1 of 34

THE CITY OF ONTARIO’S RETALIATION AGAINST�CITY AUDITOR

Brad Neumann

Former City Auditor, City of Ontario, California�CIA – Certified Internal Auditor

MBA – Master of Business Administration�

https://www.linkedin.com/in/neumannbrad/ 🡪

June 18, 2024

2 of 34

Exhibit 12:

“Your opinion/interpretation of the Standard or memo does not preclude you from my directive [to violate the professional audit standards*]. Not following my directive is considered insubordination and could result in serious discipline.“

Jordan Villwock�Management Services Director�City of Ontario�Friday, December 8^th, 2023

2

*IIA Standards: 1100, 1110, 1120, 1130, 1200

1210, 1220, 1321, 2430, 2600

The International Standards for the Professional Practice of Internal Auditing IIA Standards (2017 Edition) 🡪

3 of 34

International Standards for the Professional Practice of Internal Auditing (“Standards”) [1 of 3]

3

IIA Standards

2017 pdf file

4 of 34

International Standards for the Professional Practice of Internal Auditing (“Standards”) [2 of 3]

4

IIA Standards

2017 pdf file

5 of 34

International Standards for the Professional Practice of Internal Auditing (“Standards”) [3 of 3]

5

IIA Standards

2017 pdf file

6 of 34

Exhibit 12

City of Ontario’s Retaliation Against City Auditor

6

7 of 34

Brad Neumann’s Credentials

Michigan State University (MSU) - 2008

Telecommunication, Information Studies and Media
Additional Major: Advertising

Louisiana State University (LSU) - 2011

Master of Business Administration (MBA)
Specialization in Internal Audit

Certified Internal Auditor (CIA) - 2013

Institute of Internal Auditors

7

The IIA Standards (2017 Edition) 🡪

8 of 34

Institute of Internal Auditors (IIA)�Code of Ethics

Rules of Conduct

4. Competency: Internal auditors…

4.1. Shall engage only in those services for which they have the necessary knowledge, skills, and experience.

4.2. Shall perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing.

4.3. Shall continually improve their proficiency and the effectiveness and quality of their services.

Applicability and Enforcement of the Code of Ethics

This Code of Ethics applies to both entities and individuals that perform internal audit services.

8

https://www.theiia.org/en/standards/what-are-the-standards/mandatory-guidance/code-of-ethics/ 🡪

9 of 34

ESTABLISHMENT OF THE IAC COMMITTEE

Exhibit 4

City of Ontario’s Retaliation Against City Auditor

9

IIA Standards

2017 pdf file

IIA �Code of Ethics

10 of 34

Establishment of the IAC Committee

Exhibit 4

City of Ontario’s Retaliation Against City Auditor

10

Establishment of the IAC Committee, Page 2

11 of 34

11

Exhibit 13

Notification of Request for Resolution of Disagreement

City of Ontario’s Retaliation Against City Auditor

12 of 34

5 Hours Later…

City Auditor placed on Paid Administrative Leave

12

13 of 34

Two Types of Allegations

Allegations That The City Auditor Adhered to Professional Standards and City Policy

Action 1: City Auditor’s Proper Investigation of Alleged Waste, Fraud And Abuse

Allegation 2: Dishonesty, Exceeding Authority

Allegation 3: Insubordination

Action 2: City Auditor’s Refusal to Violate Audit Standards

Allegation 4: Insubordination

Action 3: City Auditor’s Proper Audit Staffing Decision

Allegation 5: Insubordination

Allegations That The City Auditor Committed No Terminable Offenses

Action 4: Development of a Survey for City Employees

Allegation 1: Insubordination

Action 5: Note-taking During Meeting with City Executive

Allegation 6: Insubordination

13

14 of 34

Allegations That The City Auditor Adhered to Professional Standards and City Policy (1 of 3)

Action 1: City Auditor’s Proper Investigation of Alleged Waste, Fraud And Abuse

Allegation 2: Dishonesty, Exceeding Authority

Allegation 3: Insubordination

14

City Auditor Job Description:

The City Auditor conducts audits and investigates all internal processes and procedures to eliminate waste, fraud and abuse.
Manages the citywide ethics program / hotline and makes recommendations for actions based on reported information.

City Auditor Job Description 🡪

15 of 34

Allegations That The City Auditor Adhered to Professional Standards and City Policy (2 of 3)

Action 2: City Auditor’s Refusal to Violate Audit Standards

Allegation 4: Insubordination

15

IIA’s Rules of Conduct

4. Competency: Internal auditors…

4.1. Shall engage only in those services for which they have the necessary knowledge, skills, and experience.

4.2. Shall perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing.

4.3. Shall continually improve their proficiency and the effectiveness and quality of their services.

Applicability and Enforcement of the Code of Ethics

This Code of Ethics applies to both entities and individuals that perform internal audit services.

https://www.theiia.org/en/standards/what-are-the-standards/mandatory-guidance/code-of-ethics/ 🡪

16 of 34

Allegations That The City Auditor Adhered to Professional Standards and City Policy (3 of 3)

Action 3: City Auditor’s Proper Audit Staffing Decision

Allegation 5: Insubordination

16

City Auditor Job Description:

The City Auditor…

Plans, directs, and supervises the activities of staff including employee selection, performance evaluation, employee development, disciplinary action, and complaint resolution.
Oversees, reviews, and evaluates the work activities of the audit staff and meets with staff to identify and resolve problems.

City Auditor Job Description 🡪

17 of 34

Allegations That The City Auditor Committed No Terminable Offenses (1 of 2)

Action 4: Development of a Survey for City Employees

Allegation 1: Insubordination

17

18 of 34

Allegations That The City Auditor Committed No Terminable Offenses (2 of 2)

Action 5: Note-taking During Meeting with City Executive

Allegation 6: Insubordination

18

19 of 34

Former City Auditor’s Recommendation

City Council ask for the following resignations for their participation in the retaliation against the City Auditor:

Scott Ochoa, City Manager
Darlene Sanchez, Assistant City Manager
Jordan Villwock, Management Services Director
Michael Heider, Chief HR Investigator
Mike Lorenz, Chief of Police

19

20 of 34

Appendix

20

21 of 34

IAC Establishment & City Auditor Timeline

2010: City of Ontario v. Quon

Pager use was covered by the OPD's computer and Internet use policy, under which employees agreed that "the city reserves the right to monitor and log all network activity including e-mail and Internet use, with or without notice."

2020: Scott Ochoa establishes the Internal Audit function at the City of Ontario

“Establishment of Internal Audit Committee (IAC)” adopts IIA Standards

2021: Scott Ochoa issues 2^nd memo regarding the Internal Audit function:

Adds the Executive IT Director as a permanent member to the IAC
Grants the IA function access to “all City documents and data”

See San Diego’s City Auditor’s Charter: https://www.sandiego.gov/auditor/role -->

April 2022: Brad Neumann joins City of Ontario as Internal Auditor
July 31, 2023: Brad Neumann promoted to City Auditor
December 12, 2023: Brad Neumann placed on Paid Administrative Leave
March 28, 2024: Brad Neumann terminated from public service.

21

https://www.justice.gov/osg/brief/city-ontario-v-quon-amicus-merits

City of Ontario v. Quon: https://www.justice.gov/osg/brief/city-ontario-v-quon-amicus-merits

San Diego - https://www.sandiego.gov/auditor/role#:~:text=The%20City%20Auditor%20must%20have,by%20the%20Charter%20or%20otherwise.

“The City Auditor must have access to, and authority to examine any and all records, documents, systems, and files of the City and other property of any City department, office, or agency, whether created by the Charter or otherwise.”

City of Ontario: City Auditor Job Posting on 6/19/2023 (Exhibit 1⁾

City of Ontario: Memo - Establishment of the IAC issued by Scott Ochoa, May 13, 2020 (Exhibit 4)

City of Ontario: The City’s Public “IPA” Webpage OntarioCA.gov/IPA (Exhibit 34)

IIA: Rules of Conduct 4.2 “Competency: Internal Auditors shall perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing.” (Exhibits 23-25)

IIA: Standards (Exhibit 3)

22 of 34

City Auditor Job Description

The City Auditor conducts audits and investigates all internal processes and procedures to eliminate waste, fraud and abuse.�
Manages the citywide ethics program / hotline and makes recommendations for actions based on reported information.��Preferred Qualification: Certified Internal Auditor (CIA)

IIA: Rules of Conduct 4.2 “Competency: Internal Auditors shall perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing.” (Exhibits 23-25)

22

QR Code to City Auditor Job Description🡪

🡨 https://www.theiia.org/en/standards/what-are-the-standards/mandatory-guidance/code-of-ethics/

23 of 34

Chief HR Investigator

Lies to City Auditor (1 of 2)

Exhibit 16

City of Ontario’s Retaliation Against City Auditor

23

24 of 34

Chief HR Investigator

Lies to City Auditor

(2 of 2)

Exhibit 16

City of Ontario’s Retaliation Against City Auditor

24

25 of 34

Timeline of Threats of Retaliation

November 21, 2023: “Performance Update” Memo discussion during 1:1
November 28, 2023: “Response to Performance Update” Memo discussion during 1:1
November 29, 2023: Whistleblower report filed through EthicsPoint Web & received by City of Ontario
November 30, 2023: City Auditor notified of the Whistleblower report
December 5, 2023: “Audit Plan Directive” issued that requires violation Standards

Exhibit 11 & 12

December 6, 2023: Whistleblower report “Review Complete” by Chief HR Investigator, Michael Heider.

Exhibit 14

December 8, 2023: Management Services Director threatens City Auditor with “severe discipline” for not violating professional audit standards

Exhibit 12

December 12, 2023:

7:44 AM: City Auditor submits document request to Toni McNaughton
7:57 AM: City Auditor requests IAC to resolve disagreement with MSD
10:21 AM: Chief HR Investigator falsely tells City Auditor, the whistleblower report is in a “preliminary review”
1:00 PM December 12, 2023: City Auditor placed on Paid Administrative Leave, escorted out of City Hall

25

EthicsPoint Website: City of Ontario’s Whistleblower Reporting 🡪

City of Ontario v. Quon: https://www.justice.gov/osg/brief/city-ontario-v-quon-amicus-merits

San Diego - https://www.sandiego.gov/auditor/role#:~:text=The%20City%20Auditor%20must%20have,by%20the%20Charter%20or%20otherwise.

“The City Auditor must have access to, and authority to examine any and all records, documents, systems, and files of the City and other property of any City department, office, or agency, whether created by the Charter or otherwise.”

City of Ontario: City Auditor Job Posting on 6/19/2023 (Exhibit 1⁾

City of Ontario: Memo - Establishment of the IAC issued by Scott Ochoa, May 13, 2020 (Exhibit 4)

City of Ontario: The City’s Public “IPA” Webpage OntarioCA.gov/IPA (Exhibit 34)

IIA: Rules of Conduct 4.2 “Competency: Internal Auditors shall perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing.” (Exhibits 23-25)

IIA: Standards (Exhibit 3)

26 of 34

The City Auditor Adhered to Professional Standards and City Policy (1 of 2)

Action 1: City Auditor’s Proper Investigation of the City's Alleged Financial Wrongdoing

Allegation 2: Dishonesty, Exceeding Authority for Investigation into Fraud, Waste and Abuse

Allegation 3: Insubordination for Investigation into Fraud, Waste and Abuse

The allegation that the City Auditor exceeded his authority by requesting documents and data related to an investigation of Fraud, Waste, and Abuse is unfounded and can be refuted on several grounds:

The City Auditor’s Job Description
Existence of Authorizing Memorandum
Retention Policy and Document Search
Assignment to Case XX
Mischaracterization of Beliefs and Authority
Misinterpretation of Communications
Misclassification of Work Email as Confidential
Public Records Act (PRA) Request
Question of “Malicious Intent”

26

Allegation 2: Dishonesty, Exceeding Authority for Investigation into Fraud, Waste and Abuse

The allegation that the City Auditor exceeded his authority by requesting documents and data related to an investigation of Fraud, Waste, and Abuse is unfounded and can be refuted on several grounds:

Existence of Authorizing Memorandum

The allegation incorrectly assumes that a City of Ontario Memorandum, which authorizes the City Auditor to request such documents and data, does not exist. However, this memo, issued by Scott Ochoa, City Manager, in 2021, is indeed stored on the City of Ontario’s Internal Performance Audit (IPA) SharePoint site. The presence of this document is verifiable through an audit report, directly contradicting the premise of the allegation.

Retention Policy and Document Search

The City’s policy to retain email for only one year naturally explains the IT Director's inability to find a document from three years ago. Additionally, the search conducted by IT for "Documents and Data" related to the City Auditor’s request likely failed due to searching in incorrect locations, compounded by a lack of transparency in the search process, including which documents and keywords were searched.

Assignment to Case XX

The allegation misrepresents the timeline and nature of the City Auditor’s involvement with Case XX. The City Auditor was assigned to the case on 11/30/2023, predating the HR Investigator's recommendation to file the case as a suspicious incident report on 12/6/2023. Public records confirm no such report was filed between 11/25/2023 and 1/3/2024 (Exhibit 32), and documentation of Case XX, provided to the City Auditor, supports this timeline. Furthermore, the Management Services Director’s “Audit Plan Development” directive memo (which violates the Standards) only requires audits to receive authorization prior to performance of audit procedures.

Mischaracterization of Beliefs and Authority

Claims that the City Auditor subscribes to conspiracy theories or lacks the authority to access confidential City documents and data are baseless. The City Auditor’s investigations are conducted with professional due diligence, not driven by unfounded theories. Moreover, explicit memorandums from the City Manager, alongside industry standards, grant the City Auditor full authority to access all City documents and data necessary for their duties.

Misinterpretation of Communications

The allegation misconstrues the involvement of Ms. McNaughton in the email request process, suggesting undue influence. Ms. McNaughton’s own testimony clarifies that she requested to be copied on the email and was copied on the email, indicating compliance and transparency in the document request (Exhibit 22). Furthermore, the request was not requested through an inappropriate means. It was submitted through official City email accounts while copying senior management (Assistant IT Director) on the request after being told to do so by senior management.

Misclassification of Work Email as Confidential

It is essential for City leaders, City employees and the Public to understand that all communications sent or received through a government email account constitute government documents. There exists no expectation of confidentiality for these emails, as they are subject to public records laws and transparency requirements inherent in government operations. This principle underscores the City Auditor’s rightful access to such communications as part of their investigative and oversight responsibilities, further negating claims of unauthorized document access. While sensitive documents may exist in the City leadership’s email accounts, those documents are City documents and data, and subject to review for fraud, waste and abuse.

Public Records Act (PRA) Request

The assertion that Mr. Neumann submitted an official Public Records Act (PRA) request is incorrect; the City’s exhibits did not include such a request, nor the results of the missing PRA request. PRA Requests are themselves public records are requestable by the public. The City investigators’ demonstrably false statement appears intended to harm Mr. Neumann's credibility and professional reputation. It represents yet another inaccuracy in the City investigator's report, further undermining the credibility of the allegations and calling into question the City's ability to conduct a proper self-investigation.

Question of Malicious Intent

The allegation fails to articulate any plausible malicious intent or personal benefit that the City Auditor could gain from these actions, suggesting a lack of substance to the claims of impropriety. The only malintent related to Case XX is for City leadership to prevent the City Auditor from performing his due diligence in monitoring “all internal processes and procedures to eliminate waste, fraud and abuse.” The investigator’s unsupported claim that the City Auditor acted for personal gain is not credible. The only reason why he performed the investigation is because he is serving in a position of public trust and must investigate allegations of fraud, waste and abuse.

In conclusion, the allegations that the City Auditor performing his duties somehow exceeds his duties are not only unsupported by evidence but are contradicted by documented facts and procedural clarifications. The City Auditor’s actions were within the scope of his authority and responsibilities, adhering to established policies and the interest of upholding integrity and accountability within the City’s operations. Furthermore, the City Auditor did not breach any confidentiality agreements or mishandle confidential information.

Exhibits 31-33

27 of 34

The City Auditor Adhered to Professional Standards and City Policy (2 of 2)

Action 2: City Auditor’s Refusal to Violate Audit Standards

Allegation 4: Insubordination for City Auditor’s Refusal to Violate IIA Standards

City Investigators ignored the following:

California Labor Code
The City Auditor’s Job Description
Efforts to Collaborate Overlooked
Role and Authority of the MSD
The MSD’s Inappropriate Justification for Standard Violation
Question of “Malicious Intent”

27

Allegation 2: Dishonesty, Exceeding Authority for Investigation into Fraud, Waste and Abuse

The allegation that the City Auditor exceeded his authority by requesting documents and data related to an investigation of Fraud, Waste, and Abuse is unfounded and can be refuted on several grounds:

Existence of Authorizing Memorandum

The allegation incorrectly assumes that a City of Ontario Memorandum, which authorizes the City Auditor to request such documents and data, does not exist. However, this memo, issued by Scott Ochoa, City Manager, in 2021, is indeed stored on the City of Ontario’s Internal Performance Audit (IPA) SharePoint site. The presence of this document is verifiable through an audit report, directly contradicting the premise of the allegation.

Retention Policy and Document Search

The City’s policy to retain email for only one year naturally explains the IT Director's inability to find a document from three years ago. Additionally, the search conducted by IT for "Documents and Data" related to the City Auditor’s request likely failed due to searching in incorrect locations, compounded by a lack of transparency in the search process, including which documents and keywords were searched.

Assignment to Case XX

The allegation misrepresents the timeline and nature of the City Auditor’s involvement with Case XX. The City Auditor was assigned to the case on 11/30/2023, predating the HR Investigator's recommendation to file the case as a suspicious incident report on 12/6/2023. Public records confirm no such report was filed between 11/25/2023 and 1/3/2024 (Exhibit 32), and documentation of Case XX, provided to the City Auditor, supports this timeline. Furthermore, the Management Services Director’s “Audit Plan Development” directive memo (which violates the Standards) only requires audits to receive authorization prior to performance of audit procedures.

Mischaracterization of Beliefs and Authority

Claims that the City Auditor subscribes to conspiracy theories or lacks the authority to access confidential City documents and data are baseless. The City Auditor’s investigations are conducted with professional due diligence, not driven by unfounded theories. Moreover, explicit memorandums from the City Manager, alongside industry standards, grant the City Auditor full authority to access all City documents and data necessary for their duties.

Misinterpretation of Communications

The allegation misconstrues the involvement of Ms. McNaughton in the email request process, suggesting undue influence. Ms. McNaughton’s own testimony clarifies that she requested to be copied on the email and was copied on the email, indicating compliance and transparency in the document request (Exhibit 22). Furthermore, the request was not requested through an inappropriate means. It was submitted through official City email accounts while copying senior management (Assistant IT Director) on the request after being told to do so by senior management.

Misclassification of Work Email as Confidential

It is essential for City leaders, City employees and the Public to understand that all communications sent or received through a government email account constitute government documents. There exists no expectation of confidentiality for these emails, as they are subject to public records laws and transparency requirements inherent in government operations. This principle underscores the City Auditor’s rightful access to such communications as part of their investigative and oversight responsibilities, further negating claims of unauthorized document access. While sensitive documents may exist in the City leadership’s email accounts, those documents are City documents and data, and subject to review for fraud, waste and abuse.

Public Records Act (PRA) Request

The assertion that Mr. Neumann submitted an official Public Records Act (PRA) request is incorrect; the City’s exhibits did not include such a request, nor the results of the missing PRA request. PRA Requests are themselves public records are requestable by the public. The City investigators’ demonstrably false statement appears intended to harm Mr. Neumann's credibility and professional reputation. It represents yet another inaccuracy in the City investigator's report, further undermining the credibility of the allegations and calling into question the City's ability to conduct a proper self-investigation.

Question of Malicious Intent

The allegation fails to articulate any plausible malicious intent or personal benefit that the City Auditor could gain from these actions, suggesting a lack of substance to the claims of impropriety. The only malintent related to Case XX is for City leadership to prevent the City Auditor from performing his due diligence in monitoring “all internal processes and procedures to eliminate waste, fraud and abuse.” The investigator’s unsupported claim that the City Auditor acted for personal gain is not credible. The only reason why he performed the investigation is because he is serving in a position of public trust and must investigate allegations of fraud, waste and abuse.

In conclusion, the allegations that the City Auditor performing his duties somehow exceeds his duties are not only unsupported by evidence but are contradicted by documented facts and procedural clarifications. The City Auditor’s actions were within the scope of his authority and responsibilities, adhering to established policies and the interest of upholding integrity and accountability within the City’s operations. Furthermore, the City Auditor did not breach any confidentiality agreements or mishandle confidential information.

Exhibits 31-33

28 of 34

The Role of Independence and Objectivity While Auditing Public Government (1 of 2)

“Observing integrity, objectivity, and independence in discharging their professional responsibilities helps auditors serve the public interest and honor the public trust.”

�~ GAO Government Audit Standards (2018)

28

Source: United States, Comptroller General. (2018) Government Auditing Standards: 2018 Revision (“Yellow Book”)�(GAO GAGAS Standard 3.07). Retrieved from https://www.gao.gov/assets/gao-18-568g.pdf (Exhibit 30)

Public confidence in government is maintained and strengthened by auditors performing their professional responsibilities with integrity. Integrity includes auditors performing their work with an attitude that is objective, fact-based, nonpartisan, and nonideological with regard to audited entities and users of the audit reports. GAO GAGAS Standard 3.09

Auditors and audit organizations maintain their independence so that their opinions, findings, conclusions, judgments, and recommendations will be impartial and will be viewed as impartial by reasonable and informed third parties. - GAO GAGAS Standard 3.22

29 of 34

The Role of Independence and Objectivity While Auditing Public Government (2 of 2)

Public confidence in government is maintained and strengthened by auditors performing their professional responsibilities with integrity. Integrity includes auditors performing their work with an attitude that is objective, fact-based, nonpartisan, and nonideological with regard to audited entities and users of the audit reports. GAO GAGAS Standard 3.09
Auditors and audit organizations maintain their independence so that their opinions, findings, conclusions, judgments, and recommendations will be impartial and will be viewed as impartial by reasonable and informed third parties. GAO GAGAS Standard 3.22

29

30 of 34

IIA Standards (2017): Glossary Definitions

30

31 of 34

31

32 of 34

32

City Manager

Assistant City Manager

Management Services Director

City Auditor

Internal Auditor

Chief of Police

Executive Directors

33 of 34

Internal Audit Committee Members

City Manager
Assistant City Manager
Management Services Director

33

IAC Members:

City Manager
Assistant City Manager
Executive Director of IT
Executive Director of Finance
Executive Director of CLC

Establishment of the Internal Audit Committee (IAC) memo,

Issued by Scott Ochoa, City Manager, May 13, 2020.

34 of 34

34

Exhibit 32

No Police Report Filed for Exhibit 14’s Whistleblower Report

City of Ontario’s Retaliation Against City Auditor