A REPORT FROM
THE OFFICE OF INTERNAL AUDIT
PRESENTED TO THE CITY COUNCIL
CITY OF BOISE, IDAHO
AUDIT / TASK:
#11-12, Status Report –
Previous Audit Findings
AUDIT CLIENT:
N/A
REPORT DATE:
May 18, 2012
AUDIT GRADE:
N/A
REPORT AUTHOR:
Steven Rehn CIA, CFSA
APPROVED FOR RELEASE:
Steven Rehn CIA, CFSA
AUTHORITY:
Boise City Code, 1-09-03
REPORT OF AUDIT ACTIVITIES
Task: #11-12, Periodic Status Report –
Previous Audit Findings
Introduction
Annually, the Office of Internal Audit commits resources to a number of projects
consisting of formal audits, consulting engagements, and various specialized
reviews. Based on the Office’s established policies and procedures, the projects
undergo a life-cycle that consists of the following distinct steps:
•
•
•
•
•
The engagements involve the establishment of specific objectives, and the
performance of work steps that are sufficient to allow Audit to formulate and
communicate recommendations to management relative to those objectives;
Each project is finalized with the publication of a formal report that includes
a presentation of Internal Audit’s final observations and recommendations;
Management supplies Internal Audit with either responses or action plans
that address the findings and concerns noted;
Audit pursues follow-up activities that allow the Office to gauge
management’s progress toward implementing corrective actions in areas
where such action is called for; and,
Internal Audit issues annual summary reports that depict the status of
findings and recommendations previously communicated to management
where corrective action was required.
The purpose of this report is to present the current status of issues that were
outstanding as of the last Status Report, #10-09; as well as findings that were
noted in Audit Reports issued since then, in conjunction with FY’11 projects.
Scope and Methodologies
Report #11-12 should be considered as informational only. Traditional scope
periods and coverage statements normally associated with Internal Audit
activities have not been established beyond an “as-of” date of December 31,
2011. The report covers all of the audits and engagements that were undertaken
and completed by the Office to date where there continue to be outstanding,
unresolved issues; or where corrective actions have been completed in the
interim.
Audit employed a number of methodologies during the follow-up contacts with
management and staff that typically consisted of inquiry, observation, and / or the
performance of limited testing. The objective in each case was to gain a
reasonable degree of assurance that corrective actions had either been
completed, or were progressing in a satisfactory manner.
2
REPORT OF AUDIT ACTIVITIES
Evaluation and Comments
The report has not been assigned a grade or any similar evaluation. However,
Internal Audit believes that when management’s pursuit of corrective actions has
been active and on-going, then they have demonstrated a satisfactory level of
responsiveness to the concerns voiced by Audit. This appears to hold true for
the entire cross-section of departments and divisions that were contacted during
the follow-up activities. Members of the City’s management team continue to
display a willingness to entertain, and to act on Audit’s recommendations by
pursuing corrective actions. As a result, areas of concern continue to be
addressed and deficiencies in controls, processes, and procedures corrected.
Internal Audit will continue to monitor these issues periodically, and will report on
their status as appropriate.
The incorporated document that follows (beginning on page 4) presents a
synopsis of the issues that were noted during previously completed
engagements. Management’s progress to date in correcting those issues, and
their current status is also included. When corrective actions are considered
complete, the items are designated as “Closed”; otherwise, they will continue to
be viewed as “Open” items that require some measure of remediation.
Please note that the incorporated document contains only a summarized version
of our Findings. The reader is urged to review the Audit Reports themselves (all
of which are available on the City’s web site) in detail in order to achieve a fuller
understanding of the issues, and of the associated responses received from
management in relation to our observations and recommendations.
3
From the Office of Internal Audit
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
08-08
Fire Assets - Contracts
Area Of Concern: Contract Administration
Audit Finding / Concern
Effective means of tracking action
items, and alerting management to
those events, are not in place.
Management Response
Fire's Admin Manager has created a
series of spreadsheet tools that
document various deliverables under the
contracts. The spreadsheets are
reviewed monthly for upcoming items,
which are acted on accordingly.
Contracts that are administered by Fire
Ops are managed through a series of
"tickler" items placed on calendars.
Current Status
Closed
Expired and/or un-ratified contracts
were present in the Department's
active contract files.
Fire has reorganized service units, and
established new accountabilities for
contracts. An inventory of contracts
has been assembled; expired contracts
were identified; new agreements
were negotiated where necessary
and desirable.
Closed
Controls and procedures are not
sufficient to ensure effective
administration of contracts. Rights
and responsibilities are not always
satisfied.
Fire's Admin Manager has created a
series of spreadsheet tools that
document various deliverables under the
contracts. The spreadsheets are
reviewed monthly for upcoming items,
which are acted on accordingly.
Contracts that are administered by Fire
Ops are managed through a series of
"tickler" items placed on calendars.
Closed
4
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
09-01s1
Sole Source Purchasing
Area Of Concern: Failure to Issue PO
Audit Finding / Concern
Purchases from vendor Lab Corp
totaled over $7,000.00. No PO was
issued.
09-01s3
Management Response
Deficiency was not identifiable by
Purchasing under current processes.
Issue has been incorporated into the
planning and design of the ERP Project.
Finding closed contingent on successful
implementation of ERP.
Current Status
Closed
Vendor Spending Analysis
Area Of Concern: Purchase Orders
Audit Finding / Concern
Due to soft controls and previous
exemptions, PO's were not always
issued for qualifying transactions.
Management Response
Compliance under PeopleSoft is largely
manual. DFA returns transactions that
lack PO's when these are detected.
Issue will be addressed / resolved by
anticipated functionality in the ERP
system currently in implementation.
Finding closed contingent on successful
implementation of ERP.
5
Current Status
Closed
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
09-03
IT Security Review
Area Of Concern: Improper Role Assignments
Audit Finding / Concern
Improper role assignments were noted
in relation to PO and Purchasing roles
and approvals. Two instances noted
where Administrator roles did not
appear to be properly assigned.
Management Response
IT has created reports that will enable
the Controller to work with
management to eliminate improper
assignments quarterly. Regular,
recurring reviews have not yet been
implemented.
Current Status
Open
Management Response
IT has created reports that will allow
the Controller to review assignments
with management, and reduce roles
where necessary. Regular, recurring
reviews have not yet been fully
implemented.
Current Status
Open
Area Of Concern: Mirroring of Roles
Audit Finding / Concern
Three BPD Finance staff possessed
broad, "mirrored" role assignments in
the areas of budget, purchasing, and
accounting entry capability.
10 CAFR
Annual Financial Audit
Area Of Concern: Deferred Property Taxes
Audit Finding / Concern
EideBailly detected an accumulated
Deferred Property Tax balance that
hadn't been properly recognized in
CAFR.
Management Response
Financial template tool has been
updated to incorporate this issue. Also
this item is now verified during the
annual closing process.
Current Status
Closed
Area Of Concern: Financial Statement Errors
Audit Finding / Concern
EideBailly detected several errors
within the financials that were
presented for testing. Combination of
rollover of tools from previous FY,
and missed CIP accruals.
Management Response
Issue has been reviewed with responsible
staff in various departments, and will be
presented again during closing process
meetings.
6
Current Status
Closed
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
10-01
Fire Staffing Analysis
Area Of Concern: Admin Overtime
Audit Finding / Concern
Overtime expenses are incurred
through the use of internal staff
resources to provide database
administration, and power-user
services. Additional expense is
associated with manual hydrant
mapping process.
Management Response
New reporting software has been
acquired and implemented that is
estimated to save $7,500 per year in
costs associated with "super-user" tasks.
Fire is working with IT in an effort to
transition additional database
responsibilities to that Department.
Current Status
Open
Management Response
Management implemented staggered
work shifts in March 2010.
Expectations for a 30% reduction in
Overtime were realized. FY10 and
FY11 are seeing an average reduction of
approximately 37% per month.
Current Status
Closed
Area Of Concern: Logistics Overtime
Audit Finding / Concern
Reason / support for overtime hours
booked in Logistics has not historically
been captured. Management's ability
to analyze, and improve upon these
expenses is impaired. Mapping tasks
are also incurred in this division.
7
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
10-03
Police Overtime Analysis
Area Of Concern: Overtime Patterns
Audit Finding / Concern
Certain officers were noted to have
booked Overtime / Comp Time in
recurring patterns. Two instances were
noted where Overtime was recorded
along with regular hours, and vacation.
Management Response
Management reviewed timekeeping
requirements with command staff, who
in turn reinforced procedures within
their individual operating units.
Procedures will also be reinforced as PD
converts to bi-weekly pay.
Current Status
Closed
Management Response
Management is working closely with the
City Attorney in an effort to minimize
this expense line. City Attorneys are
closing out subpoenas, and autonotification to subpoenaed officers is
commencing. Expense has declined by
24.4% since Q4FY09.
Current Status
Closed
Area Of Concern: Penalty Overtime
Audit Finding / Concern
Tests indicated as much as 25%
($51,000+) in Penalty Overtime
booked in FY'09 may have been
avoidable.
10-04
Treasury & Investing
Area Of Concern: Accrual Reconciliations
Audit Finding / Concern
Material accrued interest balances were
being reconciled on an annual basis
only.
Management Response
Treasury will reconcile accrued interest
accounts on a semi-annual basis, and will
attempt to free staff time to increase
the frequency of reconciliation.
Current Status
Open
Management Response
Treasury will implement a more
frequent review of CRD reports for
active brokers, and will document those
reviews in the B/D files.
Current Status
Open
Area Of Concern: B/D Relationships
Audit Finding / Concern
Broker/Dealer relationships were not
monitored according to best practices.
Supporting files were not always
complete.
8
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
10-05
Special Programs
Area Of Concern: Account Classification
Audit Finding / Concern
Celebration funds are held in a revenue
account.
10-06.2
Management Response
Controller is currently reviewing the
appropriate classification for the funds
before making a final determination as
to the account-type that will be utilized.
Current Status
Open
Management Response
Management has implemented a process
whereby security camera footage is
reviewed randomly.
Current Status
Closed
Parking Services
Area Of Concern: Security Over Coin
Audit Finding / Concern
Coin is subject to misappropriation
during the bagging process, after meter
harvest.
11-01
Indirect Cost Allocation Audit
Area Of Concern: Desk Procedures
Audit Finding / Concern
Documentation supporting the ICA
process is unavailable or inaccurate.
Only one individual has cross-training
and experience to perform an ICA.
Management Response
Management will document the process
of the annual creation of the Indirect
Cost Allocation Plan.
Current Status
Open
Area Of Concern: Statistical Data Integrity
Audit Finding / Concern
Statistical data that drives the ICA
process was inaccurate to varying
degrees.
Management Response
Management will work with a consultant
to review the City’s plan and obtain
recommendations, require department
directors to approve the statistics
submitted, and implement an escalation
process for missed deadlines by
department staff.
9
Current Status
Open
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
11-02
Arts & History
Area Of Concern: Capitalization of Costs
Audit Finding / Concern
Commission payments for various art
pieces were expensed, not booked to a
Capital Projects account.
Management Response
Arts will work with DFM to determine
procedures for booking projects that are
funded by outside sources. Also,
booking issues associated with BVC
objects have been clarified and this issue
is resolved.
Current Status
Closed
Management Response
Arts & History assumed full
responsibility for maintaining a
complete listing of objects. Lists are
provided to risk management
periodically as recommended. Risk
Management confirmed the adequacy
of processes currently in place.
Current Status
Closed
Area Of Concern: Insurance Values
Audit Finding / Concern
The insurer did not have a full and
complete listing of all City art objects.
10
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
11-03
DFA - Budget
Area Of Concern: BAM Contractual Compliance
Audit Finding / Concern
Level of support for BAM was not
consistent with the provisions of the
original contract.
Management Response
Management has affirmed their
intention to pursue an updated
agreement. This initiative will be
undertaken post UB system
implementation / roll-out; currently
envisioned for January - February 2012.
Area Of Concern: Compliance Reporting
Audit Finding / Concern
Management Response
Mandatory filing requirements of
annual appropriation ordinances are
not being met.
The Budget Office accepted
responsibility for filing the approved
budget ordinance with the Secretary of
State. A return receipt is requested of
the State for verification of receipt.
The receipt for the most recent
ordinance is on file in the Clerk's Office.
Current Status
Closed
Current Status
Closed
Area Of Concern: Contract Administration
Audit Finding / Concern
DFM staff did not possess most recent
iteration of TVCTV agreement.
TVCTV did not comply with all
agreement terms.
Management Response
Management created a spreadsheet to
improve the overall administration of the
contracts. The spreadsheet includes due
dates for required reports, data, and
contact information in a central
electronic file for easy access.
11
Current Status
Closed
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
11-04
Legal Dept / Administration
Area Of Concern: Billings for Services
Audit Finding / Concern
No determination as to the accuracy of
the indirect cost amount utilized for
the FY 10/11 contract periods was
possible.
Management Response
Management will more carefully retain
written direction from budget staff to
document the cost model preparation.
Current Status
Closed
Area Of Concern: Cash-Handling Practices
Audit Finding / Concern
The department has weak and
unapproved cash handling and check
processing procedures in place.
Management Response
Management aligned cash handling and
check processing more closely with
regulation. Handling procedures have
been formalized and submitted to
Treasury as required; and employees
have received cash-handling training.
Current Status
Closed
Area Of Concern: Time-Keeping Practices
Audit Finding / Concern
Attorney hours were improperly
allocated.
11-06
Management Response
Management believes the problems will
not recur with the implementation of
Cyber Shift. A new code has been
created and implemented that will allow
for the capture of hours worked for the
BCACHA.
Current Status
Closed
Management Response
Staff will create seasonal employee
accounts only when expected
termination dates have been determined.
Follow up will occur on that date, and
actual termination date established.
Accounts will be closed out as of the
termination date.
Current Status
Open
Recreation Programs
Area Of Concern: System Access
Audit Finding / Concern
Employee accounts on the Safari
System are not timely closed /
deactivated upon termination.
12
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
11-07
Library Operations
Area Of Concern: Courier Cost-Sharing
Audit Finding / Concern
Certain courier labor costs have been
under- or over-billed. Part-time delivery
vehicle costs are being absorbed solely
by the City of Boise. Certain operating
costs have been invoiced incorrectly.
Management Response
Cost share formulas have been updated
to reflect the appropriate costs
identified during the audit. The master
agreement will be reviewed by the
LYNX Directors, and inclusion of
additional courier vans / staff will be
sought by BPL. Discussions will also
include identifying appropriate costs to
be shared.
Current Status
Open
Area Of Concern: Meeting Room Reservations
Audit Finding / Concern
Hold harmless and release from
liability statements were missing for
room reservations.
Management Response
Management is reviewing current
procedures for possible alteration.
Signature requirements have been
discussed and reinforced with staff on
two separate occasions.
Current Status
Open
Management Response
Formulaic errors have been corrected.
Updated cost share information will
apply to FY12 billings due to annual
budgetary constraints of the member
libraries. Staff will exercise added
diligence in adhering to proper billing
procedures.
Current Status
Open
Area Of Concern: System Cost-Sharing
Audit Finding / Concern
The cost share formula was not in
compliance with the agreement and
consortium members were under
allocated certain costs.
13
STATUS OF AUDIT FINDINGS
PRESENTED TO:
THE CITY COUNCIL
CITY OF BOISE, IDAHO
11-09S2
P-Cards
Area Of Concern: Card Closure & Capture
Audit Finding / Concern
Purchasing cards are not being closed
within a reasonable time after
employment termination.
Management Response
Management will ensure cards are
closed within 48 hours of receiving
notification from the department
liaison, and issued a memorandum to
all department liaisons reiterating the
requirements of timely notification.
Current Status
Closed
Management Response
Management re-instituted the MCC
blocks upon discovery that they were
missing. P-Card administrators also
scan the system control set-up quarterly
to ensure the blocks continue to be in
place.
Current Status
Closed
Area Of Concern: MCC Restrictions
Audit Finding / Concern
A purchase was transacted with a with
a Merchant Category Code that was
prohibited according to program
administration.
14