Spring City review of fraud-risk assessment spotlights controls, scheduling of extra budget work session

The Spring City City Council received a staff-led fraud-risk training on May 28 that emphasized documentation the state auditor will expect and highlighted several areas for updated procedures and formal policy language.

The staff member leading the session said the online training runs about an hour and yields a certificate, and told the council that “the auditor… needs to have minutes showing that you guys have gone through it,” meaning the city must record its review of the fraud-risk assessment in council minutes and retain certificates on file. Council members and staff discussed which parts of the training applied to the governing body versus operational staff.

Why it matters: the training is tied to annual audit checks by the state auditor and is tied to several administrative practices — including ethics statements, conflict-of-interest disclosures and written purchasing rules — that auditors typically request when they examine municipal records.

Staff outlined specific control gaps and mitigation steps the city should formalize. The staff member said the city currently “does not have a CPA,” noting that lack as a scoreable gap on the assessment, and said a member of the management team holds a bachelor’s degree in accounting; staff committed to filing a copy of that credential with audit records. Council members discussed whether the absence of an on-staff CPA should change auditing practices or be addressed through contracts or external reviews.

On cash and receipts, staff said utility payments occasionally arrive in cash and that deposits are taken nightly, but recommended adopting a written cash-receiving policy and stronger dual-count and sealing procedures to reduce risk. Staff described current mitigation: an external vendor (named Flores) and the city’s software provider reconcile accounts and flag anomalies, and staff said they ask signers to initial spreadsheets to confirm direct-deposit and deposit activity.

Procurement and card controls also drew attention. Staff explained that the city uses purchase orders and that purchase orders are required for purchases of $500 or more, and said credit cards are linked to a single account with a combined monthly limit of about $44,500. To limit risk, staff described weekly or per-cycle reconciliation of card statements against invoices and purchase orders before council members review bills.

Staff also described annual compliance steps: an annual data-privacy training (an approximately eight-minute video) for employees who handle sensitive data, routine conflict-of-interest disclosures, and an ethics statement for employees and elected officials. Staff said they would update personnel and IT policy language where needed to reflect these practices.

On next steps, staff said they will prepare the fraud-risk assessment form for formal sign-off and asked whether the council wants an additional work meeting to review the proposed budget ahead of formal hearings. “If you guys would like to have another work meeting to go over the proposed budget before it is approved, then we need to let [the budget advisor] know, and then he’ll give us some dates,” the staff member said. Staff reminded members that the certified tax rate must be submitted by the 20th and that the city typically schedules public hearings in June for both proposed and amended budgets.

No formal motions or votes were recorded in the transcript; staff said they will collect certificates and related documentation for the auditor and will prepare the assessment form for approval at the next council meeting.