Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Internal Audit topic
No spam. Unsubscribe anytime.
Board accepts audit committee recommendations; IT vulnerability item closed unanimously, take‑home vehicle audit closed over policy objections
Summary
The Board accepted the audit committee’s recommendation to close two internal audit items: an IT vulnerability/penetration‑testing item (closed unanimously) and a take‑home vehicle assessment (closed 3–2). Supervisors raised concerns about the vehicle policy’s mileage/radius language and requested a separate policy discussion.
The Board of Supervisors voted to accept the audit committee’s recommendations on two internal audit matters and approved a fiscal year 2026 audit work program.
IT vulnerability audit
City staff and the audit committee recommended closing an April 2022 IT vulnerability and penetration‑testing audit because the city has implemented controls identified in the finding and is replacing the most at‑risk public‑safety communications system. Frank Abel, Carson City chief information officer, told the board the city placed the most critical systems into protected “padded cell” configurations and that the largest remaining system is being replaced. In response to board questions, Abel said it is preferable to run a fresh vulnerability/penetration test after the replacement is complete to produce a new clean baseline.
Supervisor Giomi moved to accept the audit committee’s recommendation on the IT item; the motion passed unanimously.
Take‑home vehicle assessment
The audit committee also recommended closing five findings from a take‑home vehicle assessment completed in October 2024 after departments adopted the recommended procedures, tracking sheets and policy language. The board voted 3–2 to approve the audit committee recommendation to close the findings (three yes votes, supervisors White and Horton opposed).
Supervisor White said he opposed closing the audit without further policy changes and raised concerns about language in the proposed policy that would permit take‑home vehicles within a 25‑mile radius; he argued response time (a 30‑minute trigger) and emergency‑responder status should be controlling factors instead of a fixed mileage radius. Supervisor Horton echoed the operational concern, saying a 25‑mile radius would be inappropriate for a compact jurisdiction and that construction/engineering standards for roads in wet areas (raised elsewhere in the meeting) should be carefully enforced in new developments.
Audit work program and procurement
The board also directed the internal auditor (Eide Bailly LLP) to proceed with the fiscal year 2026 audit work program, authorizing three major projects: credit‑card payment security and compliance, capital asset accounting, and a public guardian asset management review. The motion to proceed with the FY26 audit work program passed unanimously.
Next steps
City staff said they will schedule further, separate discussion on vehicle‑use policy specifics and noted the closed audit findings will be revisited if follow‑up testing shows remaining issues.
