a department, agency, or office, and any city officer cited in an internal audit report shall provide a written response to any inquiry from the internal audit unit made on behalf of the internal audit commission. All reports of the commission and unit, including responses thereto, shall be public and shall be submitted to the appointing authorities and to the mayor.

(m) Compensation. No member of the commission shall receive compensation for services as a member of the commission, nor shall any member of the commission be deemed to be either an employee of the city for purposes of pension credit, or a member of the city municipal employees' retirement fund.

(Ord. No. 11-04, 7-6-04; Ord. No. 11-13, 11-25-13)

Editor's note—  Ord. No. 11-04, adopted July 6, 2004, repealed former § 2-41 of the Code, which pertained to the internal audit unit and derived from the 1977 Code, § 2-39, and Ord. No. 9-83, §§ 1—4, adopted Feb. 28, 1983. In addition, Ord. No. 11-04 added new provisions to the Code as §§ 2-42, 2-43; as other provisions already existed within the Code as § 2-43, said provisions of Ord. No. 11-04 have been redesignated as §§ 2-41, 2-41.1 at the editor's discretion.

Charter reference—  Internal audit commission, Ch. VII, § 2(a).

Cross reference—  City finances, § 2-481 et seq. 
  
Sec. 2-41.1. - Internal audit unit.

(a) Established. There shall be an internal audit unit which shall be a department of the City of Hartford. The unit shall provide staff to, and shall report to and be under the direction of, the internal audit commission. The unit shall discharge the responsibilities of the internal audit commission as directed by the commission. The unit shall have full access to all records, property and personnel of all city departments and offices and those of the board of education in the performance of its duties. The unit shall discharge its responsibilities in a manner consistent with the code of ethics of the institute of internal auditors.

(b) Head of unit. The head of the internal audit unit shall be the chief auditor, who shall be appointed by the commission. The chief auditor shall be a member of the classified service, shall be certified as an internal auditor or fraud examiner, and shall have an advanced degree in accounting, business administration, public administration, or law. The chief auditor shall be administratively responsible for the operation of the internal audit unit and shall make recommendations to the commission concerning appointments to the unit, promotions within the unit, and the salary, within adopted salary schedules, for each employee of the unit. Additionally, the head of the internal audit unit shall be responsible for the timely filing of internal audit commission minutes with the town and city clerk, in accordance with subsection 2-41(j).

(c) Staff. The internal audit unit shall have such staff as shall be approved by the council in adoption of the annual budget, as recommended by the commission, subject to the provision of subsection 2-41(k). Staff of the internal audit unit shall be members of the classified service and, subject to the rules of the classified service, shall be appointed and may be removed by the chief auditor.

(d) Consultants. In accordance with Chapter VII, Section 2(a)(3) of the Charter, the commission and the internal audit unit may retain such consultants for the purpose of conducting the examinations and evaluations required by the Charter and this Code. Such consultants may include, but not be limited to, accounting professionals, legal counsel, financial advisors, information technology consultants or criminal investigators as deemed necessary and appropriate.

(e) Counsel to the internal audit commission and internal audit unit. In accordance with Chapter VII, Section 2(a) and (b) and Chapter VIII, Section 3(b)(1)(i) of the Charter, the commission and the internal audit unit may retain counsel for the purpose of providing legal advice necessary to conduct the independent examinations into all matters relating to the integrity, efficiency and efficacy of the government of the city, including the board of education. Notwithstanding any provisions otherwise set forth in this Code or by resolution regarding the role of the Corporation Counsel with regard to the (1) representation of the commission and the internal audit unit and (2) selection and retention of counsel, the commission is hereby authorized to retain counsel in accordance with Chapter VIII, Section 3(b)(1)(i) of the Charter. Said Counsel shall be an attorney of good standing in the State of Connecticut for a period of not less than ten (10) years or a reputable firm.

(Ord. No. 11-04, 7-6-04; Ord. No. 11-13, 11-25-13)

Charter reference—  Internal audit unit, Ch. VII, § 2(a)(3).

Note—  See the editor's note following § 2-41. 

Financial Accountability is a top priority for the City of Hartford. With this goal in mind we have created a Fraud Hotline that can be used to report information about fraud, waste, or abuse of resources in governmental agencies including, but not limited to, the City of Hartford, the Hartford Public School System, the Hartford Parking Authority and the Hartford Public Library.  If you wish to report known or suspected wrongdoing  you can contact us in one of three ways:

Phone:(860) 757-9957
E-mail: FraudHotline@hartford.gov
U.S. Mail: 550 Main Street | Room 304 | Hartford, CT | 06103

When contacting us, please provide as many details as possible about the situation.  The more information you provide, the better we will be able to address any concerns you may have.  If you desire, you can remain anonymous and your identity will be held in the strictest confidence.

Thank you for your cooperation and interest in the welfare of the City of Hartford.

What is an Audit?

Webster's dictionary describes an audit as "a formal examination and verification of financial accounts." The Internal Audit Department is responsible for reviewing all financial books, records, operations and activities of an organization. It is our responsibility to determine that policies and procedures are being followed and to report any deviations to the City Council and the Mayor. Internal auditors are a form of internal control - a form that functions by evaluating other forms of internal control. It is the job of Internal Audit to be certain that necessary controls are in place and working effectively.

In order to accomplish this objective, the nature of some audits require the element of "surprise". By the term surprise, we mean that auditors need to verify critical records before there is an opportunity to alter, make extractions, insert data, or change activity that was not there before the auditors arrived. Records that are usually examined on a surprise basis are cash funds, accounting records, employee records, observation of standard operating activities, and certain inventory records. This will help to identify potential problems and provide the opportunity to correct and improve them.

With every audit, we strive to add value, cover risk and develop people. The goal is to provide timely, reliable and relevant information and to accomplish this we feel communication is essential. Auditors provide a medium for establishing contact between all levels of employees and can give proper attention to employee problems, suggestions and ideas.

It is important to view an audit as an opportunity to discuss with the Internal Audit Department what you feel is working well within your area and what may not be. By working together we can deliver balanced assurance - to point out where the controls are functioning effectively and where the areas of considerable risk lie.

What is meant by internal control?

Internal controls are processes put in place by management and staff in order to effectively administer a specific program and achieve its goals. Internal controls may be rules or procedures; for example, certain steps must be followed in issuing a payroll check. Internal controls may also be informal, for example, you may control access to administrative records by locking them in a file drawer.

Internal controls are designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

1. Effectiveness and efficiency of operations.
2. Reliability of financial data and reporting.
3. Compliance with applicable laws and regulations.

What is the process when an audit is performed?

The most successful audit projects are those in which the unit being audited and the Internal Audit Department have a constructive working relationship. Our objective is to have your continuing involvement as well as communication at every stage, so that you understand what we are doing and why we are doing it. Every audit project is unique. However, there are similarities in the process auditors use. In most audits, the process consists of the following stages:

1. Obtain an understanding of the area under audit by reviewing:
   • Policy
   • Administrative Regulations
   • Other authoritative sources
2. Develop an internal control analysis/questionnaire based on review of the above and/or administration's assertion.
3. Develop fieldwork activities.
   • Request specific information from auditee.
   • Interview appropriate staff.
   • Test selected data.
   • Verify information.
   • Verify procedures.
   • Verify compliance.
   • Perform exit interview with auditee.
4. Provide preliminary draft report/status report to auditee.
5. Submit final report to the City Manager and City Council

Chief Auditor

Craig S. Trujillo, CPA
Phone:(860) 757-9952
Email: trujc001@hartford.gov

Craig Stephen Trujillo is a graduate of LaSalle University in Philadelphia, Pennsylvania and is a Certified Public Accountant. He is a member of the National and South East New England Institute of Internal Auditors and the American Institute of Certified Public Accountants. He joined the Insurance Internal Auditors Group (IIAG) in 1985 and was president in 1998. Craig has held several chair positions on the Board of Directors and is currently the Vice President Secretary.

Craig started his career in Public Accounting and after four years joined the Internal Audit Department of the Insurance Company of North America, now CIGNA Corporation. Covering over 20 years with CIGNA in Philadelphia, Craig was responsible for all financial and operational audits of Domestic Property & Casualty, International Operations (over 30 countries, managing an audit staff in Philadelphia, London, Brussels, Tokyo, Bogota, Los Angeles and Miami), including fraud investigations, Life and Employee Benefits, Special Risk, Marine & Aviation, Bonds, Information Technology and various Marketing and Sales functions. In 1996, He relocated to Simsbury Connecticut with his wife and two sons and headed up the Internal Audit Management Team for the CIGNA Healthcare Operations.

In 1998, Craig retired from CIGNA and joined the Phoenix Life Insurance Company internal audit department in Hartford Connecticut as Assistant Vice President. He was responsible for the Phoenix's International, Reinsurance and various operational and financial audits and special projects. He was the lead audit investigator related to the insurance industry’s largest worker’s compensation reinsurance fraud perpetrated in Bermuda and Chicago. He was the Process Improvement Coordinator for the Finance Division and was a key team member that implemented Sarbanes Oxley compliance.

In 2006 and early 2007 Craig worked for a National CPA firm and did some consulting work for Robert Half International in the International Banking, Manufacturing and domestic Retail and Energy sectors. In May of 2007, Craig assumed the position of Deputy Chief Auditor and in November 2017 he was appointed Chief Audit Executive for the City of Hartford, Connecticut responsible for all audits and special investigations related to all City operations including Fire, Police, Public Works, Health and Human Services, eight Public Libraries, the Hartford Public School District, and the Hartford Parking and Baseball Stadium Authorities.

Audit Commission Chair

Bruce Rubenstein

Auditor

Desmond Sinclair, CPA
Phone: (860) 757-9953
Email: DSinclair@hartford.gov

Desmond G. Sinclair is a licensed Certified Public Accountant with a Master Degree in Information Technology and a Bachelor Degree in Business Administration with concentration in Data Security and Accounting respectively.  

Desmond background provides a depth of knowledge and understanding of audits; accounting, financial statements analysis and compilation as well as data intrusion, detection and vulnerability testing that can assist and enhance the City process improvement endeavours.   

He is a Member of AICPA, CTCPA, IIA and IEEE and has held various positions within Public Accounting firms and Private industries. Desmond goal is to minimize financial risk while assisting in developing successful business models that can sustain the City of Hartford’s financial health.  

Jay Johnson, CPA

Phone: (860) 757-9954
Email: Jay.Johnson@hartford.gov

Jay Johnson is a graduate of the University of Massachusetts (BBA, major in accounting) and Western New England College (MBA). He became a licensed Certified Public Accountant in the Commonwealth of Massachusetts. He started his career in Public Accounting in the Hartford office of Price Waterhouse then spent many years with United Technologies Corporation in both audit and finance roles.

Donna L. Barberi, CIA, MSPA
Phone: (860) 757-9956
Email: Donna.Barberi@hartford.gov

Donna Barberi is a Certified Internal Auditor and a graduate of the University of Hartford with a Master of Science Degree in Professional Accounting and a Bachelor of Science Degree in Business Administration with a concentration in Accounting.

Donna started her Internal Auditing career at Fleet Bank in Hartford, Connecticut where she conducted financial, operational, and system audits on the Trust and Investment Services team. She also worked on the Fraud Team where she monitored and Investigated potential employee fraud transactions. Donna has also worked for a national CPA firm and most recently for UConn Health in Farmington, Connecticut as an Internal Auditor where she managed and performed operational, financial, and compliance audits for the quasi-state agency.

Phu-Loc Nguyen, CPA
Phone: (860) 757-99??
Email: phuloc.nguyen@hartford.gov

The Office holds an institutional membership in the Government Finance Officers Association of Connecticut (GFOA-CT) and the Association of Local Government Auditors (ALGA). All auditors are members of the Institute of Internal Auditors (IIA). Additionally, some auditors maintain personal memberships in the American Institute of Certified Public Accountants (AICPA), the Connecticut Society of Certified Public Accountants (CSCPA) and the Association of Certified Fraud Examiners (ACFE).

As members of these professional organizations we are required to adhere to certain professional standards and we are bound by their codes of ethics. We participate in professional development programs in an effort to maintain and improve our auditing proficiency and stay current with auditing and accounting issues. Many of the programs we attend are sponsored by these professional organizations. We are required to attend a minimum number of credit hours of continuing professional education each year.