Loading...
10/20/2015 Audit Follow-Up . ; AMY HEAVILUN, CPA CLERK OF CIRCUIT COURT & COMPTROLLER '`i 1` MONROE COUNTY FLORIDA INTERNAL AUDIT DIVISION Reuben Iyamu,MBA,CFE,Director Audit Follow-Up BOCC P-Card Audit (Issued July 07, 2014) Re a ort #16-01 October 20, 2015 Summary Eighteen of the 22 recommendation steps developed to address the findings identified in the Purchasing Card audit report (issued on July 7, 2014) have been completed or resolved. Efforts have been initiated and/or in progress to resolve the remaining four recommendation steps. In view of these successful efforts to date, the four remaining recommendation steps that are in progress have been turned over to the Monroe County Board of County Commissioners (BOCC) management for their final resolution and disposition. The resolved/completed recommendation steps include: • BOCC management submitted the record of staff reimbursement (along with applicable monthly bank statement) to the Clerk's Finance Division. • BOCC management established and implemented policies to ensure proper administration of its P-Card program. • BOCC management developed an "Action Form" and has commenced using that form to report identified P-Card policy violations to the County Administrator and the County Attorney for applicable disciplinary action. • Process is in place for the County Administrator to take appropriate disciplinary action on any reported P-Card policy violation. • Process is also in place for the County Administrator to notify the Clerk's Finance Division of any disciplinary action resulting in loss or restriction of cardholder privileges. • Revised P-Card policy is accessible to all County staff, and all cardholders are required (on an annual basis)to review the P-Card policy and sign an acknowledgment statement. • BOCC management successfully recovered the $718.88 of inappropriate P-Card charges from the applicable cardholders. • P-Card Administrator reviews monthly cardholder bank statements prior to submission of those statements to the Clerk's Finance Division. • Process is in place for the P-Card Administrator to notify all parties described in the BOCC P-Card policy of any reported lost or stolen P-Card. 1 Audit Follow-Up: Report#16-01 • Cardholder agreements were executed with all active cardholders. • The established form for requesting new P-Cards or to make changes to existing P-Cards has been revised to include provisions for the P-Card Program Administrator and the County Administrator or designee's signature/approval. • Process is in place to ensure P-Cards are deactivated upon cardholder termination. • "Daily Purchase Card Purchase Report" is being signed by appropriate County personnel. • BOCC management has determined that the current P-Card policy provision regarding proper approval of the "Daily Purchase Card Purchase Report" does not warrant revision of the policy. • BOCC management established a process to ensure only one P-Card is assigned to each cardholder. • BOCC management has segregated key responsibilities and functions of P-Card administration to preclude errors and inappropriate actions by staff. • BOCC management has established procedures to account for received travel/airline related credits. • Access to Bank of America Web-Based System was provided to a Clerk of Court designated staff. Actions that were initiated and/or in progress to address recommended steps but which are not yet finalized include: • Making appropriate effort to recover the remaining $253 of inappropriate P-Card payments made for AT&T Internet Services. • Ensuring P-Cards are deactivated timely upon cardholder termination. • Ensuring Bank of America monthly statements are submitted timely to the Clerk's Finance Division. • Ensuring appropriate County staff is designated as the recipient of the annual inventory list of issued P-Cards. We appreciate the full cooperation and assistance provided by applicable BOCC and Clerk of Court staff during this follow-up process. Objectives, Scope, and Methodology The purpose of this follow-up audit was to report on the progress and status of efforts by the Board of County Commissioners (BOCC) management to complete or resolve the findings and recommendations on the audit report issued on July 7, 2014. This is the first and final follow-up on the recommendation steps issued to address the reported audit findings. To determine the progress and status of the recommended steps, we obtained and reviewed relevant records, interviewed knowledgeable staff, and selected/tested sample transactions. Except for the compliance with Section 1321-1(2) of the Standard issued by The Institute of Internal Auditors which requires that the Internal Audit Division obtain an external assessment at least once during each five-year period, we conducted this follow-up audit in accordance with the International Standards for the Professional Practice of Internal Auditing. Departure from this specific requirement does not affect the result of this follow-up audit in any way. The standards 2 Audit Follow-Up: Report#16-01 require we plan and perform the follow-up audit to obtain sufficient, appropriate evidence to provide reasonable basis for our findings and conclusions based on our follow-up audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit follow-up objectives. Backurourrd The intent of the BOCC Purchasing Card(P-Card) program was to reduce the transaction cost of procuring goods and services and enhance timeliness of purchases through administrative efficiencies. Savings are realized by not having to generate checks and timeliness is enhanced because lesser procedures and fewer staff are needed to initiate and process transactions. Notwithstanding these positive attributes of a P-Card program, there are inherent risks associated with the program that must be addressed through effective internal controls. Accordingly, the BOCC established policies and procedures primarily to serve as internal controls designed to, among other things, prevent unauthorized and inappropriate purchases with County P-Cards. At the request of the Monroe County Clerk of Circuit Courts and Comptroller, the Clerk's Internal Audit Division conducted an audit to determine whether the BOCC P-Card program was operating efficiently, effectively, and in accordance with the established policies and procedures. Previous Conditions and Current Status In the original audit report issued on July 7, 2014, we identified several risks that indicated the need for improvement and enhancement of processes and controls over the BOCC P-Card program. A total of 22 recommendation steps were issued to address the 17 reported audit findings. Table 1 below provides a description of each of those 22 recommendation steps and their current status. As shown on the table, BOCC management has successfully completed or resolved 18 of the 22 recommendation steps. The remaining four steps that are in progress are being referred to management to ensure proper resolution and disposition. Table 1 Recommendation Steps (From Audit Report Issued on July 7,2014) and Their Current Status Recommendations Current Status • Per the Cardholder Agreement, the ✓ Completed- As part of our follow-up review, Purchasing Card Administrator should we selected and examined three monthly submit the reimbursements with the statements that were submitted to the Clerk's Monthly Statement to the Clerk's Finance Finance Division and found one of the three Division. NOTE: Auditor subsequently monthly statements included records for a $6 clarified this step to indicate that reimbursement by BOCC staff. The staff had documentation/proof/copy of inappropriately paid the $6 to a vendor as reimbursement be submitted with the Florida sales tax while purchasing an iPhone Monthly Statement, not the original case with a County P-Card. Accordingly, we payment. considered this step completed and resolved. 3 Audit Follow-Up: Report#16-01 • Monroe County Department Directors, the ✓ Completed - During our follow-up review, Purchasing Card Administrator and the we noted BOCC management County Administrator should properly established/implemented processes and administer the Monroe County Board of revised/enhanced P-Card policies to ensure County Commissioners Purchasing Card proper administration of its P-Card program. Policy and Procedures. Accordingly, we consider this step completed and resolved. • The Purchasing Card Administrator should ✓ Completed - During our follow-up review, report all Cardholder violations of BOCC we found BOCC management developed a Purchasing Card Policy and Procedures to standard form ("Action Form") for use in the County Administrator for disciplinary reporting P-Card policy violations to the action and/or loss of privileges. County Administrator and the County Attorney. We reviewed selected monthly bank statements for cardholder violations and noted a few policy violations that were rightly reported to the County Administrator and the County Attorney for applicable disciplinary action. Accordingly, we consider this step completed and resolved. • The County Administrator should enforce ✓ Completed - As described in the immediately applicable disciplinary action and loss of preceding step, BOCC management has privileges for continual Cardholder misuse. established a process for reporting cardholder violations to the County Administrator and the County Attorney. Our review also showed noted cardholder violations were reported to both the County Administrator and the County Attorney. In response to our inquiry on this matter, BOCC management staff indicated no disciplinary actions were taken as the few reported P- Card policy violations did not warrant disciplinary actions. Accordingly, we consider this step completed and resolved. • The County Administrator should notify I Completed - As addressed in the the Clerk's Finance Division of any immediately preceding step, BOCC Cardholder loss or restriction of management staff indicated no disciplinary Cardholder privileges. actions were taken as the few reported P- Card policy violations did not warrant disciplinary actions. In response to our further inquiry on this matter, BOCC management indicated should the County Administrator or the County Attorney take any disciplinary action on a P-Card policy violation that resulted in loss or restriction of 4 Audit Follow-Up: Report#16-01 cardholder privileges, the Clerk's Finance Division will be promptly notified. Additionally, we noted during our follow-up review of an instance where due to the occurrence of inappropriate charges on her County issued P-Card (i.e., a P-Card policy violation); a cardholder voluntarily returned her P-Card and ordered her account to be closed. That incident was properly reported to the Clerk's Finance Division. Accordingly, we consider this step completed and resolved. • Monroe County Staff and Cardholders V Completed — The revised BOCC P-Card should reeducate themselves on the policy has been approved by the board and Monroe County Board of County posted on the County's website for access by Commissioners Purchasing Card Policy all County staff. According to BOCC and Procedures concerning disallowed management staff, County employees and purchases. cardholders were informed of the revised policy via email that the revised policy has been posted on the County's website for their access. In addition, BOCC management indicated that going forward, cardholders will be (1) periodically reminded of items that are not allowed to be purchased with BOCC P-Cards and (2) required (on an annual basis) to review the applicable P-Card policy and sign an acknowledgment statement. Because of these actions and indications, this step is considered completed and resolved. • The Purchasing Card Administrator should ✓ Completed - The $718.88 of inappropriate P- have the noted outstanding charges Card charges that were reported in the initial resolved and/or reimbursed by the audit as unpaid/unresolved have been Cardholder immediately. successfully recovered from the applicable cardholders and/or resolved. Accordingly, we consider this step completed and resolved. • The Purchasing Card Administrator should ✓ Completed - The Purchasing Card review the submission of the Monthly Administrator reviews monthly cardholder Statement to the Clerk's Finance Division bank statements prior to submission of those for completeness and proper statements to the Clerk's Finance Division. 5 Audit Follow-Up: Report#16-01 documentation. In addition, the P-Card Administrator developed and uses a spreadsheet to track cardholder purchasing activities and to identify any applicable inappropriate charges. Accordingly, we consider this step completed and resolved. • Monroe County Staff should pursue • In Progress: Turned Over To Management - immediate reimbursement of these charges. Efforts were made and are ongoing to recover the $253 (i.e., $70, $60, and $123) remaining balance from the $441 total inappropriate P-Card payments made for AT&T Internet Services. Because of the actions initiated and are being taken, responsibility to ensure final resolution/completion of this step is turned over to BOCC management. • The Purchasing Card Administrator should ✓ Completed - During our follow-up period, ensure that all parties listed in the BOCC there were no reported lost or stolen P-Cards. Purchasing Card Policy and Procedures are BOCC management indicated that should notified when she processes a card as any P-Card be declared lost or stolen, all Lost/Stolen. appropriate parties described in the BOCC P- Card policy will be promptly notified. Accordingly, this step is considered completed and resolved. • The Purchasing Card Administrator should ✓ Completed - Our follow-up review showed a ensure that a "Cardholder Agreement" is cardholder agreement was executed with and executed by all Cardholders prior to by all current active County cardholders. issuance of a BOCC Purchasing Card. Based on this action taken by BOCC management, this step is considered complete and resolved. • The "Request for Purchasing Card" form ✓ Completed - The BOCC form for requesting should be altered to include a a new P-Card or to make changes to an signature/approval line for the Purchasing existing P-Card (i.e., "Request for Card Program Administrator and/or Budget Purchasing Card" form) has been revised to & Finance Division Director. make a provision for the Purchasing Card Program Administrator and the County Administrator or designee's signature/approval. Based on this action taken by BOCC management, this step is considered complete and resolved. • Monroe County should audit their Human • In Progress: Turned Over To Management - Resource employee files and add the Through inquiry and from our follow-up Purchasing Card to or complete an review, we determined that P-Cards are additional "Property/Equipment Tracking deactivated upon cardholder termination. 6 Audit Follow-Up: Report#16-01 Form" for all current Cardholders. However, our review also showed terminated cardholder P-Cards were not always deactivated timely. In addition, BOCC management evaluated the current process for using the "Property/Equipment Tracking Form" to track the issuance and deactivation of P-Cards and determined that the use of the tracking form was not effective and efficient and will therefore no longer be used to track the issuance and deactivation of P-Cards. To ensure P-Cards are deactivated upon cardholder termination, the department director is expected to notify the P-Card Administrator of a cardholder termination. Upon receipt of that notification, The P-Card Administrator will deactivate the cardholder's P-Card. We recommend BOCC management take such actions to ensure P- Cards are promptly deactivated upon cardholder termination. Responsibility to ensure final resolution/completion of this step is turned over to BOCC management. • When a Purchase Card is issued, Monroe ✓ Completed - As described in the immediately County Supervisors, Department Directors preceding step, BOCC management will, as and the Purchase Card Administrator an alternative to using the should work together to ensure that a "Property/Equipment Tracking Form, ensure "Property/Equipment Tracking Form" is P-Cards are deactivated upon cardholder completed and sent to the Human termination by requiring all department Resources office to be placed in the directors to notify the P-Card Administrator employee's official personnel file in of cardholder termination. The P-Card accordance with Monroe County Administrator will in-turn deactivate the Administrative Instruction 4725. cardholder's P-Card. Accordingly, this step is considered completed and resolved. • "Daily Purchasing Card Purchase Report" ✓ Completed - "Daily Purchase Card Purchase forms should be certified by the Report" forms are being signed by Cardholder and verified by the appropriate parties including the applicable Cardholder's immediate supervisor, cardholder, department head, and P-Card Department Director and finally the Administrator. Accordingly, we consider this Purchasing Card Administrator. step completed and resolved. • The Board of County Commissioners ; ✓ Completed - BOCC management evaluated should evaluate the current Purchasing ' the current policy regarding the proper Card Policy and Procedures which does not . approval of the "Daily Purchase Card address the proper approval of the "Daily Purchase Report" and subsequently Purchasing Card Purchase Report" for the ; determined that a policy revision was not County Administrator, County Attorney warranted. BOCC staff also indicated 7 Audit Follow-Up: Report#16-01 and Commissioners and possibly amend or adequate controls are in place to ensure the update the policy to address these P-Card Administrator reviews the instances. Elected/Appointed official's "Daily Purchase Card Purchase Report" for reasonableness, accuracy, and completeness. Accordingly, we consider this completed and resolved. • The Bank of America Purchasing Card • In Progress: Turned Over To Management - Statement monthly package should be All three of the Bank of America monthly submitted to the Clerk's Finance Division statements we selected and reviewed were in a more timely manner and prior to the paid after the Bank of America stipulated payment due date. payment due dates. The three bank statements were not paid timely due to late submission to the Clerk's Finance Division by BOCC staff. Two of the three bank statements were not received by the Clerk's Finance Division prior to the bank stipulated payment due dates. One bank statement was received only a day before the payment due date. In response to our inquiry on this matter, BOCC management staff acknowledged that the monthly bank statements should have been submitted more timely to the Clerk's Finance Division. To ensure payments to Bank of America are made timely, we recommend BOCC management enhance efforts to ensure Bank of America statements are submitted timely to the Clerk's Finance Division. Due to the actions initiated and are being taken, responsibility to ensure final resolution/completion of this step is turned over to BOCC management. • The Purchasing Card Administrator should ✓ Completed — BOCC management assessed immediately direct Bank of America to this recommendation step and subsequently provide a copy of the monthly billing determined that access to the Bank of statement to the Clerk's Finance Division America Web-based System ("Works") will pursuant to the Monroe County BOCC be provided to a designated staff at the Purchasing Card Policy and Procedures. Clerk's Finance Division. In response to our inquiry, staff at the Clerk's Finance Division confirmed that a designated staff has been provided access to the Bank of America Web-based System. Accordingly, we consider this step completed and resolved. • The Purchasing Card Administrator should ✓ Completed - The P-Card Administrator has review the active Purchasing Cards to commenced maintaining an up-to-date list of 8 Audit Follow-Up: Report#16-01 assure that Cardholders only have one active P-Cards. Our reconciliation of that list Card/Account number assigned to them at showed only one P-Card was assigned to a time. each of the listed cardholders. Accordingly, we consider this step completed and resolved. • Monroe County should strengthen the ✓ Completed - To strengthen internal controls, policy by implementing additional internal BOCC management hired a staff and is also controls; specifically the segregation of presently in the process of hiring one duties. This type of control is critical to additional staff to perform certain key reduce the risk of both erroneous and incompatible responsibilities and functions inappropriate actions as well as potential previously performed by the P-Card fraud. Administrator. These actions taken by BOCC management will help reduce the risk of error and inappropriate staff actions. Accordingly, we consider this step completed and resolved. • The policy should clearly identify who • In Progress: Turned Over To Management - receives the "list" provided by the BOCC management continues to assess the Purchasing Card Program Administrator. method in which to address this The recommended recipient would be the recommendation step. According to BOCC Board of County Commissioners. management staff, determination will be made as to who receives the annual inventory list of issued P-Cards. Because of this action and indication, responsibility to ensure final resolution/completion of this step is turned over to BOCC management. • Monroe County should develop a policy I Completed - We noted from our review and and procedure to account for travel/airline inquiry that BOCC management has related credits. There is an absence of established procedures to account for control over these credits and their proper travel/airline related credits. Specifically, use. There is exposure for loss and misuse BOCC management created a "Purchasing of County funds in this area. Card Activity Log" to track travel related refunds and credits received. With the recommendation that BOCC staff ensures all received and/or used travel related credits are properly and timely applied and communicated to the Clerk's Finance Division, we consider this step is considered completed and resolved. Table legend: • Recommendations from the original audit. 1 Recommendations addressed and resolved. • Action Initiated but not completed. 9 Audit Follow-Up: Report#16-01 Conclusion a As noted in Table 1 above, BOCC management has completed and resolved the majority (i.e., 18) of the 22 recommended action steps. Efforts were initiated and/or are in progress to complete the remaining four steps. Accordingly, we are turning these four remaining steps over to BOCC management for their final resolution and completion. Those four remaining recommendations steps include: • Making appropriate effort to recover the remaining $253 of inappropriate payments made for AT&T Internet Services. • Ensuring P-Cards are deactivated timely upon cardholder terminations. • Ensuring Bank of America monthly statements are submitted timely to the Clerk's Finance Division. • Ensuring appropriate County staff is designated as the recipient of the annual inventory list of issued P-Cards. We appreciate the cooperation and assistance of the applicable BOCC and Clerk of Court staff provided during this audit follow-up and commend them for their significant efforts to address the recommended action steps. Appointed Official's Responses County Administrator We are pleased the follow-up audit to the original Purchasing Card audit from July 2014 has been completed. While Monroe County has always maintained established policies and procedures of the Purchasing Card program, the audit allowed us to further document and enhance operational efficiencies. Even though the follow-up audit did not allow for revisions to the original findings, as noted, eighteen of the twenty-two original recommendations which were taken under advisement have been completed. The four remaining items have already been addressed and are in progress. With the enhanced documented procedures further mitigating any risk associated with the program, Monroe County has clearly demonstrated an efficiently and effectively operated Purchasing Card program. We would like to thank the new Internal Audit Director, Reuben Jyamu, and his staff for their professionalism and collaboration with the follow-up audit process. I 10 Audit Follow-Up: Report#16-01 t Copies of this audit report may be obtained from the Monroe County Clerk of Court's web site (www.clerk-of-the-court.com), by telephone (305)-295-3130, by FAX (305)-295-3663, by mail or in person (500 Whitehead Street Suite 101, P.O. Box 1980, Key West, FL 33040) Audit Conducted by: Reuben Iyamu, MBA, CFE, Director of Internal Audit Trisha Schroff, CFE, Internal Auditor 11