East Point council hears forensic-audit findings; sheriff, DA notified and council finds conflict of interest

East Point — At a special Sept. 22 meeting, the East Point City Council heard a forensic audit presentation and discussed recommendations to tighten finance, procurement and cybersecurity controls after auditors and city staff identified multiple weaknesses, a phishing-related loss and vendors requiring follow-up.

Plant Moran forensic auditors summarized tests that flagged deleted vendor codes, payments recorded outside normal check or vendor processes, unlabeled capital assets and an approximately $1.5 million inventory write-down. City staff and the auditors said the matter includes possible criminal elements tied to a phishing scheme; the city manager reported the sheriff's office "has agreed to investigate and the district attorney should it merit has agreed to take up prosecution." The city manager and auditors said arrests have been made in the broader criminal investigation.

The findings matter because they prompted referrals to outside law enforcement and because they exposed internal-control gaps that auditors said allowed fraudulent payments and inconsistent recordkeeping. Council members questioned procurement steps for certain vendors and asked city staff for follow-up and documentation.

Plant Moran lead Michelle McHale described the team's role as narrowly forensic and evidence-focused: "We are fact finders," she told council. Her associate, Kyle Sutton, described a set of standard red-flag analytics used in such engagements — address matches between the employee and vendor master files, round-dollar invoices, sequential invoice numbers — and said the tests identified two vendors of particular interest.

Phishing incident, recoveries and cyber controls

Auditors and the city manager said the city experienced a phishing scheme that resulted in net losses after recoveries. City staff said law enforcement and cyber-insurance recoveries returned roughly $434,000 from law enforcement and about $200,000 from cyber insurance, for a combined recovery of approximately $634,000; the city manager characterized the net loss at roughly $585,000 after recoveries and reimbursements reported during the meeting. Staff said the incident exploited weaknesses in practice and communication rather than insider collusion; the auditors said their separate background checks and mapping did not identify city employees as perpetrators.

City Manager Jones said the city "has beefed up considerably our cyber security" and described new layers of email and endpoint protections, annual mandatory training tied to system access, and other bank-level verifications…