Municipal Reporting Risk Assessment for cities and counties

Why reporting risk stays invisible until it costs you

Municipal reporting rarely fails loudly. It degrades. A workaround introduced during an ERP upgrade becomes the permanent process, a spreadsheet bridges two systems that were never integrated, and the person who understood the sequence retires. Nothing announces that the numbers have become fragile — until a close slips, a council question cannot be answered, or your independent auditors ask for evidence that has to be reconstructed from memory. These are the patterns we most often find:

• The monthly and year-end numbers are assembled by hand in spreadsheets, and the assembly steps live in one person’s head.
• Finance and HR disagree on headcount, position control, or payroll distribution, and nobody can point to which system is authoritative.
• The same figure comes out differently depending on which report you run it from, and the difference is reconciled manually every close.
• Requests from your independent auditors are answered by rebuilding evidence from scratch each year rather than pulling it from a documented source.
• Turnover has already taken part of the institutional memory, and the surviving reports are the only remaining documentation.
• Nobody has written down what would break, or who would be blocked, if a given report or extract stopped running tomorrow.

How the engagement runs

What you receive

• Reporting inventory for Finance and HR — the reports, extracts, spreadsheets, and manual steps that produce the numbers your organization relies on.
• Data lineage for the figures that matter most: where each number originates, every hand-off it passes through, and where it is transformed without a record.
• Single-point-of-failure register — the reports, jobs, and people whose absence would stop a close, a payroll, or an audit request.
• Reconciliation and control-gap findings, with the specific step where the numbers can diverge undetected.
• Evidence-readiness review: which recurring requests from your independent audit firm can be answered from a documented source, and which are rebuilt by hand each year.
• Risk register scored by likelihood and impact, so the findings can be discussed with a finance director and a council in the same language.
• Prioritized remediation plan with rough effort and sequencing for each recommendation, written so it can be used as a scoping input or a budget request.
• A closing review session walking your staff through the findings and the plan.

What this engagement does not include

This engagement is diagnostic and nothing else. It tells you where you stand, what is most likely to break, and what to do about it in what order. Remediation is a separate, larger engagement, scoped and priced only after you have seen the findings and decided what is worth doing.

• Any build work — no reports, extracts, integrations, or automations are written inside this fee
• Dashboards of any kind, including sample, prototype, or "quick-win" dashboards
• Worked examples or rebuilt versions of your existing reports
• Changes to your systems, data, or configuration — the review is read-only
• An audit opinion, an attestation, or anything filed with the state

Scope: Finance and HR, extendable on request

The standard $4,500 scope covers Finance and HR. Those two carry the most reporting consequence in almost every organization — the general ledger, the close, payroll, position control — and they are where fragile hand-offs concentrate. On request the assessment can be extended to cover additional departments:

• Utility billing
• Permits
• Planning
• Business licensing

Extensions are quoted before we begin, so the fee is known up front rather than discovered later.

This is not your annual audit

Your annual financial audit is a statutory engagement performed by your independent audit firm, on a defined standard, ending in an opinion. This assessment is nothing of the kind. It is private work you commission for your own use: no opinion, no attestation, nothing filed with anyone. The point is to find the weak places in how your numbers are produced on your own schedule and in your own words — before someone else finds them on theirs.

Access we need from you

• Read access to the reporting your Finance and HR teams actually use, or a working session with a staff member who has it. The review is read-only and changes nothing.
• Roughly two to four hours total of staff time across the two weeks, spread over a kickoff, the walkthroughs of each recurring cycle, and a closing review.
• Copies of the recurring evidence requests you already answer for your independent auditors, if you have them collected. If not, we will work from what your staff describe.

Frequently asked questions