"???Without formal policies and procedures including risk assessment and monitoring procedures, the county increases its risk of fraud,??? the report stated." . . . . .