2026 Audit Plan

According to the charter, the ultimate decision to perform any audit shall be at the sole discretion of the Auditor. It says the Auditor shall conduct:

• Financial and performance audits of the City and County of Denver in accordance with generally accepted government auditing standards;

• Audits of individual financial transactions, contracts, and franchises; and

• Audits of financial and accounting systems and procedures, including records systems, revenue identification, and accounting and payment practices, for compliance with generally accepted accounting principles, best financial management practices, and any applicable laws and regulations governing the financial practices of the City and County of Denver.

The 2026 Audit Plan ensures broad audit coverage throughout the city while also addressing specific performance, financial, contractual, information technology, and regulatory risks. 

Integrated audits incorporate various auditing elements and diverse approaches, producing more effective outcomes. It includes:

• Performance auditing – We identify opportunities to improve the efficiency and effectiveness of city activities. Our performance audits also assess the viability or strength of the internal control environment of the city’s agencies and programs.
  
• Financial auditing – Identified audits will assess the financial internal control environment, compliance with city polices, financial governance, accounting and reporting practices, and high-risk financial transactions.
  
• Information technology auditing – Our audits will address identified IT risks by focusing on the effectiveness of the city’s cybersecurity defenses, data protection, data privacy, and management of critical systems and applications.
  
• Contract compliance auditing – Our 2026 Audit Plan reflects a continued emphasis on auditing city contracts for compliance with contract terms and fulfillment of the scope of work.

The Audit Analytics Program expands the office’s risk assessment and auditing capabilities and continues leading-edge audit practices to provide greater value and impact. Using data science tools, we sort through large numbers of transactions and entire data sets to identify the highest risks.

• Audit analytics – We use quantitative and qualitative risk-finding analytics of audit-related data and apply survey and sampling methodologies to a variety of topics and sources of information. Audit analytics helps ensure data is accurate, can be used to create visual representations of anomalies and patterns, is used to build statistical models, and synthesizes analytical results in audit reports.
  
  
• Continuous auditing – We conduct ongoing analyses of data systems to identify high-risk areas and test controls in the city’s financial and operational systems in a timely fashion. The information gained from continuous auditing helps inform audits and the annual risk assessment. It also helps us identify trends and exceptions.

The city’s managers are responsible for establishing internal controls to detect and prevent fraud for each city entity. Although fraud detection is not our primary responsibility, our audits consider the possibility that fraud, waste, or abuse may be occurring.

Audit follow-up activities are conducted for every audit to assess whether city personnel implemented the agreed-upon audit recommendations for improvement and impact.

We regularly issue follow-up audit reports to the Audit Committee and the City and County of Denver’s operational managers. These reports show the status of audit findings and our recommendations for improved business practices.

We measure the audit recommendation acceptance rate, and recommendation implementation rate, as indicators of the degree to which the city is using information provided by our audit reports to mitigate identified risks and to enhance efficiency, effectiveness, and economy of operations.

Auditor O’Brien and the Auditor’s Office leaders meet with City Council members, the mayor, other elected officials, city agency leaders, neighborhood and community groups, and civic leaders to solicit input regarding risks.

Developing the annual audit plan is an ongoing process — conducted by assembling ideas from a variety of internal and external sources, examining a broad range of city activities and data, and then assessing risk factors along with additional considerations.

In developing a list of potential audits and other types of analyses, we consider:

• Assessments of operations and controls in previous internal and external audit reports —including independent audits of the city’s “Annual Comprehensive Financial Report,” single audits, and audit management letters.
• Input from community members, elected officials, Audit Committee members, external auditors, and agencies.
• Local events, financial conditions, major capital projects, and public policy issues.
• Risks identified in other local governments’ audits that could also emerge in Denver.

We assess a range of city activities and entities including:

• Organizational units within a city agency, like a division or a department.
• Individual city programs and offices.
• Transaction cycles or processes that affect more than one city function or agency, like contract procurement, purchasing, cash handling, fines, taxes, property assessments, or key technology processes.
• Individual financial statement accounts or transactional activities, like construction projects in progress, tax-funded programs, special revenue funds, and grant programs.
• City functions that operate like for-profit entities, like Denver International Airport and other entities associated with enterprise funds.
• Contracts and agreements between the city and third parties, including cultural facilities and nonprofit organizations.

We identify and prioritize potential audits based on risks on the city. We assess these risks by reviewing:

• Significant changes that have occurred in the city.
• Time since the last audit of an area.
• Size of the agency, program, activity, or contract.
• Size of the budget.
• Compliance and regulations.
• Pending or recent legislation.
• Complexity of transactions.
• Fiscal sustainability.
• Critical information technology systems, including hardware and software.
• Management.
• Quality of internal control systems.
• Age of programs, operations, or contracts.
• Public health and safety.
• Critical infrastructure.
• Short- and long-term strategic risks.
• Equity.
• Related litigation.
• Relevant case law.
• Emerging risk areas.

We periodically evaluate and may change risk factors as necessary.

After we finalize the audit plan, new information may come to light. Unanticipated events may occur, and initiatives, priorities, and risks within the city may change. The flexible nature of our audit plan as a living document provides the discretion to change course when it is in the best interest of the city.

The Auditor’s Office provides independent oversight of how tax dollars and other funding resources are spent on the city’s many services, initiatives, and programs. Article V of the Denver Charter establishes this independence and provides for the Auditor’s general authority and duties. The charter also establishes the Audit Committee, through which we report our audit findings.

Several key components serve as the corner-stone for Denver’s auditing framework. These elements give the Auditor the independence needed to conduct meaningful audits:

• Elected Auditor – The City and County of Denver has an elected Auditor who is independent from all other elected officials and operational management.
  
  
• Audit Committee – The Denver Charter establishes an independent Audit Committee, chaired by the Auditor, with six other members appointed by the mayor, members of the City Council, and the Auditor.
  
  
• Comprehensive access – The Denver Charter and city ordinance authorize the Auditor to have access to all officers, employees, records, and property maintained by the City and County of Denver and to all external entities, records, and personnel related to their business interactions with the city. When an external partner entity refuses access as required by contract after repeated requests, the Auditor may work with the independent Audit Committee to issue a subpoena.
  
  
• Audit response requirements – City ordinance requires that audited agencies formally respond to all audit findings and recommendations, establishing the Auditor’s ability to work in conjunction with these agencies while maintaining independence.
  
  
• Adherence to professional audit standards – The Auditor’s Office conducts all audits in accordance with generally accepted government auditing standards published by the U. S. Comptroller General. These standards contain requirement and guidance on important topics such as ethics, objectivity, and independence.

Denver Auditor Timothy M. O’Brien, CPA, has more than 40 years of auditing and accounting experience. Auditor O’Brien strives to bring greater clarity, transparency, and accountability to Denver’s city government for its residents. Elected in 2015 — and reelected in 2019 and 2023 — Timothy O’Brien is distinguished from his predecessors as a professional auditor.

Auditor O’Brien and his office have won many national awards for their work, including eight Knighton Awards from the Association of Local Government Auditors:

• 2024 Knighton Distinguished Award: “City Shelters.”
• 2023 Knighton Distinguished Award: “Homeless Encampments.”
• 2022 Knighton Exemplary Award: “Residential Trash, Recycling, and Compost Services.”
• 2021 Knighton Distinguished Award: “Airport Parking Shuttle System.”
• 2020 Knighton Exemplary Award: “Neighborhood Sidewalk Repair Program.”
• 2019 Knighton Distinguished Award: “Denver Preschool Program.”
• 2018 Knighton Distinguished Award: “Affordable Housing.”
• 2015 Knighton Exemplary Award: “Rocky Mountain Human Services.”

Auditor O’Brien also received the David M. Walker Excellence in Government Accountability Award in 2022 from the National Intergovernmental Audit Forum and the ADA Access Award from the Colorado Cross-Disability Coalition in 2018 for his work on behalf of people with disabilities.

Auditor O’Brien received the 2017 Outstanding CPA in Government Impact Award from the American Institute of CPAs. He was honored with the 2016 Jonathan Holtzinger Award of Excellence by the Colorado Chartered Financial Analyst Society for demonstrating the highest standards as a financial and investment professional.