Plan Moran presents risk assessment; city details inventory audits and CDBG-DR internal audit contract

The Asheville City Audit Committee heard a detailed internal audit program update and a three-year internal audit plan after the committee completed its organizational business.

Frank McGowan, strategic services manager in the finance and management services department, told the committee that the city completed Jefferson Wells audits for cash handling at the Harris Cherokee Center and for fleet management operations; the cash-handling work identified no significant findings but recommended reconciliation and training improvements, while the fleet audit produced four findings related to fuel policy, procurement card use, standard operating procedures and physical security. He also said PB Mares was engaged to perform inventory audits of fleet management, the Harris Cherokee Center and the water warehouse; those reports showed no major findings and departments have developed action plans.

The committee then heard a presentation from the co-sourced audit partner, Plan Moran. Matt Bodoff, a partner at the firm, and colleagues Brian O'Neil and Jessica Boris described a risk-assessment process that combined surveys of 18 departments, leadership interviews and analysis of prior findings. Jessica Boris said the heat map identified the four highest-rated audit units as human resources, transportation, capital projects and information and technology services. She outlined the first-year priorities for FY2026: revenue and payment collections (initiated), grants management (planned for 2026) and cybersecurity (to be conducted concurrent with the grants audit). Plan Moran said the engagement is flexible and they expect to conduct about three to four audits per year while maintaining a consolidated tracker for remediation testing and follow-up.

Frank McGowan also briefed the committee on the Community Development Block Grant'Disaster Recovery (CDBG-DR) program: the city followed federal procurement requirements and awarded a separate internal audit contract to CliftonLarsonAllen (CLA) to perform internal audit work for the CDBG-DR program; Frank said the city was awarded $225,000,000 "and change" for CDBG-DR and that CLA's contract extends for six years and has begun initial planning. He emphasized CDBG-DR is a federal program requiring federal procurement standards and said more detailed presentations on CDBG-DR audit work will be scheduled in future special meetings.

Tony McDowell, who identified himself during discussion, thanked the Plan Moran team and cautioned that a high risk score reflects the nature of an audit unit's work rather than a performance judgment. Plan Moran confirmed they considered prior risk assessments and that the plan can be reprioritized annually or as circumstances change.

The committee asked about remediation testing and staffing; Plan Moran and city staff said remediation testing will be part of the audit cycle and that the internal audit position vacated in January remains under review by HR amid anticipated budgetary discussions.