Security issues within Pima County’s finances last fiscal year included a fraudulent account used to steal nearly $43,000 from county taxpayers, a state audit revealed.
The Arizona Auditor General conducts yearly reviews of the county’s financial accounts and reports potential issues. For the fiscal year ending June 30, 2022, the county’s Report on Internal Control and on Compliance had three findings staff have developed action plans to fix.
Of those findings, the Auditor General reported a fraudulent account stole $42,739 from the county after the procurement department failed to obtain a tax form to change the account’s log-in credentials for an online money transfer service.
An employee within a county-contracted construction company sent procurement staff faulty bank routing information, and staff failed to verify the change over the phone, County Administrator Jan Lesher said.
Within the next two weeks after the initial transfer, the county approved two more money transfers to the account for $1.5 million and $2.5 million, but the fraudulent account’s bank detected the scam and canceled the transfer, according to the report.
The audit said the money was stolen in part because the procurement department “did not train its employees on required verification procedures to obtain an IRS W-9” and didn’t complete other verification measures to ensure the transfer was genuine. Lesher said the county did receive the proper tax form but didn’t verify the banking information changes with the company.
The Auditor General recommended the county conduct staff training on verification processes, require more forms of verification when resetting log-ins, and create a monitoring system within the self-service portal for vendors that work with the county.
Deputy Auditor General Melanie Chesney said the nature of the state-issued audits is to find “all those monies (that) could have just been at risk of being stolen.” Pima County’s audit, however, revealed “an unfortunate instance where the monies actually were stolen.”
“When public monies are stolen because public officials are not doing the things that they should be doing, that’s cause for concern, and of course, our auditing standards require us to report that in our public reports,” she said.
Lesher said, “we’ve now made sure that we have processes and checklists in place to ensure we don’t do that again.”
The report also outlined issues with previously reported news that former County Administrator Chuck Huckelberry submitted his retirement in July 2021 and returned to work to receive his regular salary on top of $12,228 in monthly pension benefits, unbeknownst to county residents and the Board of Supervisors. His regular salary totaled $114,110 from the date his retirement took effect on July 4, 2021, through his last paycheck issued on April 15, according to county payroll records.
The audit states the clandestine action left the board without “the opportunity to evaluate the operational impact on the County and the direction it may have wanted to go in light of the County Administrator’s closely-held retirement,” and also left the supervisors unaware Huckelberry would have to work less than 20 hours a week for half the year under his return-to-work status.
After learning about Huckelberry’s retirement, the board adopted a policy in May that any employee who plans to retire within the state retirement system and continue to work for the county must notify the board at least 90 days before the retirement date.
The third audit finding said the county failed to properly monitor a subrecipient of its federal money. Lesher said the subrecipient was the city of Tucson, which received $1.6 million of the county’s Emergency Food and Shelter National Board Program funds that provide assistance to asylum seekers.
The report said the county issued reimbursement requests to the city but failed to closely monitor Tucson’s spending of the federal monies as required for federal awards.
Lesher said the issue arose when Tucson went from being a contractor to a subrecipient, which triggered the need for closer monitoring. The contract outlining the new relationship began on July 1, 2022, even though the city was considered a subrecipient in June 2022.
“When we have a subrecipient, we are required to monitor, and we should because they are providing programmatic services as part of the contract,” Lesher said. “I am very comfortable and confident that the city adhered to the requirements for that one-month period for which they were providing the service.”
The county has contracted with a third-party agency to monitor subrecipient spending, according to the report.
“We are responsible for a great deal of the public’s money, and we strive to ensure that it is spent without any incidents of fraud. (The issues that) have been brought to our attention by the Auditor General have all been addressed,” Lesher said. “We have no sense that we have any concerns with those kinds of problems continuing.”