Mark Decker CISSP
IT and cybersecurity
Mark brings experience as a county Chief Information Officer and Chief Information Security Officer. He supports reviews of technology operations, security, and system reliability.

Performance & internal audits
A nimble team of senior auditors serving state and local governments. We listen, observe, and analyze the evidence to answer difficult questions.
Explore our work
We evaluate operations against established criteria and verifiable evidence. Our role is to help public officials and communities understand what is working, what needs attention, and why.
Audit standards
Government Auditing Standards
GAGAS · The Yellow Book
IIA Global Internal Audit Standards
Applied as appropriate to each engagement’s scope and requirements.
Specialist credentials
Julian Metcalf holds the Certified Fraud Examiner (CFE) credential from the Association of Certified Fraud Examiners (ACFE) and the Certified Construction Auditor (CCA) credential.
Professional standards
We use Government Auditing Standards (GAGAS) and the IIA Global Internal Audit Standards, as appropriate to each engagement.
Selected clients
Serving communities of different sizes, regions, and perspectives.









How we work
Every organization has its own history, constraints, and ways of working. Understanding that context is part of the audit.

People and context
We talk with staff and leadership to understand how the organization works, the constraints people face, and the questions that need closer attention.
Listening helps us understand the decisions and organizational dynamics behind the records.

Operations and evidence
Site visits, process walkthroughs, and document testing show how written policies translate into daily operations.
We follow the work, compare accounts with records, and examine where practice and expectations diverge.

Evidence and conclusions
We examine the records, talk with the people doing the work, and test what we are told. This helps us understand why problems occur and what can improve.
Our senior team tests explanations and follows new evidence as the work develops. We explain what we found and recommend practical changes.
We connect records and operational data, test assumptions, and follow patterns that deserve a closer look.

Comparing activity across days and hours helps test whether staffing matches service demand. This figure from our 2025 animal care services audit shows alignment between the standard shift and recorded activity. Figure 4.2, report page 36.

Looking beyond a net total reveals the range of cost increases, credits, and no-cost changes. Figure 1.2 from our construction change-order audit, report page 10. The analysis uses reported records; see the report for data completeness and reconciliation limitations.

An analytical example combining the frequency and location of speeding incidents to support closer review.
See how this approach applies across the audits, studies, and public-sector work in our experience.
Explore our full experienceGPP Audit Hub

Clients can access GPP Audit Hub to follow audit progress and monitor compliance items. We also use the Hub internally to monitor project progress, track continuing professional education, and support our adherence to GAGAS, IIA standards, and other professional standards for quality and independence.
Selected public reports
Our experience extends beyond these publications. Some engagements result in non-public reports.
GPP reviewed expenditure records, staff time, and support services to estimate the cost of administering federal education funding. We also interviewed staff to understand work that was not charged directly to federal programs.
For fiscal years 2022-23 through 2024-25, the audit estimated $8.1 million to $12.2 million a year in support costs not billed to federal awards. We examined how state and federal requirements overlap and which costs could be recovered.
The report explained the state’s share of these costs and recommended ways to improve tracking and recover eligible costs where practical.
Read the full public report ↗GPP examined construction change orders for BART’s independent Office of the Inspector General. We reviewed records and controls to assess how changes were monitored and where costs or risks could be missed.
The audit found gaps in independent monitoring, data quality, compliance records, and project planning. It also explained why a low net change-order total can be misleading when credits offset large cost increases.
We recommended clearer oversight responsibilities, better records, and stronger planning practices. BART’s OIG reported that management agreed with all recommendations.
Read the full public report ↗GPP reviewed Sacramento’s Animal Care Services Division through site visits, staff interviews, analysis of operating records, and comparisons with other agencies. We examined how staffing and daily work affected the care and services the Division could provide.
The audit found problems with vacancies, veterinary delays, field-service oversight, and public reporting. It made 31 recommendations across ten findings, covering capacity, recruitment, procedures, licensing, and other program responsibilities.
Recommendations addressed both staffing needs and changes to how work was organized. Analysis of activity by day and hour helped assess whether staffing matched service demand.
Read the full public report ↗GPP reviewed the Port of Richmond’s management, operations, and finances. We visited facilities, interviewed City staff and tenants, examined leases and financial records, and compared practices with other ports.
The audit found gaps in long-term planning, written procedures, maintenance oversight, and financial monitoring. It also examined how the Port selected tenants, checked reported cargo volumes, and monitored lease requirements.
We recommended a strategic plan, clearer responsibilities, better records, and dedicated maintenance and finance management. These recommendations gave the City specific steps to improve day-to-day operations and plan for the Port’s future.
Read the full public report ↗GPP independently reviewed Berkeley’s Payroll Audit Division. We interviewed staff, surveyed departmental payroll clerks, analyzed payroll records, and tested transactions to assess accuracy and controls.
Testing found no material payroll errors that the Division had not already identified and corrected. Staff were managing complex pay rules, but outdated guidance, manual data entry, and prefilled timecards created extra work and risk.
The audit made seven recommendations. These included a shared payroll manual and electronic timekeeping, with work coordinated across Payroll Audit, Human Resources, Information Technology, and City management.
Read the full public report ↗GPP reviewed four years of expenses under a water recycling agreement for the Monterey County Water Resources Agency and the County Auditor-Controller. We compared charges with the agreement, examined supporting records, and reviewed financial controls.
The audit estimated $1.11 million in indirect cost overcharges and recommended reimbursement. It also found inconsistent time records, missing monthly reports, and accounting practices that made the Agency’s funds difficult to track.
We recommended correcting the cost allocation method, strengthening records and reporting, and updating the agreement to clarify responsibilities. The public report packet includes the agencies’ responses.
View the public report and board materials ↗Explore the wider range of audits, studies, and public-sector work behind our practice.
Full experienceOur people
Our senior auditors do the work directly. We listen to staff and leadership, examine the evidence, and consider how the organization works.

Julian has led audits and studies for local governments, with experience in San Francisco, Santa Clara County, and Moody’s Investors Service. His work connects public operations and financial analysis.

Ofu’s experience spans compliance, performance, and management audits for government and private-sector organizations, including work on internal controls and risk management.

Eric combines government auditing with experience in local government management, consulting, and training. His work includes compliance, performance, program, and management audits for state and local governments.
Mark and Stephen join engagements when their expertise fits the scope.
IT and cybersecurity
Mark brings experience as a county Chief Information Officer and Chief Information Security Officer. He supports reviews of technology operations, security, and system reliability.
Transit and asset management
Stephen’s experience includes transit engineering, maintenance planning, and asset management, including work as a Senior Director at New York City Transit. He supports reviews of transit operations, asset condition, and reliability.
Recent peer review ↗
August 25, 2025
GAGAS · IIA Global Internal Audit Standards
Independent judgment. Verifiable evidence.