Internal Audit Follow-Up
Report
Accounts Payable Audit
TxDOT Audit Office
Accounts Payable
TxDOT Internal Audit – MAP Follow-Up
Objective
Assess the status of corrective actions for high risk Management Action Plans (MAPs)
previously communicated in Accounts Payable Audit Report issued March 11, 2013.
Summary Results
Testing included an evaluation of 3 MAPs to determine if corrective actions were
implemented as agreed.
MAP Status
1 Closed
Comments
Corrective actions have been completed.
2 Open
Corrective actions that require completion to address identified risks
from the original audit report.
0 New
Corrective actions that were newly identified and further actions are
necessary to properly address the remaining risks.
Scope
The audit was performed by Alma Alvarez and Vivian Cohn (Engagement Lead). The audit
was conducted during the period from July 9, 2013 to July 31, 2013.
Methodology
The audit work included:
 Testing a sample of employee access rights in the automated financial system
 Selecting and testing a sample of possible duplicate payment transactions for the
months of May and June 2013
 Reviewing procedures, reports, and training documents for Quality Control and
Duplicate Payments areas
 Interviewing process owners and key personnel
Background
This report was prepared for the Transportation Commission, TxDOT Administration and
Management. The report presents the results of the Accounts Payable Follow-Up Audit
Report which was conducted as part of the Fiscal Year 2013 Audit Plan.
In 2009, TxDOT adopted the Spirit of Sarbanes-Oxley (SOX) in response to the federal SOX
Act of 2002 and engaged Deloitte for a project involving identification of key controls to
prevent or detect material financial misstatement. Based on the State Auditor’s Office
(SAO)’s 2012 financial and audit report recommendation, TxDOT contracted with Crowe
Horwath, LLC to conduct a financial reporting risk assessment and to assess and improve
the Spirit of SOX procedures developed in 2009.
August 22, 2013
2
Accounts Payable
TxDOT Internal Audit – MAP Follow-Up
All invoices are batched into vouchers in TxDOT’s Financial Information Management System
(FIMS) which is used to record obligations and payments to individuals or entities. Final
disbursements are made by the Comptroller of Public Accounts through the Uniform
Statewide Accounting System (USAS). The department processes approximately $32 million
per day on average, which represents roughly 2,700 vouchers processed per month.
We conducted this follow-up engagement in accordance with Generally Accepted
Government Auditing Standards and in conformance with the International Standards for
the Professional Practice of Internal Auditing. Those standards require that we plan and
perform the engagement to obtain sufficient, appropriate evidence to provide a reasonable
basis for our conclusions based on our engagement objectives. We believe that the
evidence obtained provides a reasonable basis for our conclusions based on our
engagement objectives.
August 22, 2013
3
Accounts Payable
TxDOT Internal Audit – MAP Follow-Up
Detailed MAP Follow-Up Report and Status
MAP Status: Open
Corrective actions that require completion to address identified risks from the
original audit report.
Original Audit Finding Number 2: Utilization of the Sample Audit Key Control
MAP Owner: Lanny Wadle, Deputy Finance Division Director
Paul Campbell, Payments Management Section Director
MAP 2.1 – The control activity was suspended during a period of employee turnover due to
retirement and constrained resources, approximately August 31, 2011. A new employee was hired
in October 2012 and is assigned the primary task of performing a Quality Control review of
randomly selected vouchers submitted for payment. The employee will retain the list of vouchers
that are randomly selected for review and incorporate the information into a spreadsheet. This
employee will contact the applicable voucher processors with questions, suggestions, or for any
other purpose arising from their review. Documentation of notable findings or necessary changes
are recorded on an excel spreadsheet and saved on the network drive with password protection.
Management will review quarterly for performance management, training and improvement
purposes. Future staffing plans include hiring a second employee to this renamed Quality Control
unit to increase the value of our review effort even further.
We will also re-evaluate key controls in this area to reflect best practices as considered appropriate
by management within its tolerable level of risk.
Original Completion Date: April 15, 2013
Revised Completion Date: November 15, 2013
Original Audit Finding Number 4: Duplicate Payments
MAP Owner: Lanny Wadle, Deputy Finance Division Director
Paul Campbell, Payments Management Section Director
MAP 4.1 – We will train voucher processors on documenting steps to follow when a system warning
is observed and on resubmittal process and practices.
We will coordinate with General Services Division (GSD) for effective communication to 3rd parties
and management of 3rd party performance under agreements, particularly, when duplicate
payments are routine and display a consistent pattern of occurrence.
We will develop procedures to document in the voucher deck anytime systems controls are
August 22, 2013
4
Accounts Payable
TxDOT Internal Audit – MAP Follow-Up
disregarded including the reason the system warning is disregarded and the supervisor’s approval
of the adequate explanation provided by the voucher processor for the decision to disregard.
We will develop written procedures to document the review process of the report for “potential
duplicate payments” including definition of the process, procedures to research and document final
disposition for items on report. Further, we will establish accountability for reporting and
collections, to include TxDOT’s debt collection procedures and timing as necessary, if items are
determined to be a duplicate. We will establish a process to perform root cause analysis for items
that are determined to be a duplicate payment.
We will re-evaluate key controls in this area to reflect best practices as considered appropriate by
management within its tolerable level of risk and adjust documentation and processes accordingly.
Original Completion Date: April 15, 2013
Revised Completion Date: November 15, 2013
Closing Comments
The results of this MAP Follow-Up engagement were discussed with/provided to Finance
Division on August 6, 2013. The audit team appreciates the cooperation and assistance
received during this engagement.
August 22, 2013
5