Glendale audit committee reviews internal audit report citing documentation gaps in workers’ compensation settlements and minor PCI exceptions

Natalie Manami Valdivia, principal internal auditor for the City of Glendale, presented the internal audit quarterly activity report for the quarter ended March 31, 2025, to the Glendale Audit Committee at a special meeting on May 27, 2025.

The audit covered two completed projects—the workers’ compensation disability settlement process and a Payment Card Industry Data Security Standards (PCI DSS) compliance review—plus continuous audits of procurement card activity and user access, an in-progress take-home-vehicle audit, outstanding follow-ups, and staffing transitions. Auditors recommended clearer settlement documentation, closer contract oversight of the city’s third‑party administrator (TPA), establishment of KPIs, recovery of a small overbilling, and periodic reviews of PCI procedures and training.

Valdivia opened the presentation by telling the committee she would “walk you through each of the 7 sections of our internal audit quarterly activity report, starting with the projects completed.” Senior internal auditor Ani Antonacion (presented in the meeting as the lead on the workers’ compensation review) summarized the disability‑settlement audit and its findings. “The focus of this audit was specifically on the disability settlement, not the entirety of the workers’ compensation process,” Antonacion said, and described how settlements are documented and authorized in the city’s process.

The workers’ compensation audit reviewed 280 settled claims from Oct. 1, 2019, through Sept. 30, 2024. Auditors reported that annual settlement costs in the review period generally ranged “around $1,000,000 to about $1,500,000” and that the sample review of settlement authorization reports (SARs) found six improvement opportunities across four categories: quality control, contract compliance, invoicing/penalties, and KPIs/policy updates. Key recommendations included creating a reference guide to source documents so SAR conclusions can be substantiated more quickly; ensuring final permanent disability ratings are tied clearly to the underlying whole person impairment (WPI) medical basis in the SAR; documenting any deviations between negotiated settlement amounts and actual payouts in the claim file; and working with the TPA to ensure the TPA's SARs include required elements (amounts paid, reserves, and a pros/cons analysis).

Auditors reported that their work on the SARs was time‑consuming—one committee member noted the audit took 667 hours to complete—and that the city pays its third‑party administrator about $80,000 per month for claims management. Natalie Valdivia summarized the invoicing findings and recommended more systematic analytical review of TPA invoices, earlier notification when a claim’s status changes to indemnity (which increases billing rates), and pursuing refunds for an identified small overbilling related to self‑imposed penalties.

On PCI compliance, internal audit reported site visits to six payment‑processing locations and review of the city’s PCI tracking and calendar tasks. Valdivia explained the basics of PCI DSS and why the city must comply, noting that the standards “are set by the 5 major credit card brands” and that noncompliance can lead to fines or loss of card acceptance. The audit found three sites with exceptions related to periodic tamper‑seal reviews or missing training dates; those exceptions were remediated by departments after discovery. The auditors also completed a gap analysis against new PCI DSS requirements and plan system reviews in later audits.

Continuous auditing activity included a user‑access comparison (active employees vs. enabled Active Directory users) that, as of a Feb. 24, 2025 point‑in‑time review, showed no enabled accounts for separated employees. A procurement‑card (P‑card) continuous audit examined 8,133 transactions totaling just over $2 million (Oct. 1, 2023–Mar. 31, 2024) and found 10 split‑payment exceptions—instances where single purchases appeared split to stay within single‑purchase limits; auditors concluded the identified charges were legitimate and recommended management either increase cardholder limits when justified or require purchase orders or higher‑limit approvers for those purchases.

The report also listed one project in progress—a take‑home vehicle audit being finalized by Daniel Mitchell, the city’s newly hired internal auditor—and noted 23 outstanding audit items remained as of March 31, 2025. Valdivia told the committee that there were no outstanding priority‑1 items for the quarter and that three categories in the city’s follow‑up resolution would trigger director attendance if items remained unimplemented for specified time frames; none applied this quarter.

During committee comments the internal audit staff acknowledged personnel transitions: the committee and audit staff recognized outgoing senior internal auditor Annie (Annie/"Ani" referenced in the presentation) and welcomed new auditor Daniel Mitchell. Paula Adams, chief human resources officer, and Dania Portillo, workers’ compensation administrator, were identified in the meeting as department contacts who assisted auditors and were present to answer questions.

Committee members asked follow‑up questions about the 2020 spike in claims (auditors said most 2020 claims were non‑COVID), whether the city’s PCI device tamper inspections examine physical seals daily (auditors described daily or scheduled seal checks logged by staff), and how procurement‑card exceptions are handled (auditors said exceptions were routed to cardholder approvers and department heads for corrective reminders or limit adjustments).

Next steps identified in the meeting: pursue reimbursement for identified overbilling; work with the TPA to improve SAR content and contract compliance; implement the recommended KPIs and update the city’s administrative policy references for workers’ compensation; complete the take‑home vehicle audit and present it to the audit committee at the July 30, 2025 meeting; and continue PCI system reviews and monitoring tasks throughout the year.

The meeting adjourned after a motion and second; the committee recorded a roll call before closing.