Santa Barbara County Grand Jury Examines Embezzlement

Despite the forensic audit into former Public Works accountant Lynn Hogan’s ability to steal $2.1 million from the county over 10 years, the Grand Jury report released last week indicates it could happen again, easily. Auditor-Controller Theo Fallati disagrees. Fallati said that after the embezzlement was discovered, his team met with all department heads to go over the countywide policies on financial internal controls. They’ve also been meeting every quarter since with the chief financial officers of the county’s 26 departments for updates on the financial information system, known as FIN, and discussions of any issues that arise.

In particular, the Grand Jury was concerned that the county had no requirement to change passwords periodically for FIN and that no second signature was needed when creating a temporary vendor to issue checks — which is how Hogan stole $1.7 million. Among numerous faults, it noted only 2.5 persons existed in the five-person internal audit division, the finance software fell short in many ways — in chief a lack of accounts receivable and accounts payable systems in it — and that those shortcomings caused duplication of effort among the many county departments. Department accounting personnel seemed unaware of important rules, and changes to FIN weren’t communicated completely.

Fallati replied that the password problem had been fixed; additionally, stronger, more hacker-proof passwords — that weren’t shared — were explained to managers. Approval by a second financial officer was required for temporary vendor checks almost immediately after Hogan’s thefts were discovered. The problem in the Lynn Hogan case was, in Fallati’s eyes, that so much trust had been placed in her and she was so willing to abuse it.

“The same person who takes checks in,” Fallati said, “shouldn’t reconcile bank accounts and write checks out.” And it’s as much management’s duty to be responsible for financial oversight, Fallati said, as making sure the doors were locked at night, the county’s property safeguarded. Using knowledge gained during 30 years as a Public Works accountant, Hogan, in many instances, had created project deposits in certain funds — like the Surveyor Deposit Trust — falsified charges for work on the project, then given the remainder to herself or her eight confederates as a temporary vendor being refunded. Hogan and four others have pleaded guilty so far.

Of the lack of personnel in the internal audit office, Fallati noted the department had 10 people in 2008 when the Great Recession hit. “Internal audit is half its size,” Fallati acknowledged. “Given the county’s situation, expansion was off the table [during the last budget cycle]. If it came down to another custody deputy or an internal auditor, which would you choose?”

The county’s average revenue since 2015 has been about $900 million. Taxes comprise about 33 percent of it, service charges about 27 percent, and grants about 40 percent. The Grand Jury worried that property tax fraud might be ripe through property tax reimbursements. For instance, homes either destroyed or devalued in the Thomas Fire and mudflow were likely re-assessed, and a refund based on the new property tax amount issued to the owner — using the “temporary vendor” number to issue the check.

“Property tax is exactly an example of a one-off refund,” said Fallati. Unlike the Grand Jury, Fallati viewed the one-time vendor number as appropriately assigned to those receiving a refund. After the property was re-assessed, next year’s tax valuation would reflect the re-assessment. No second refund would be necessary, no warrant — county lingo for a check — would need to be issued.

Much of the Grand Jury report concerned the Auditor-Controller Office’s financial information network, or FIN, and what it lacked. The report suggested that an “enterprise resource planning” system, or ERP, should be considered in its place. Swapping FIN for ERP could be done, Fallati said, with an audible shrug in his voice, but Marin County just spent $30 million on an ERP system that failed. The county’s FIN is unique, developed in the 1990s by four employees and upgraded over the years from a mainframe, to servers, and now to being web-based. Among the four was the ex-husband of newly elected Auditor-Controller Betsy Schaffer — Fallati retires at the end of the year — whom Fallati called a brilliant computer-science architect. The close connection between the three was part of an unexpectedly acrimonious election for the office in June.

But the Grand Jury was taken aback to hear from all county staffers that FIN has neither accounts receivable nor accounts payable functions. It disapproved of the duplication of effort required to implement secondary software at each county department. That’s only half-true, said Fallati. Disbursements, or accounts payable, is one of FIN’s main tasks, he explained. To illustrate why accounts receivable were not, Fallati gave the example of the operations of County Public Health. Medical clinics have a totally different type of receivables from, say, the Planning department, Fallati offered. “If we gave just one canned way to do it, neither department would use it,” he believed. The receivables from all departments, however, are entered into the FIN system after they are collected.

“The beauty of having [FIN] self-developed is that our people can fix bugs or make enhancements,” said Fallati. The county doesn’t have to wait for the company to get around to it or be charged an arm and a leg. “We took tremendous risks with what we did, but we were successful,” he said.

The Grand Jury report’s 11 findings and recommendations leave no county group untouched. It requests responses from elected officials who head departments from the Board of Supervisors to the Treasurer-Tax Collector. For the most part, the grand jurors want county government to strengthen the lapses identified to prevent fraud such as Hogan’s, or at least in the exact same way.