Who checks the city's work? What an independent auditor does

Every year Boulder's books get audited, as Colorado law requires. That audit answers an important question: are the city's financial statements right? It does not answer the question most residents are actually asking, which is whether the money bought what it was supposed to buy. Nobody in Boulder is assigned to answer that one independently. Thus, today the only people who evaluate a city program are the people who run it.

I've said a lot on this site about hiring an independent City Auditor who is a peer to the City Manager. People reasonably ask what that means, what the job actually is, and how an auditor decides what to look at. I started my career as an internal auditor at American Express, so this is one of the few corners of city government where I can say I've done the job. Here are the nuts and bolts.

Two different kinds of audit

A financial audit checks the accounting: it tests the city's records and ends in an opinion on whether the financial statements are fairly presented. Boulder does this every year, as every Colorado local government must, and it does it fine.

A performance audit asks a different question: did this program do what it was supposed to do, at a reasonable cost, and could it be done better? The federal Yellow Book, the standard most American government auditors work to, describes performance audits as objective analysis that helps the people running and overseeing a program improve it, cut costs, and answer for the results. In practice that sounds like: is permit review hitting the timelines the city publishes? Did the capital project come in on budget, and if not, why? Is police overtime what we planned for? Is the city collecting the fees it's owed?

That last kind of question pays for itself more often than you'd think. In 2023 Atlanta's city auditor found $197.8 million in uncollected water revenue tied to inconsistent shutoff enforcement. Portland's auditor documented a $1.4 billion infrastructure maintenance backlog that had gone unfunded. That one should sound familiar, since our own pile of deferred maintenance and unfunded capital projects sits at roughly $400 million.

An auditor does not set policy, run programs, or tell council how to vote. The product is a public report: what we looked at, what we found, what we recommend, and management's written response printed right alongside it. Then the auditor comes back later and checks whether the recommendations actually happened.

Why the reporting line is the whole ballgame

Boulder runs a council-manager government. Voters elect nine council members, and council hires three people: the City Manager, the City Attorney, and the Municipal Judge. The City Manager runs everything else, which means nearly every one of the city's employees reports, eventually, to one person.

Boulder does have an internal audit function today, and the people in it do real work. But according to the city's own page, it reports administratively to the Chief Financial Officer and functionally to an Internal Audit Committee "comprised of city leadership," under a policy the City Manager approved this June. Follow that chain up and it ends at the City Manager's desk. An auditor whose boss is also the boss of everyone being audited is going to have a hard time writing the report that says the boss's priority project is off the rails. I don't say that as a knock on anyone's integrity. It's a structural problem, and no amount of good faith fixes it.

The private sector settled this a long time ago. At Amex, the audit department didn't report to the executives whose processes we were testing; it answered to the audit committee of the board. Public companies work this way for exactly the reason above: the person checking the work can't work for the person who did it.

That's what "a peer to the City Manager" means. And we don't need to amend anything to do it. Article II, Section 12 of the City Charter already empowers council to appoint "an auditor for such independent audits as are in this charter required or authorized to be made by order of the council." We've simply never used it.

The reporting line is necessary, but it isn't enough on its own. The professional bodies that set the standards for local government auditors (the Association of Local Government Auditors, and the GAO through the Yellow Book) are consistent about the other protections, and an ordinance creating the office should write every one of them down:

• Removal only for cause, by a supermajority. Firing the auditor over an inconvenient report should take more than one bad week on council. Honolulu requires a two-thirds vote of the full council; San Diego requires a two-thirds vote plus the audit committee's recommendation.
• A fixed term that outlasts a council. Honolulu uses six years, San Diego ten.
• Unrestricted access to every record, data system, and employee, without needing a department head's sign-off.
• Its own budget line, so the office can't be quietly starved.
• Public reports, with management's response attached.
• An audit committee with community members who have real finance, audit, or evaluation chops. A common setup is two council members and three residents.
• Recognized standards and outside review. Audits done to the Yellow Book or the Institute of Internal Auditors' Global Internal Audit Standards, with an external peer review every three years.

I already hear the retort: "Council can already ask staff for anything it wants!" This is true. But council asking the City Manager to evaluate the City Manager's programs is the arrangement we have now, just with more meetings. And an auditor's real value is giving the people inside the building who already know something isn't working the cover to say so.

It also isn't expensive. A group of Boulder residents published a careful proposal this summer for a three- or four-person office running under $1 million a year, somewhere around 0.15% of the city's roughly $590 million budget. Gainesville, Florida, a commission-manager city a bit bigger than ours, runs a six-person office for about $741,000.

How an annual audit plan comes together

A small office can't look at everything, and it shouldn't try. A three- or four-person shop finishes a handful of full audits a year, plus shorter reviews and follow-ups. Thus the most important thing the auditor does all year is decide what to look at, and the professional standards are specific about how: base the plan on a documented risk assessment, refresh it at least annually, take input from the governing body and management, and get the plan approved by the governing body. Here's what that looks like in practice.

1. Build the audit universe. List everything that could be audited: every department, program, major contract, capital project, IT system, and revenue stream. In a city Boulder's size that's a few hundred lines on a spreadsheet.
2. Score the risk. For each line, ask how much money flows through it, how complex it is, whether it's new or just changed (a new system, a new tax, new leadership), how many residents depend on it, how exposed it is to fraud (cash handling, procurement, and payroll always score high), and when anyone last looked at it and what they found. The output is a ranked list, not a hunch.
3. Ask around. Council members, the City Manager, department heads, and the public all get a say. Department heads in particular know where the problems are; a good auditor asks each of them what keeps them up at night. A confidential hotline lets any employee or resident flag waste or fraud, and those tips feed the next year's plan.
4. Fit the plan to the staff. Take the top of the ranked list, estimate the hours for each audit, and draw the line where the hours run out. Hold back some time for the thing nobody saw coming, and for following up on old recommendations.
5. Approve it in public. The audit committee reviews the plan and council approves it, which is the "by order of the council" the charter asks for. One rule matters a lot here: council approves the plan, but it shouldn't get to strike an audit to protect a favorite program. Choosing the topics belongs to the auditor. That's what independence means in practice.
6. Do the work, the same way every time. A planning meeting with the department, fieldwork (interviews, data, documents), a draft report back to the department for a fact check and a written response, and then a final public report with that response attached.
7. Track it until it's done. Every recommendation gets tracked until it's implemented or council decides, on the record, to accept the risk. The auditor reports that status publicly at least once a year, and revisits the plan at midyear when circumstances change.

If I were sketching Boulder's first-year plan myself, the top of the list would almost write itself: capital projects and the deferred maintenance backlog, whether the climate tax is buying the wildfire mitigation we actually need, and whether permit review times match what the city tells applicants. That's my list, though. The auditor's list should come out of the risk assessment, and it may well surprise all of us. That's sort of the point.

What I'd do on council

Pass an ordinance creating the office with the protections above. Hire a credentialed auditor (a CIA, CPA, or CGAP, with real government audit experience), seat the audit committee with qualified residents, and publish the first risk-based plan within six months. Then pair it with the other two commitments on my accountability page: every new program arrives with a target and a date, and a program that misses its target twice comes back to council for a vote to continue. An auditor is what makes those commitments checkable.

Every year we find out whether our numbers add up. It's time we found out whether they add up to anything.