FISCAL YEAR AUDIT PLAN
2027
TABLE OF CONTENTS
A LETTER FROM YOUR TULSA CITY AUDITOR
Dear Tulsans,
It is my pleasure to present the FY27 Audit Plan to you. It is really your audit plan. Your engagement in the “Evaluate the 918” survey went from 300 survey responses in 2025 to 2,800 in 2026. Your thoughtful responses and care for this city is what inspires us to do our work with excellence.
We took your responses and created individual reports for each of the 18 department heads, the City Councilors and the Mayor. We walked them through the results and discussed how we can make a City that best meets your needs.
Also influencing this plan are the voices of over 900 City of Tulsa employees (compared to 200 last year). City employee responses helped us think through the processes that are doing well and the processes that need improvement. We also reviewed the following:
-
Department Head and Mayoral Staff Interviews,
-
Interviews with Mayor and Council,
-
Mayor and Council priorities,
-
Trends in risk flags from the hundreds of data analytics we’ve built to continuously monitor financial transactions,
-
All City of Tulsa related news articles for the last year,
-
Lawsuit payouts made by the City of Tulsa,
-
What other cities’ auditors are auditing
Our work of including residents and employees throughout our audit process was recognized by the Institute of Internal Auditors. We were the recipients of the IIA Excellence Award, a prestigious global honor recognizing outstanding contributions to the internal audit profession. Our leadership, innovation, and dedication earned us a place among a select group of individuals and teams making a meaningful and lasting impact worldwide.
We also were selected to present our work at the National Association of Local Governments Annual Conference where we presented our work to hundreds of local auditors across the country.
I am thankful for this opportunity to serve you, and I am looking forward to working with all of you as we make Tulsa everything that we want it to be for ourselves, our neighbors and our children.
Sincerely,
Tulsa City Auditor, Nathan Pickard, CIA
PLANNED AUDITS
The City Auditor’s Office has included the following audits in its plan with a goal of completing at least 10 audits in this upcoming fiscal year. Many changes occur throughout the year due to unexpected circumstances and emerging risks so this plan can change accordingly.
ABOUT THE OFFICE OF THE CITY AUDITOR
OUR MISSION
Our mission is to provide accountability and build trust by listening to residents and employees, evaluating city systems and performance, and informing stakeholders through transparent reporting. We adhere to the Global Internal Audit Standards and uphold values of independence, accountability, trust, and access.
CITY AUDITOR AUTHORITY
The Office of the City Auditor is an independent body established by the City Charter to provide objective, risk-based, and trusted oversight of city operations. Elected by the public and supported through a protected budget, the City Auditor is empowered to access all city records and conduct audits, reviews, and investigations across departments and agencies.
According to the City Charter, Article IV, Section 5, “All officers, employees, divisions, departments, boards, authorities, commissions, and agencies of the City of Tulsa shall produce and make available to the City Auditor any records, accounts, personnel, facilities, and inventories which the City Auditor may request or require.”
CORE FUNCTIONS
The core functions of this office include conducting an annual audit plan, responding to ethics complaints, and fulfilling special requests from the Mayor and City Council. The audit work is structured and evidence-based: we understand city objectives, assess risks, test controls, and issue findings and recommendations to drive improvement. Reports are issued with clear criteria, causes, effects, and recommendations.
Listening is central to our process. We engage with residents through surveys, the 311 system, social media, and public forums. Internally, we hold interviews and surveys with staff and leadership. We plan to expand outreach through community engagement to better understand and evaluate resident outcomes.
Ultimately, we aim to strengthen city governance, risk management, and operational effectiveness by offering insight, foresight, and independent assurance. Trusted by both employees and residents, the Office of the City Auditor serves as a vital resource to ensure the City of Tulsa exceeds expectations and upholds public trust.
ABOUT THE AUDIT SELECTION PROCESS
The audit selection process varies from institution to institution, and is ultimately decided by the City Auditor. The Office of the City Auditor follows Institute of Internal Auditors standards in its audit selection process.
The Office of the City Auditor conducted a comprehensive risk assessment aligned with internal audit standards and best practices. This multi-phase process ensures that audit resources are directed toward the most impactful areas of city operations while remaining responsive to evolving needs.
1
COLLECT RISK INFORMATION
PRIORITIZE
RISK
2
DETERMINE AUDITS
3
The first phase involved collecting information about these risks from a variety of sources. We gathered input from the public through community indicators, surveys, social media, news articles, community events, and lawsuits. Within the organization, we interviewed department heads, surveyed employees, and consulted with boards, commissions, and elected officials. We also leveraged insights from our own audit team, members of the audit committee, and peer audit organizations and used financial and HR data systems to look for negative risk trends.
In the second phase, we prioritized risks to formulate audits using several criteria: the availability of evidence, audit cost versus benefit, staff expertise, and organizational capacity. This helped us translate identified risks into potential audits with a clear rationale.
Next, we determined which audits to pursue, incorporating input from internal staff, City Councilors, and the Mayor. Ultimately, the elected City Auditor made the final decision. We compiled a list of the top 20 potential audits. The result is a balanced, dynamic plan that considers strategic priorities, resource availability, and emerging risks.
This process, guided by audit standards, ensures that our work supports the city’s governance, risk management, and control processes. It also promotes transparency, responsiveness, and accountability. Our goal is to listen, evaluate, and inform—providing valuable insights that improve city operations and serve the public interest.
FISCAL YEAR 2027 OPERATING BUDGET
The Office of the City Auditor includes a team of up to 14 full-time employees of auditors, audit managers, data analysts, performance auditors, IT auditors, communications professionals, and administrative professionals. The majority — nearly 97 percent — of the total operating budget goes towards salaries and wages.
$1,835,000
Personnel Costs
$7,000
Technology, Materials & Supplies
$112,000
Contract Services & Charges
$1,892,000
Total Budget
FISCAL YEAR 2027 ORGANIZATIONAL CHART
The following FY 2027 Audit Plan for the City of Tulsa includes 17 potential audits, with a goal of expanding community engagement and communication with the public.
HOW AUDITS ARE CONDUCTED
This year’s audit plan incorporates performance, financial, information technology audits and community engagement to ensure we are focusing on the right risks and processes that affect the community the most.
As a team of internal audit professionals, the Office of the City Auditor adheres to the highest professional standards and utilizes diverse approaches, including:
PERFORMANCE AUDITING
Identifies opportunities to improve the efficiency and effectiveness of city activities, and assesses the viability or strength of the internal control environment of the city’s agencies and programs.
FINANCIAL AUDITING
Assesses the financial internal control environment, compliance with city policies, financial governance, accounting and reporting practices, and high-risk financial transactions.
INFORMATION TECHNOLOGY AUDITING
Focuses on the effectiveness of the city’s cybersecurity defenses, data protection, data privacy, and management of critical systems and applications.
AUDIT
ANALYTICS
Uses quantitative and qualitative risk-finding analytics of audit-related data and applies survey and sampling methodologies to support audit teams working with many different topics and sources of information. Audit analytics can be used to ensure data is accurate, consistent, and complete; to identify, analyze, and create visual representations of anomalies and patterns; to build statistical models; and to synthesize analytical results in audit reports.
CONTINUOUS AUDITING
Allows auditors to directly connect with city data systems, use an entire data population rather than samples, and automate ongoing analyses of that data. These ongoing analyses of data systems are used to identify high-risk areas and test controls in the city’s financial and operational systems in a timely fashion. The information gained from continuous auditing helps inform audits and the annual risk assessment. It also helps audit teams improve efficiencies in planning and fieldwork by identifying trends and exceptions earlier than through traditional audit methods.
AFTER THE AUDIT
AUDIT FINDINGS AND RECOMMENDATIONS
Following an audit, findings are shared with the Mayor, City Council, City management, and the public to promote transparency and drive meaningful change. Audits identify inefficiencies, risks, and areas for improvement, as well as provide data-driven recommendations that help City departments enhance service delivery, optimize financial practices, and strengthen public trust. These recommendations are shared with appropriate department heads.
MONITORING IMPLEMENTATION PROGRESS
After an audit report is issued, the Office of the City Auditor follows up with department managers to track their progress in implementing corrective actions. Each year, departments are required to report on their efforts, detailing whether recommended changes have been completed, are in progress, or will not be pursued due to changing conditions. This ongoing monitoring process helps maintain accountability and ensures that audit findings are not just documented but acted upon.
