City Auditor outlines internal-audit strategy and launches overtime usage review

City Auditor Shakira presented the Office of the City Auditor(OCA) internal-audit strategy to the City of Norman Finance Committee on March 20, 2025, and said the office will begin a triennial overtime usage audit covering July 1, 2021, through June 30, 2024.

Shakira said the OCA's mission is to "add value for the city council and city management in advancing the city's objectives by providing an independent source of assurance and consulting services designed to improve performance." She told the committee the strategy follows global internal audit standards and is designed to align audit work with city priorities.

The audit office is currently one full-time auditor and the auditor described limited capacity: 1,600 available audit hours per year (4,800 hours across a three-year triennial period), which she said allows for about six audits over a triennial cycle. She said adding one auditor would roughly double capacity to 3,200 hours per year and allow about 12 audits in the same period.

Shakira described five broad goals for the OCA: make the office a preferred workplace; be a key resource for council and management; align audit work with city strategy; expand audit coverage; and improve industry standing. She outlined steps including targeted hiring when budgets permit, professional training and certifications (including encouraging Certified Fraud Examiner credentials), cross-training for specialized audits (IT, compliance, operations), and use of continuous-audit analytics.

On audit tools, Shakira said IT has approved the OCA's chosen case-management software but that contract negotiations remain with the city attorney's office. She also described a data-analytics approach that could use the city's ERP system or an external product called Third Line to detect anomalies and create dashboards for council oversight.

Shakira reported the office is in the final draft of a triennial audit plan and is in the pre-planning phase of the overtime usage audit; she said the pre-planning phase ends the day after the meeting and planning begins immediately thereafter. She described the overtime audit sample and selection criteria: employees paid overtime between July 1, 2021, and June 30, 2024; accounts where overtime expenditures exceeded 100% of the original budget; and any fiscal year with a deficit greater than $20,000. The audit will examine trends and departmental controls; departments identified for review included Fire, Parks and Recreation, Police and Utilities, and Shakira said some departments had deficits of more than $1 million across the three-year period.

She said two credit-card audits will run in parallel: a three-month credit-card usage audit and a three-month credit-card process audit; because they examine the same function, she plans to tie them together into a single report. The overtime usage audit work is scheduled to include walkthroughs and fieldwork with a target reporting window in Julyto August 2025 and follow-up thereafter.

Shakira also described quality-assurance steps required for public-sector audit functions: internal quality-assurance and improvement planning culminating in an external assessment no later than March 2027 (three years after the office's first engagement in March 2024). She said the OCA will provide routine updates to council and committees and develop a citywide fraud training program within six to eight months.

A finance committee member noted the overtime audit report was not listed on the meeting agenda and suggested taking the full report to next month's meeting; Shakira said she would bring the final triennial audit plan to the committee on Tuesday for consideration and would bring the audit charter to the full council for approval if there were no additional edits.

Next steps: Shakira will present a final draft of the triennial audit plan to the committee at a Tuesday meeting and will return to council with the audit charter for formal approval if the charter receives no additional edits from council members.