Auditor releases findings of County of Maui Fraud Risk Assessment, identifies gaps

The Office of the County Auditor transmitted a County of Maui Fraud Risk Assessment to the County Council and Mayor on Wednesday.  The Assessment was prepared by Spire Hawaii LLP, an independent contractor of the Office of the County Auditor. 

According to the report, the County’s awareness of fraud risk increased in recent years because of incidents involving County employees. The report assessed the fraud risk and antifraud processes of 20 executive departments to determine whether existing fraud controls are adequate.

The report found that existing controls are not adequate to mitigate likely fraud risks because they do not cover significant areas of fraud exposure. According to the report, coverage gaps include:

• There are no controls designed to mitigate fraud risk when Procurement Law is suspended by emergency proclamations.
• There is no countywide nepotism policy.
• Comprehensive fraud monitoring programs and procedures have not been established for vendors who perform outsourced County services.
• Except for public safety, law enforcement, parks and recreation, and selected fiscal positions, existing hiring processes do not focus on screening job applicants for fraud risk.
• There are gaps in countywide procedures for approving and monitoring overtime to ensure overtime is properly paid, fraudulent claims are prevented, and compliance risk from federal and state overtime laws are mitigated.
• Conflicting statements and unclear oversight roles between the Department of Water Supply and the Department of Finance have created uncertainty about how the Department of Water Supply’s fiscal and procurement processes are reviewed and monitored.

The report also found that there is no countywide process for reporting, investigating and responding to fraud. “Instead, multiple County entities receive, investigate, and make decisions on fraud incidents. Each uses their own processes and standards, resulting in confusion and potentially inconsistent dispositions of fraud incidents and sanctions,” according to the report.

The County Auditor made five recommendations to address these findings, and while the County disagrees with certain findings, it expressed agreement with recommendations made in the report.

The report concluded that the County’s antifraud program was at the lowest, or ad hoc level of maturity, “because the County’s existing controls were not the products of a design process, but were developed and implemented in an ad hoc or reactive manner.” The report suggests that the County “consider developing a fraud mitigation program through a process of continual improvement, where fraud risks are identified, mitigation strategies are developed and evaluated for effectiveness, and efforts are made to create and maintain an organizational culture that supports fraud risk management.”

The County of Maui expressed disagreement with the assessment, but agreed there are many ways to improve.

“Based on the limited scope of work performed that was restricted to interviews, information unconfirmed with key personnel and missing actual validation testing… it would be impossible for the assessment to affirmatively determine this,” County Managing Director Josiah Nishita wrote in a response letter dated Jan. 7, 2026.

Top fraud types identified in the report include: (1) corruption; (2) billing schemes; (3) non cash misappropriation; (4) cash larceny; and (5) payroll schemes.

The report also ranked the departments that pose the greatest potential for fraud risk, noting that those with the most revenues could be expected to experience the greatest fraud losses. The rankings indicate that the five departments with the greatest potential exposure to fraud risk are: (1) the Department of Finance; (2) the Department of Environmental Management; (3) the Department of Public Works; (4) the Maui County Emergency Management Agency; and (5) the Department of Water Supply.

It was noted that calculations of the departments’ fraud risk rankings using the Association of Certified Fraud Examiners finding, illustrate relative finance exposure, and do not reflect known fraud or actual risk.

“We want to emphasize that the rankings should only be used as a starting point for a wider assessment of other factors that could contribute to departmental fraud risk,” the report noted, with increased risk arising with new departments, departments with new programs, and departments that will receive significant new revenues.

The County of Maui Department of Management responded to the report in a 15-page letter from Managing Director Josiah Nishita.

Nishita wrote: “The Administration takes your observations seriously and welcomes your recommendations. Though we may disagree on some areas within the draft report, the additional improvements and recommendations provided will help us in our commitment to further enhance and strengthen our internal controls framework, maintain moral integrity, and mitigate fraud risks to protect our taxpayers’ interests and maintain their trust.”

Nishita said the county looks forward to assessing and/or implementing fraud risk management best practices, including:

1. Creating an organizational culture and structure conducive to fraud risk management.
2. Establishing a Fraud Risk Management policy that demonstrates the organization’s commitment to high integrity and ethical values regarding managing fraud risk.
3. Planning more regular fraud risk assessments and assess risks to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing fraud control activities, and implement actions to mitigate residual fraud risks.
4. Designing and implementing a strategy with additional specific preventive and detective fraud control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation.
5. Establishing a more unified or centralized communication process to obtain information about potential fraud and deploy a coordinated approach to investigation and corrective action to address fraud appropriately and in a timely manner.
6. Evaluating outcomes using a risk-based approach and adapt activities to improve fraud risk management. Preformign ongoing evaluations to ascertain that all fraud risk management components are present and communicate deficiencies to the parties responsible for taking corrective action.

The full County of Maui Fraud Risk Assessment report is posted online here.