Emmet County. Consulting Engagement Phase 1 Evaluation of Internal Controls over Financial Reporting. September 13, rehmann.

Transcription

1 Emmet County Consulting Engagement Phase 1 Evaluation of Internal Controls over Financial Reporting September 13, rehmann.com

2 Table of Contents Letter to the Board of Commissioners 1 Executive Summary 2 Procedures and Results Phase 1 I. Evaluation of Selected Accounting Cycles: A. Purchasing and accounts payable 4 B. Cash receipts 6 C. Capital asset monitoring 7 II. Internal Control and Fraud Risk Questionnaires 8 III. Analysis of Contracts with AECOM Technical Services, Inc. 10 Next Steps 12 Appendix - Developing a Comprehensive Policies and Procedures Manual A

3 Rehmann Robson 2330 East Paris Ave., SE Grand Rapids, MI Ph: Fx: rehmann.com September 13, 2017 Board of Commissioners Emmet County Petoskey, Michigan We have been engaged to perform certain consulting services for Emmet County, Michigan. In Phase 1, we evaluated the County's internal controls over financial reporting. Maintaining a strong internal control environment is an ongoing process that involves identifying, assessing and mitigating risks. Over the course of several on-site visits, we were able to meet with management, review processes and policies currently in place, and through related procedures, identify instances that represent opportunities for management to improve upon Emmet County s internal controls. We have performed the procedures listed in the body of this document solely to assist management and the Board of Commissioners in fulfilling its oversight responsibilities. The procedures performed and corresponding findings, recommendations and comments are detailed in the report following the Executive Summary. We have not performed, or been engaged to perform, any procedures beyond those procedures selected by management and the Board of Commissioners as documented in this report. The sufficiency of the procedures is solely the responsibility of management and the Board of Commissioners. Because the procedures performed do not constitute an audit, examination, or review of the County s financial statements, we do not express an opinion on the County s financial statements or any elements, accounts, or items thereof, nor do we offer any assurance on the County s risk management system. Matters communicated in this report are those that existed as of the report date and cannot be projected to any future periods, as controls may deteriorate or other conditions that affect the risk management environment may change. Our comments and recommendations, all of which have been discussed with appropriate County personnel, are intended to assist management in improving the integrity, maintenance, and security of the County. We will be pleased to discuss these comments in further detail at your convenience, perform an additional study of these matters, or assist you in implementing any of our recommendations. Sincerely, Page 1

4 Executive Summary Rehmann has been engaged to perform certain consulting services for Emmet County. Phase 1 entailed an evaluation of the County's internal controls over financial reporting (internal control). Internal control is the foundation on which all operational, financial, and compliance activities are based. Effective internal control is designed to provide reasonable assurance that an organization will accomplish its objectives efficiently, effectively, and in compliance with applicable laws, regulations, and the provisions of grant agreements. I. Evaluation of Selected Accounting Cycles As part of our evaluation of the County s internal control, we received and reviewed narratives describing the County s existing policies and procedures, interviewed key members of the County s staff, and examined selected source documentation to gain an understanding of the County s systems. We focused our evaluation on three of the County s most significant transaction cycles: A. Purchasing and accounts payable B. Cash receipts C. Capital asset monitoring For each significant transaction cycle, we quantified the results of our assessment as follows: Satisfactory indicates that overall, the elements of the internal control structure related to the County s policies and procedures adequately address the relevant risks that County s operating activities are effectively controlled; no significant risks were identified that require management s immediate attention or escalation Satisfactory with Exceptions indicates that the overall elements of the internal control structure related to the County s policies and procedures mostly address the relevant risks that the County s operating activities are effectively controlled; however, certain exceptions were noted that may warrant management attention or escalation Unsatisfactory indicates that the overall elements of the internal control structure related to the County s processes and procedures do not adequately the address relevant risks that the County s operating activities are effectively controlled; additional controls should be designed and implemented by management as soon as practical The results of our procedures indicated that the County s existing internal controls over each of the selected transaction cycles were unsatisfactory. Specific recommendations for improvements are provided in the following pages. Appendix A provides an overview of the components of internal control, along with list of recommended policies and procedures for the County to adopt. II. Internal Control and Fraud Risk Inquiries In order to gain a comprehensive picture of the County s operations from various perspectives, management requested that we make written inquiries of all County personnel regarding internal control and fraud risks. The result of those inquiries identified various areas of concern, which were considered as part of our recommendations, but did not lend themselves to actual ratings. Page 2

5 While the response rate to the questionnaires that were distributed was very high (nearly 80%), the results were inconsistent. Many respondents identified no weaknesses of any kind, while others pointed out multiple concerns. While some degree of inconsistency is normal, the apparent disconnect between the two groups of County employees is telling. It seems likely that management and the Board of Commissioners may receive at least some resistance to implementing needed change until the larger workforce better understands the reasons for those changes. Additional training and education may be helpful in that regard. III. Analysis of Contracts with AECOM Technical Services, Inc. AECOM Technical Services, Inc. was selected by the County in late 2008 to provide Municipal Engineering Services under a 3-year contract (which was later extended with an additional 5-year Master Agreement). Given the significance of the activity between the County and AECOM, we evaluated the agreement, and tested selected invoices for compliance with the County s bidding requirements. Our testing revealed that projects were approved through Task Orders issued by the County to AECOM. No bids or change orders were executed, though the County Board of Commissioners were provided with copies of the payments to AECOM for approval in the ordinary course of business. In the absence of competitive bids, it was not practical for us to determine whether the payments where AECOM were reasonable for the value received. However, our analysis shows that over a sixyear period from , the County paid approximately $2.3 million on a time and materials basis with limited review and approval, which likely contributed to the significant cost overruns incurred during that period. A full report of our procedures, results and recommendations follows this Executive Summary. Page 3

6 Evaluation of Selected Accounting Cycles $ Purchasing and Accounts Payable Procedures Performed 1. Obtained and read the County s financial policies and procedures 2. Obtained and read relevant job descriptions 3. Evaluated the County s accounting system s ability to integrate into the purchasing process 4. Made inquiries of various County department managers and employees regarding purchasing 5. Selected a sample of journal entries posted outside of the accounts payable module to verify that appropriate review and approval took place 6. Selected a sample of normal operating purchases, and tested for compliance with the County s policies and procedures and/or best practices 7. Selected a sample of larger non-operating purchases (including capital outlays), and tested for compliance with the County s policies to obtain quotes, proposals, or sealed bids Findings / Results 1. The County does not have a comprehensive policies and procedures manual. There are many separate policies and procedures that were provided individually as requested. We further noted that often, the policies in place are vague and do not explicitly document the procedures to be followed. For example, one purchasing policy states: The Controller will adopt operational procedures for making small purchases up to $5,000 ; however, no such documented procedures were available for our review. 2. There is no centralized purchasing department. Operational purchases of up to $5,000 are made at the department level. Department heads are authorized to determine the need for a purchase, to determine whether sufficient resources for the goods or services are in the budget, and to initiate the purchase without any central review or approval. 3. Formal purchasing documents such as purchase requisitions, purchase orders, and receipting documents are not consistently used in order to perform a three-way match (purchase order, invoice, receiving report) before making payment to vendors. 4. Journal entries do not consistently contain evidence of review and approval by someone independent of the preparer. 5. We noted instances in which a vendor was involved in multiple capital projects in excess $20,000, which should have required a separate bidding process for each project. Despite the fact that these projects took place over the course of several years, the County relied on a single multi-year contract with the vendor involved. Although approved by County Board of Commissioners, this multi-year contract was not specifically related to the individual projects or costs, and appears to have circumvented the normal bidding process for those projects. 6. We noted instances in which purchase transactions were approved by personnel other than those authorized by the County s written policies and procedures to approve such transactions. 7. We noted instances in which a formal bidding process was required based on the size of the purchase but documentation of the bidding process was not available. 8. The County utilizes accounting software that is quite old and lacks the capabilities necessary for an integrated purchasing system. It is not capable of tracking a purchase from the original purchase requisition and purchase order through the receipt of goods or services, and payment of the invoice. Conclusion Internal controls over purchasing and accounts payable are unsatisfactory. Page 4

7 Recommendations 1. Develop and implement a comprehensive financial policies and procedures manual, including purchasing and accounts payable. See Appendix A for a suggested list of policies to address. 2. Establish a central purchasing function (at least for purchases over a specified threshold). 3. Update or upgrade the County s accounting software to a modern system that can better integrate purchasing and accounts payable to ensure proper accountability throughout the process. 4. Require the use of formal purchasing documents, including purchase requisitions/purchase orders (which document the need for and authorization of a purchase), invoices (which provide the documentation to pay), and receiving reports/packing slips (which document receipt and inspection of goods) to enable the accounts payable department to perform a proper three-way match for all purchases 5. Document and retain required bids for larger purchases, and document a valid reason if bids were not obtained. 6. Obtain written approval from the County Board of Commissioners (when required) for selecting bids. 7. Update and maintain a list of authorized signers for each department. 8. Disallow open-ended multi-year contracts that bypass the bidding process for individual projects. Page 5

8 Evaluation of Selected Accounting Cycles Cash Receipts Procedures Performed 1. Obtained and read the County s financial policies and procedures 2. Obtained and read the receipting policies of individual departments, where available 3. Inquired of department managers and employees in various departments that receipt cash Findings / Results 1. The County does not have a comprehensive policies and procedures manual. Neither does it have separate policies and procedures specific to each department that receives cash. 2. Cash drawers are accessible by multiple employees. 3. Our inquiries indicated that there have been various instances of cash shortages, and of cash receipts not being adequately secured (i.e., lying around on desks). Conclusion Internal controls over cash receipts are unsatisfactory. Recommendations 1. Develop and implement a comprehensive financial policies and procedures manual, including cash receipting specific to individual departments. See Appendix A for a suggested list of policies to address. 2. Ensure limited access to cash drawers by a single individual during periods between deposits for proper accountability. 3. Develop a drawer inventory form for outgoing and incoming personnel to sign documenting the cash amounts before and after each employee has access to a cash drawer. 4. Develop and implement policies to ensure cash receipts are immediately secured, and deposited as appropriate. Page 6

9 Evaluation of Selected Accounting Cycles Capital Asset Monitoring Procedures Performed 1. Obtained and read the County s financial policies and procedures related to capital assets 2. Obtain and examined the County s capital asset listing 3. Selected a sample of capital assets from the provided listing to verify existence 4. Selected a sample of known capital assets and traced to the provided listing to verify completeness 5. Made inquiries of various County department managers and employees regarding capital assets Findings / Results 1. Existing capital assets are not tagged with an asset number to allow for tracking. 2. Periodic inventories are not performed and reconciled to the capital asset records. 3. A fully depreciated item was included on the capital asset listing which could not be located. 4. Bulk equipment purchases have not been handled consistently. Per policy, each piece of equipment should be considered a separate purchase, rather than aggregated. We noted instances in which bulk purchases were capitalized contrary to County policy. 5. Bids for certain capital outlays that met the bidding threshold were not available for review. 6. Our inquiries indicated that capital assets are not evaluated for potential impairment, as required by generally accepting accounting principles. 7. The capital asset listing is prepared on a manual spreadsheet, which creates the potential for calculation errors and misstatement of depreciation expense and related accumulated depreciation. Conclusion Internal controls over capital asset monitoring are unsatisfactory. Recommendations 1. Develop and implement a comprehensive financial policies and procedures manual, including adequate control over capital assets. See Appendix A for a suggested list of policies to address. 2. Perform a physical inventory of capital assets and reconciliation to the capital asset records and the general ledger at least annually. 3. Consider obtaining automated capital asset software to eliminate the potential for manual spreadsheet errors. 4. As there may be instances in which it would be appropriate to capitalize a bulk purchase, the County should consider updating its policies and procedures to allow this to be analyzed by appropriate management personnel to determine if and when a bulk purchase should be capitalized. 5. Ensure that the bidding requirements are adhered to and that documentation of the bidding process is maintained for all capital outlays meeting the bidding process threshold. Page 7

10 Internal Control and Fraud Risk Questionnaires? Procedures Performed 1. Obtained a current listing of all County employees 2. Prepared tailored internal control and fraud risks questionnaires for each employee (long-form for managers, short-form for all others) and mailed to employees for confidential data collection 3. Analyzed responses for significant internal control and/or fraud risks faced by the County 4. Summarized responses according to significance/prevalence Findings / Results 1. The overall response rate for completing and returning the questionnaires was 79%, which is better than average for this type of exercise. 2. Approximately 33% of managers surveyed identified one or more areas of concern. Fewer issues were identified by other employees, with an overall rate of approximately 21% of employees raising at least one concern, and approximately 10% of employees raising two or more concerns. 3. The most prevalent issues identified were: a. Management has not made it clear that fraudulent or unethical behavior will not be tolerated b. Weaknesses in internal control over cash receipts c. Lack of adequate segregation of incompatible duties d. Known weaknesses in internal control and/or fraud risks in the employee s home department e. Lack of adequate review and approval of non-routine transactions f. Noncompliance with laws or regulations 4. In addition, the following concerns were raised by at least two employees: a. Unauthorized transfers from the Delinquent Tax Revolving Fund to cover general operations b. Excessive or wasteful spending c. Improper control over inventory d. Lack of adequate staff training e. Lack of management oversight f. Employees would not feel comfortable reporting fraud if they became aware of it Conclusion 79% Response rate from 267 questionnaires 1 in 3 Managers reported areas of concern 80 Comments submitted There is an apparent disconnect between two groups of employees within the County. Four out of five employees did not identify any areas of concern while those who did frequently identified multiple issues. One of the potential barriers to implementing necessary systemic changes at the County may be resistance on the part of those who either don t see the problem, or don t want to deal with the natural disruption to normal operations that comes with implementing new policies and procedures. Regardless, at least a significant minority of those surveyed identified the need for improvements, and they should be a positive force for change as management and the Board of Commissions moves forward with their initiatives. Effective internal control always begins with the tone at the top. As the Board and Administrator continue to adopt new policies and procedures, it will be important to communicate not only the changes, but the reasons behind those changes. Sending a clear message that Emmet County cares about internal control will go a long way toward accomplishing that objective. Page 8

11 Recommendations 1. Develop and implement a comprehensive financial policies and procedures manual, and distribute it to appropriate personnel. See Appendix A for a suggested list of policies to address. 2. Consider holding targeted training for County employees to explain the importance of internal control in allowing the County to carry out its mission efficiently and effectively, and in safeguarding its assets. 3. Clearly communicate at both the Board level and within each department that the County takes internal control seriously, and that employees are expected to carry out their responsibilities in an ethical manner. 4. Consider establishing a mechanism for employees to report suspected fraud, waste, and abuse to senior management and/or the Board confidentially. This could be done through an anonymous webform or a third-party fraud hotline. Research consistently confirms that whenever fraud, waste, or abuse are found in an organization, there were employees who knew about it and never reported it to anyone simply because they had never been asked. A well-advertised hotline is one practical expedient to solicit that input. Page 9

12 Analysis of Contracts with AECOM Technical Services AECOM Technical Services, Inc. (previously STS Consultants) has served as the County s primary consultant for large capital projects since During the period from , the County paid AECOM approximately $2.7 million in fees related to a variety of projects. Given the significance of this relationship, we were asked to analyze the County s contract with AECOM and review its bidding practices. Procedures Performed 1. Obtained a copy of the Master Agreement between AECOM Technical Services, Inc., and Emmet County, Michigan, for Miscellaneous Professional Services, with an effective date of October 15, 2011, and signed by then Chairman James Tamlyn on November 14, Obtained a schedule of invoices paid by the County to AECOM during the period from , and supporting invoices for the period from (the period for which electronic records were readily available) 3. Determined whether bids were obtained for the various projects, and whether the payments to AECOM were presented to the Board of Commissioners for approval 4. Compared the initial proposed cost for selected projects to the final invoiced costs 5. Where applicable, requested change orders to support cost overruns Findings / Results 1. The Master Agreement between AECOM and the County did not specify what projects would be performed, but referred to separate Task Orders to be issued during the term of the contract. 2. The County did not have any record of formal Task Orders being issued noting pre-authorization of expenses or maximum not-to-exceed costs. Project cost estimates ( limits ) were included by AECOM on individual invoices, but then revised as needed to keep projects within the specified budget. 3. We examined documentation for 273 invoices spanning 38 distinct projects from 2011 through 2016 totaling $2.3 million. In total, the amount paid was approximately equal to the limits noted by AECOM on its invoices. However, these limits were increased during the course of 18 of those projects (by more than $1 million) without any documented approval process, so this comparison is not especially meaningful. 4. It does not appear that any bids were issued for these services. Accordingly, it is not practical to determine whether the costs incurred for these projects were reasonable in relation to the current market price for such services. In each case, the invoices were simply billed on a time and materials basis. 5. In addition to any cost overruns incurred directly with AECOM, for one specific project (the Headlands Observatory), the County s general contractor identified 32 separate change orders, totaling over $200,000, that were necessary due to identified design errors that had to be corrected after the project began. As this represents only a single project, the total cost of all such issues is unknown. 38 Projects invoiced by AECOM 273 Invoices examined for approval 0 Number of bids solicited $2.3M Paid on a time and materials basis Page 10

13 Conclusion While the amount paid to AECOM over the past 8 years was significant, there is no clear evidence whether it was excessive for the services rendered. The most significant limitation in further analysis is that the County has not bid these services out in many years. It is theoretically possible that AECOM would have been the successful bidder in each case; but it is equally possible that other vendors would have provided competitive proposals at an overall savings to Emmet County. In addition, given the design errors identified by the general contractor that required re-work, it is likely that at least some portion of the AECOM billings, which were on a time and materials basis, included rework for services already billed and paid for by the County. Recommendations 1. The County should first update/amend and then adhere to its purchasing policies and procedures to ensure that appropriate bids are obtained for projects of a particular size. 2. If properly addressed by policy, it would be acceptable to issue an RFP for municipal engineering services (or construction management services, or other similar professional services) for a reasonable period of time (e.g., three years), and then to forgo competitive bidding on individual projects within that period of time. However, appropriate safeguards should be in place to ensure the County is still getting the best value for its investment. Any such contracts should be subject to periodic evaluation, and should be re-bid at appropriate intervals. 3. To the greatest extent possible, the County should request maximum not-to-exceed cost estimates for each project, and minimize the use of time and materials projects, which provide little incentive for economy in design or execution. AECOM Billings Bay Bluffs $126,000 Fairgrounds $35,248 Camp Petosega $131,860 Recycling Center $25,914 Other $29,655 Transfer Station $172,206 Dark Sky Park $1,169,467 Courthouse $609,466 Page 11

14 Next Steps This report concludes our procedures under Phase 1 of our agreement with Emmet County. Through our initial discussions with management and members of the Board of Commissioners, we are aware of a variety of initiatives and other projects that the County is considering undertaking. As with any organization, resource allocation is the primary limiting factor. We understand that management would like to tackle as many of the projects internally as possible, both from a cost perspective and to better understand and address the underlying issues. In terms of going back and uncovering past inefficiencies or inappropriate spending, we would suggest that the County would be better served to look forward and focus its efforts on prospective changes to systems, agreements, and policies/procedures. Rehmann stands ready to assist with additional phases of this project, upon request. Page 12

15 Appendix A Developing a Comprehensive Policies and Procedures Manual Internal Control Integrated Framework Since 1992, the gold-standard in internal control has been the seminal work of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control Integrated Framework. Updated periodically, and now codified in generally accepted auditing standards, Government Auditing Standards, and the Uniform Guidance, the COSO framework lays out five essential components to any system of internal control, and goes on to detail 17 principles that expand on the application of the components. Control Environment 1. Demonstrates Commitment to Integrity and Ethical Values 2. Exercises Oversight Responsibility 3. Establishes Structure, Authority, and Responsibility 4. Demonstrates Commitment to Competence 5. Enforces Accountability Risk Assessment 6. Specifies Suitable Objectives 7. Identifies and Analyzes Risk 8. Assesses Fraud Risk 9. Identifies and Analyzes Significant Change The COSO cube visually demonstrates that each component (and related principle) is applicable to each objective of internal control at each level of an organization. This applies to operational objectives (efficiency and effectiveness), reporting objectives (both financial and nonfinancial), and compliance objectives (laws and regulations). Control Activities 10. Selects/Develops Control Activities 11. Selects and Develops General Controls over Technology 12. Deploys Policies and Procedures Information and Communication 13. Uses Relevant Information 14. Communicates Internally 15. Communicates Externally Information and Communication 16. Conducts Ongoing / Separate Evaluations 17. Evaluates and Communicates Deficiencies Page A-1

16 Recommended Policies and Procedures Governments should have a comprehensive set of policies and procedures to address the control activities component of the COSO framework. Following is a list of key areas to address. Rehmann can provide the County with samples of these policies to use as a starting point for its own internal development. However, it is essential that any sample policies be thoroughly reviewed and tailored for the County s unique needs. Adopting a policy designed for another entity without modification is frequently worse than having no policy at all. Financial Management Systems General Accounting and Financial Management Purchasing and Procurement Cash Receipts Payroll and Timekeeping Bank Reconciliations Journal Entries and Non-routine Transactions Capital Assets Long-term Debt Employee Travel and Reimbursements Grant Administration Year-end Closing and Reporting Other Policies and Procedures Conflict of Interest Records Retention Information Technology Access Disaster Recovery Policies for Compliance with the OMB Compliance Supplement General Information/SEFA Prep Activities Allowed/Unallowed Allowable Costs/Cost Principles Cash Management Eligibility Equipment and Real Property Management Matching, Level of Effort and Earmarking Period of Availability Procurement, Suspension and Debarment Program Income Reporting Subrecipient Monitoring Special Tests and Provisions Once appropriate policies and procedures are in place, the County s work is not over. This is an iterative process, as the journey toward having appropriate internal control is never truly complete. Following the COSO framework, the County should: 1. Establish a positive tone at the top that emphasizes the importance of internal control 2. Assess the risk of what could go wrong if internal controls are lacking 3. Develop specific policies and procedures to mitigate those risks 4. Communicate the policies and procedures throughout the organization 5. Periodically assess whether the controls are functioning, and update as necessary Monitoring Activities Control Environment Risk Assessment Information and Communication Control Activities Page A-2