City finance director presents internal‑control audit; consultant recommends inventory, purchasing and fuel controls

Lee’s Summit finance staff and an outside consultant presented the results of an internal control and fraud‑risk vulnerability study during the council meeting, describing both strengths and steps the city could take to reduce vulnerability to theft or manipulation.

Brianna Bericher, the city’s director of finance, introduced the presentation and said the audit — conducted by 60 Fifth North Group at the city manager’s request — reviewed internal controls across departments. David Ross, president and CEO of 60 Fifth North Group, told the council the engagement focused not on detecting existing fraud but on where the city could be vulnerable and how to reduce opportunities to exploit weaknesses.

“We are not looking for fraud within operations. We’re looking to where the organization could be vulnerable to fraud,” Ross said, explaining that annual external financial audits typically do not examine operational internal‑control vulnerabilities. He listed areas of special attention, including vendor payment processes, purchasing operations, inventory management, fuel use, payroll and permitting.

Ross praised several controls already in place: the city’s use of payee positive‑pay for checks, vendor verification procedures, a professional fuel management system and an anonymous reporting mechanism. At the same time, he identified higher‑risk areas and practical mitigations: perform regular physical verification of inventory, conduct fuel‑use analytics, require physical verification for selected purchases, tighten controls on how vendor banking and address information is updated, and restrict software permissions so clerks cannot both receive payments and alter records without a second approver.

Ross gave real‑world examples of schemes common in local governments, including off‑book schemes where payments are collected but records are altered, and purchasing schemes where legitimate line items can be diverted to resale. He stressed the role of deterrence and said that reducing opportunity — including using permissioned ERP settings — can be the most effective safeguard. The consultant noted the city is implementing Workday, which he said offers granular permission controls that can reduce many software‑related risks.

Councilmembers asked detailed questions about the most common types of schemes, software controls and whether staff interviews and department‑by‑department testing were part of the review. Ross and Bericher said the audit included interviews across departments, on‑site work and data analytics; the deliverable will be a gap analysis and a prioritized, phased implementation plan with recommendations for near‑term “low‑hanging fruit” items and longer‑term controls.

Council discussion focused on deterrence, the value of employee reporting and whistleblower processes, and the city’s Workday implementation as a tool to remove manual data entry and improve permission controls. Bericher and Ross said some measures could be implemented in the current fiscal year and that the prioritized plan will help staff address the highest‑risk items first.