A REPORT FROM THE OFFICE OF INTERNAL AUDIT

Transcription

1 A REPORT FROM THE OFFICE OF INTERNAL AUDIT PRESENTED TO THE CITY COUNCIL CITY OF BOISE, IDAHO AUDIT / TASK: #15-03, Cash Controls / Electronic Funds Transfers AUDIT CLIENT: Cross-Functional REPORT DATE: July 31, 2015 AUDIT GRADE: Cash Controls Low Satisfactory Funds Transfers High Satisfactory REPORT AUTHOR: APPROVED FOR RELEASE: Steven Rehn CIA, CFSA Steven Rehn CIA, CFSA AUTHORITY: Boise City Code, FY2015 Work Plan

2 Task #15-03, Cash Controls / Electronic Payments Date of Audit: March 3, 2015 INTRODUCTION In order to provide the range of services and programs that are currently available to its citizens, the City of Boise has implemented supportive business processes at various locations throughout the organization. Those processes often necessitate the establishment and use of cash funds e.g. cash drawers, petty cash, and other specialized imprest-type funds. These funds, when taken together, represent approximately 0.34% of cash balances typically held by the City. The majority of the City s cash balances are maintained on deposit in commercial banking institutions; the funds that are the subject of this review exist in the form of currency and coin, and are distributed across various front-line business units throughout the organization. A number of departments maintain cash drawers in order to accept fees and payments for various services. As of the date of audit, these cash banks existed at nineteen (19) separate locations, and were generally tied to automated POS / business-processing systems. Another eleven (11) locations accept payments for processing, though they do not maintain cash drawers. As of the date Audit s review commenced, petty cash funds and specialized imprest-type funds existed at twenty-three (23) locations across the City, and ranged widely in size. Petty cash funds are typically used for miscellaneous payouts and small expense reimbursements. Transactions are limited in size to amounts under $100 each. Larger imprest funds are used to support specialized needs that are unique to some specific department missions. The City also has a need to transfer funds electronically in order to achieve the timely and efficient movement of monies in fulfillment of various business purposes / obligations. Electronic funds transfers involve incoming and outgoing wire transfers, debit and credit Automated Clearinghouse (ACH) entries, automated bank transfers, and electronic payment card processes. Effective processes and procedures are required in order to ensure compliance with regulatory requirements, as well as to mitigate the unique risks and exposures that accompany these types of activities. Given the distinctly unique nature of the two areas incorporated into this review (cash controls and controls surrounding funds transfers), Internal Audit is assigning individualized ratings in order to properly reflect the results of our reviews in each of the two areas. 2

3 SCOPE AND METHODOLOGIES The overall purpose of the audit was to gain a reasonable degree of assurance that the control environment related to specific cash-associated functions within the City was adequate. Internal Audit defined the following specific objectives for the review: Verify the existence and condition of all Petty Cash funds, Imprest funds, and other cash banks maintained at various City locations. Review cash intake points across the City; as well as processes supporting the accepting, recording, balancing, and deposit of funds. Review controls and procedures surrounding electronic funds transfer capabilities. Internal Audit established the scope of the review to include relevant cash-related activities defined within the objectives that occurred beginning on October 1, 2013 and ending on January 31, The existence and condition of Petty Cash, Imprest, and other cash banks was assessed as of the date they were physically reviewed generally between March 3, 2015 and April 2, Audit utilized a combination of interviews, observations, detailed testing, and direct verifications throughout the course of the engagement. Evidentiary materials obtained were deemed to be sufficient to support the observations and recommendations contained within this report. 3

4 EVALUATION AND COMMENTS Based on the work performed, it appears that the controls currently in place across the various city venues that maintain petty cash funds or cash drawers, or that normally receive funds, are best characterized, overall, as Low Satisfactory. Opportunities for improvement in practices were identified with a fair degree of regularity at various business units that were subject to review. Those opportunities were most commonly associated with safekeeping practices. They were present, but less frequently so, with respect to other processes such as receiving and depositing funds. Internal Audit also noted the regulations governing these activities did not always appear to align with existing practice, or with the staffing models currently in place. Relative to electronic funds transfers, management appears to have adopted and / or implemented a suite of highly-effective controls and procedures. Those are best characterized as functioning in a High Satisfactory manner. Specific areas of interest in this portion of the review included systemic controls, authorities, access controls, and other environmental control factors. No issues worthy of separate mention were noted. Audit s detailed observations and recommendations appear in the following report sections. (Refer to Appendix A for additional details concerning Internal Audit s existing grading scale.) 4

5 FINDINGS AND RECOMMENDATIONS Internal Audit s observations and recommendations are detailed below, in table form for purposes of presentation. Audit is following up for management responses with the individual business units, and will provide updates on the status of corrective actions as part of the FY 15 Annual Status Report. Petty Cash / Imprest Funds Primary areas of interest for this portion of the review consisted of: (1) Existence of the authorized fund balance; (2) Safekeeping practices; and, (3) Periodic fund reconciliation and replenishment. All funds were present or accounted for as of the date of review. All underwent periodic reconciliation and replenishment as well. Opportunities to improve safekeeping processes were present in a number of areas. One fund was down-sized, one established, and two others eliminated based on business needs. (See shaded symbol, in the table below indicating areas where potential for procedural improvements existed.) (See Appendix B for additional information relative to the factors that comprised the review in this area.) Petty Cash / Imprest Funds Department Division Existence Safekeeping Airport Finance Balance / Replenish # Other Arts & History Boise 150 * DFA Administrative Services Financial Services * Fire Administration Special Teams IT Administration Library Main Branches Parks & Rec Administration Recreation $ Zoo ^ Police Administration Investigations PDS Housing & Community Development Public Works Operations *-Petty Cash was no longer necessary; the Petty Cash funds were surrendered and closed out. ^-Fund balance reduced by 40% in order to reflect current need. $-Separate fund established to fulfill on-going business need. #-See Other Area of Concern on page 6 for additional commentary related to these practices. 5

6 Cash Drawers / Cash Intake Points Primary areas of interest for this portion of the review were: (1) Receiving and recording funds; (2) Balancing processes; (3) Depositing funds; (4) Safe-keeping practices; and, (5) General controls and procedures. Audit also tested / verified the existence of authorized cash balances all funds appeared to be accounted for. The areas reviewed generally had effective procedures in place for receipt, balancing, and deposit of funds. Opportunities to improve processes were most often noted in the area of safekeeping practices. (See shaded symbol, in the table below, indicating locations where the potential to improve processes existed.) (See Appendix B for additional information relative to the factors that comprised the review in this area.) Cash Drawers / Cash Intake Points Department Division Receiving Balancing Depositing Safekeeping Airport Finance General # Arts & History Administration DFA Accounting Administrative Services Collections Fleet Services H/R Administration Risk Services IT Administration Legal Library Administration Main Branches Parks & Rec Administration Recreation Resources Zoo Police Administration PDS Building Division Housing/Community Development Public Works Administration Utility Billing #-Refer to Other Area of Concern on page 6 for additional information relevant to cash drawer processes. 6

7 OTHER AREA OF CONCERN Internal Audit utilizes Other Area of Concern comments to provide management with feedback on issues noted during a project that appear to deserve additional management attention. Audit generated the following comments involving the current set of cash-related regulations. De-Centralized Cash Practices Audit reviewed petty cash funds at 21 locations, and cash drawers at 19 locations. While interviewing staff and reviewing procedures in place within the business units, we noted certain regulatory provisions that, due to a potential misalignment with business process and need, were not routinely observed. Examples include: Petty Cash Regulations mandate a daily balancing / verification of petty cash funds; and a monthly replenishment. Neither of these schedules was typically observed by fund custodians. Usage of the funds tended to be cyclical or sporadic. Custodians typically balanced at longer intervals, with final reconciliation and replenishment as needed. Cash Drawers Regulations stipulate that business units use a payout / refund form for any voids or refunds transacted through cash drawers. The forms are to be documented with reasons, and with customer signatures. These transactions must also be authorized by a supervisor. Over 1/2 of the locations we visited did not employ these types of documents or approval measures. Cash Drawers Regulations prohibit the sharing of cash drawers. However, we noted some locations where drawers are used communally in order to accommodate breaks, varying work schedules, and / or split shifts. Processing Funds The level of staffing at several locations did not readily support an effective segregation of duties. Internal Audit recommends management revisit the regulations, and pursue revisions where it may be appropriate to do so. As written, the current set of regulations, if observed, could result in the imposition of unneeded administrative burdens in some instances. In other instances, the regulations do not appear to effectively fit the staffing or business models that have been deployed. Centralized Responsibilities A number of related responsibilities have been assigned to a central function within the City the Department of Finance and Administration (DFA). Given the resources available to fulfill the assigned responsibilities, the current tasking scheme may not be viable: 7

8 Centrally-sponsored Training DFA has been tasked with providing training for both cash handlers, and for petty cash custodians. Training in the area of cash-handling has been made available via electronic sources. The current status for training petty cash custodians is unknown; no training in this area has been documented. Centrally-sponsored Audits DFA has been tasked with performing periodic audits citywide in the areas of cash drawer procedures and compliance; and also petty cash funds. One petty cash audit has been conducted since the regulations became effective. No audits of cash drawer procedures / compliance are known to have occurred. Management may want to consider redistributing these responsibilities. Potential improvements might include pushing responsibility for training and cashmonitoring out to the owning departments / divisions. This could be accompanied by the implementation of periodic certification processes in order to gain assurance that those business units have trained their staff, and have provided proper oversight of the cash balances in their possession. DFA involvement could occur if and when special circumstances materialized that warranted such involvement. CONCLUSION Internal Audit would like to recognize management s responsiveness to our cashrelated observations. At the point where we shared observations and recommendations with the various business units that possessed cash balances or that were involved in receiving funds, we requested feedback on corrective actions either planned or implemented. In nearly all cases, immediate corrective actions were pursued. Additional improvements in the overall control environment may also be available through a revision of the current regulations that govern this area. Requirements could be more closely aligned with existing staffing resources and business models, which would result in regulatory requirements that are more realistic and more readily achievable. MANAGEMENT PARTICIPANTS Lynda Lowry, CFO / City of Boise Richard Downen, Deputy City Treasurer / City of Boise Jim McMahon, Controller / City of Boise Management teams from participating Departments 8

9 APPENDIX A Evaluation and Grading of Audits Each audit will be evaluated or graded, and will receive one of the five following ratings. Grades will be assigned based on the perceived best fit. Thus, not all attributes associated with an assigned grade may be present within a given Department or Division. High Satisfactory: No significant weaknesses or deficiencies were noted during the audit. If any issues were noted, they were clearly insignificant or inconsequential. The audited area displays a high degree of control and management oversight is effective. Satisfactory: Reportable issues may exist within the audited area, but they are not deemed to be representative of pattern or practice within the area. Issues are typically of an isolated nature. Overall, systems of internal control are effective, and management oversight is adequate and supportive of the accomplishment of goals and objectives. Low Satisfactory: Reportable issues exist within the audited area, and are encountered frequently enough to lose the appearance of isolated. Systems of internal control appear to be marginally adequate at best. Management oversight is not always effective to ensure the quality of operations. Needs Improvement: Weaknesses or deficiencies are encountered on a relatively frequent basis within the audited entity or function. Issues noted, and their frequency, are suggestive of a pattern or practice of inadequate oversight. Internal control mechanisms may not be universally in place, implemented, or actively observed. Management oversight is weak, or is not always effective. Unsatisfactory: Material or significant deficiencies are noted within the operations under review. Issues may pose risks that are either missioncritical or mission-fatal. Management has failed to implement appropriate internal controls. Management oversight is ineffective, absent, or willfully avoided. 9

10 APPENDIX B Internal Audit incorporated specific procedural and / or control factors into its reviews. Those were: Petty Cash / Imprest Funds Authorized Fund Balance is Present or Accounted For Methods for Storing Funds Staff Authorized to Access the Funds Security of Access Devices (Keys / Combinations) Activity Levels of the Fund Balancing and Replenishment Cash Drawers and Cash Intake Points Test / Verify that Funds are Present or Accounted For Segregation of Various Cash-Handling Tasks Establishing Accountability for Funds Received Issuing Receipts Restrictive Endorsement of Checks Void / Refund Procedures Cash Drawer Assignments (Sole-Control or Communal) Closing / Balancing Procedures Deposit Procedures Number of Staff Authorized to Access the Funds Security of Access Devices (Keys / Combinations) Staff Training 10