A REPORT FROM THE OFFICE OF INTERNAL AUDIT

Transcription

1 A REPORT FROM THE OFFICE OF INTERNAL AUDIT PRESENTED TO THE CITY COUNCIL CITY OF BOISE, IDAHO AUDIT / TASK: #16-11, Sewer Operations AUDIT CLIENT: Public Works REPORT DATE: December 14, 2016 AUDIT GRADE: Satisfactory REPORT AUTHOR: APPROVED FOR RELEASE: David Veloz, Internal Auditor Steven Rehn CIA, CFSA Director of Internal Audit AUTHORITY: Boise City Code, FY2016 Work Plan

2 TASK #16-11, Sewer Operations DATE OF ENGAGEMENT: June 29, 2016 INTRODUCTION The Public Works department is comprised of five divisions; Administration, Engineering, Environmental, Government Buildings, and Operations. The divisions are in place to ensure City of Boise resources are effectively used, and that the health, safety and welfare of the community are protected. The divisions are responsible for the management of wastewater, surface and ground water quality, trash and recycling, street lights, as well as a geothermal heating system. As the largest division of the Public Works department, the Sewer Operations Division maintains approximately 800 miles of sewer lines, operates two wastewater treatment plants, and disposes of the biosolids (the final product of the sewage treatment process). Sewer Operations provides these same services to cities and sewer districts adjacent to the City of Boise as well. The Division employs approximately 150 employees who operate and monitor systems to ensure the City is in compliance with federal, state, and local environmental regulations. The two wastewater treatment plants operated by the City are the Lander Street Wastewater Treatment Plant, and the West Boise Wastewater Treatment Plant. Combined, these two plants have the design flow capacity to process 39 million gallons of wastewater per day; they currently operate at approximately sixty-nine (69) percent of capacity. The treated effluent from the two treatment plants is ultimately discharged into the Boise River system. The Environmental Protection Agency (EPA) has issued both plants National Pollutant Discharge Elimination System (NPDES) permits. The Sewer Operations Division monitors and tests various pollutants to ensure compliance with the NPDES permit limits. With the increasingly stringent NPDES permit limits set forth by the EPA, the City has made a conscious effort to reduce the Total Maximum Daily Load (TMDL), which is the specific limit on pollutants in wastewater in order to achieve water quality goals. The City has devoted significant resources to a number of major projects necessary to the removal of such pollutants. For example, the City has completed the construction of the West Boise phosphorus removal facilities, which include the Enhanced Biological Nutrient Removal (EBNR) and Struvite Production Facility (SPF). In addition, the City opened the 49 acre Dixie Drain facility on the lower Boise River in August of 2016, which has the capability of removing approximately 140 pounds of phosphorus per day from the river. 2

3 SCOPE AND METHODOLOGIES The overall purpose of the audit was to gain a reasonable degree of assurance that the control environment related to the Sewer Operations / Wastewater Treatment Plants is adequate. The control environment should ensure the Division is functioning in an efficient and effective manner, that resources are properly safeguarded, that goals and objectives are being met, and that activities comply with applicable policy, law, and/or regulation. Internal Audit defined the following specific objectives for the review: Review to ensure the City of Boise is observing regulatory / permitting requirements set forth by the regulatory agency responsible for oversight. Review the control environment for procurement practices and asset management at the wastewater treatment plants. Determine whether the City of Boise has any agreements pertinent to the water treatment process, and assess performance. Review to ensure management performs an analysis of revenues and expenditures to identify trends and opportunities for efficiencies. Internal Audit established the scope of the review to include all Sewer Operations Division activity that occurred beginning on October 1, 2013 and ending on March 31, Where necessary, work was performed with specific as-of dates, as indicated in the report sections that follow. Internal Audit utilized a combination of interviews, observations, and detailed attribute testing in order to accomplish the defined objectives. The methods employed and the evidentiary materials developed were deemed to be adequate to support the conclusions contained within this report. EVALUATION AND COMMENTS Based on the results of the work performed, the level of administrative effort and the oversight efforts surrounding the Sewer Operations Division that were the subject of this review result in the assessment of a Satisfactory level of performance. (Refer to Appendix A for additional details concerning Internal Audit s existing grading scale.) Internal Audit confirmed that regulatory / permitting requirements are observed through a systematic process implemented by the Sewer Operations Division. Effluent limitation and monitoring requirements are essential for each wastewater treatment plant in order to remain compliant with the National Pollutant Discharge Elimination System (NPDES) permit. As required by the NPDES permit, the 3

4 Sewer Operations Division has developed a comprehensive plan, inclusive of a quality assurance plan (QAP), for all monitoring requirements. The QAP must include qualifications and training of personnel. We detected deficiencies in the training records of Division employees. Contributing factors appear to relate to a breakdown in the assignment of training in the City s automated learning system. Audit also reviewed procurement practices and asset management processes in order to confirm the inventory / fixed assets were appropriately positioned in support of the Sewer Operations Division. Internal Audit attended the annual physical inventory at the Lander Street Wastewater Plant. We observed the inventory process; we did not detect any significant concerns. Internal Audit confirmed the City of Boise has a sales agreement with Multiform Harvest Inc. (MHI) for the sale of struvite, a material recovered through the phosphorus removal process. While the City did not generate any revenues through the aforementioned agreement within the audit scope period, there are on-going efforts to further develop the struvite production process in order to attain the optimum level of consistency, and ultimately to produce a marketable product. The City of Boise also receives revenue for wastewater treatment services provided to neighboring districts; such as the Eagle Sewer District and Garden City Sewer District. We detected minor errors in the billing process, as well as a timeliness matter with regards to the final billing. Management performs analyses of revenues and expenditures through system based reporting in order to project future cash flow needs of the division. Internal Audit confirmed that trends are identified through the reporting and used to present information regarding future projects and / or cash position. The payroll expenses for the Sewer Operations Division were also reviewed. Internal Audit did not identify any issues of concern relative to the utilization of information, nor in amounts incurred for salaries or overtime during the audit scope period. The report sections that follow provide additional commentary on the work performed, and our findings, concerns, and recommendations relative to each respective area. 4

5 FINDINGS AND RECOMMENDATIONS Audit s Findings are detailed below; including any recommendations that were made, and management s responses to those suggestions. 1. FINDING: Training records and management system Internal Audit reviewed training records for the West Boise and Lander Wastewater Treatment Plants. Training programs are assigned to certain employees based on those employees job responsibilities. The credentials that result from these training programs expire within specified timeframes; typically on an annual cycle. The training programs are managed through an automated system known as ilearn. When the assigned course is completed, the annual credential will remain active, and the system will automatically reassign the training for the next annual cycle. According to the National Pollutant Discharge Elimination System (NPDES) permit, the permittee must develop a quality assurance plan for all monitoring required by the permit. The plan must include qualifications and training of personnel. While reviewing training course records, Audit noted 30 instances of credential failure within the records: a) Two (2) employees that should have been assigned to a training course do not appear to have been. The employees title changed but those changes were not identified as triggers for changes to their individual training regimes. b) Fifteen (15) employees that should have been assigned to a training course based on their position were not. Their position was not on the HR list for inclusion. c) Thirteen (13) employees records reflected expired credentials; the courses did not appear to have been assigned due to a vulnerability within the training program. Further review by management revealed additional training program assignments that had failed to automatically reassign, resulting in additional expired credentials. As a result of the processes and programs currently in place, discrepancies exist within the employee training records in regards to the necessity and recurrence of training programs. Internal Audit recognizes the HR department has, or will, implement corrective actions to mitigate the training program vulnerabilities. 5

6 RECOMMENDATION: Internal Audit recommends the Sewer Operations division collaborate with the HR department to strengthen processes. First, review listings for training records in order to ensure the records are accurate and complete. Second, review exception reporting to ensure employees have the appropriate, current credentials. And finally, utilize training program reporting that could display / electronically mail alerts prior to a credential deadline to ensure the employee completes the training in a timely manner. An on-going review of the HR list for training assignment, credential achievement verification, and systematic alerts / renewals would assist in accurate and timely completion of training programs. MANAGEMENT RESPONSE: Public Works management concurs with the audit finding regarding training records. The training record finding regarding recurrence of trainings is related to an anomaly in the training software. Operations Division ilearn administrators have been working closely with HR in finding acceptable monitoring and control measures until the time the software glitch may be closed. Exception reporting has been implemented by HR identifying gaps with training/credential assignments occurring thereafter. Public Works will collaborate in HR s periodic on-going reviews of training necessity. In Public Works Operations Division, supervisors and managers will be provided monthly incomplete assignment lists in addition to the overdue assignment reports normally distributed. This will provide supervisors advanced visibility to course deadlines. 2. FINDING: Billing records accuracy The Sewer Operations Division provides treatment to wastewater pumped from various surrounding districts and will bill each district accordingly. Internal Audit reviewed billing records for the Eagle Sewer District, and the Garden City Sewer District. The billing was compared to loading reports containing the monthly, and the mean daily flow from various monitoring sites. The sewage waste strength is also sampled for biochemical oxygen demand (BOD) and total suspended solids (TSS), both of which factor into billing calculations. Review of the billing records suggests not all billings appear to have been properly calculated. Audit noted the following billing errors: a) The Eagle Sewer District Treatment Loading information suggests that a re-billing should have occurred for March However, it appears that the March 2016 re-billing was not completed. 6

7 b) The amount due for Fiscal Year 2014 does not agree with the letter support submitted to Garden City; the Treatment Loading data sheet was not accurately utilized to compute the average daily system loading for BOD and TSS. c) The department reviewed the reimbursement to the West Boise Treatment Plant and found that the Utility Reimbursement, which is part of the basis for the billing, was not included. As a result of the current process and procedures, billing records appear to be incorrectly calculated. The Eagle Sewer District and Garden City Sewer District charges for services that were under review equate to approximately $2.1M. Audit estimates the nominal error resulting from these issues to be approximately $4K. A comprehensive review of the loading information would ensure the accuracy of billing records. RECOMMENDATION: Internal Audit recognizes that the Sewer Operations Division / Public Works identified two of the three errors noted prior to the audit. However, the resolution had not occurred as of the date of our review. Internal Audit recommends the Sewer Operations Division / Public Works consider updating the customer billing data in an effort to make all parties whole. Furthermore, management should consider strengthening their controls in order to ensure billings are accurately calculated and presented. MANAGEMENT RESPONSE: Public Works management provided the following responses for each respective billing error: a) The TSS value from the March 2016 lab report was incorrectly entered into the billing spreadsheet. The value on the lab report was 75.15, and the value entered into the billing spreadsheet was The billing difference equated to $18.04, which was included in the August 2016 billing. b) FY 2014 Garden City Final Billing: The original final billing amount for FY 2014 for Garden City was $2,206.99, which matched the letter sent to Garden City. While completing the FY 2015 final billings, staff found a minor error in the spreadsheet that also affected the FY 2014 final billings. The error resulted in a credit of $4, for the FY 2014 Garden City final bill. The difference has been included as an adjustment to the FY 2015 final bill. 7

8 c) As with item 1., staff realized that the Utility Management amount was not entered for the West Boise location. That has been corrected, and the adjustment was included with the FY 2015 Final Billing. PW management acknowledges that there were several minor errors in the district billings. As noted by Internal Audit, the magnitude of the errors is minor, and the corrections have been included in more recent billings. Going forward, each of the billings is being reviewed by the Finance Manager prior to the bills being sent to the Districts. 8

9 OTHER AREA OF CONERN Internal Audit utilizes Other Area of Concern comments to provide management with feedback on issues noted during a project that appear to deserve additional management attention. Audit issued the following comments during the engagement. 1. Training records and management system According to the National Pollutant Discharge Elimination System (NPDES) permit, the permittee (the City of Boise) must develop a quality assurance plan for all monitoring required by the permit, which must include qualifications and training of personnel. Internal Audit reviewed the training records for the Water Industry Bloodborne Pathogens Safety course administered to employees of the Sewer Operations division. The training course is assigned to certain employees based on their title / position through the ilearn training program. Review of the training records suggests the ilearn training program may have failed in the course reassignment for those employees who completed the course after the original due date for completion. Audit noted the following in Finding #1 (see page 5, above): Thirteen (13) employees records reflected expired credentials, and / or the course did not appear to have been assigned due to a vulnerability within the training program. Training courses are required by certain employees city-wide in order to perform their job duties, and may be a requirement given grant funding provided for certain projects. There is a risk that the deficiency we noted during our review may extend to all ilearn training programs city-wide. Internal Audit recommends the HR department determine the extent of the ilearn training program vulnerability. Furthermore, the HR department, in conjunction with their client departments, should review exception reporting to ensure employees have the appropriate credentials given their respective areas of responsibility. Employees should all be current with their respective training. MANAGEMENT RESPONSE: Human Resources management provided the following response: Thank you for the feedback on potential vulnerabilities in our ilearn learning management system (LMS) that were uncovered during your recent audit of Public Works' NPDES permit. We understand the importance of training 9

10 compliance, particularly any tied to a federal grant program, and have done a careful analysis of the areas you have identified in your report. As we advised during the audit, the LMS credential system does not have a warning in place to notify us when a training is completed after the due date. When this occurs the credential does not get 'reset' and consequently, training is not reassigned the following year. We are currently working with IT Application Services to automate new employees being added to credentials automatically, based on their job title, as well as identify and create an automated workaround process that would catch any overdue completions and adjust the credential accordingly. In the interim, we have set up automatic reports that runs weekly, comparing the training Due Date with the actual Completion Date for all citywide compliance training completed during the previous week. We review this report every Monday morning and manually adjust the necessary credentials. We have also changed the wording on the credential alert an employee receives requesting employees notify us when they complete a training after the due date. In preparation for the application IT is developing, we are already reviewing all the credentials one-by-one to identify any training that has expired and reassigning it. As part of that process we are also reviewing each credential to ensure the appropriate employees are included on it. We are also adding an additional notice to each credential that will trigger an to Training and Organizational Development when an employee's credential is 365 days overdue as a final precaution and alert. While we cannot provide a specific timeline on when the enhancements IT is developing will be completed, the first part of the project (automatically adding new employees to credentials) should be completed before the end of the year. We appreciate you bringing these concerns to our attention. 2. Timeliness of billing Internal Audit reviewed billing records for the Eagle Sewer District and Garden City Sewer District. The billing was compared to loading reports containing the monthly and mean daily flow from various monitoring sites. The sewage waste strength is sampled for biochemical oxygen demand (BOD) and total suspended solids (TSS). Garden City is billed based on estimated budget rates, and then trued-up with the difference between the projected and actual costs at year-end. The year-end true-up occurs after the audited financials have been completed and released. 10

11 Review of the billing records suggests not all billings appear to be calculated in a timely manner. Audit found that the Fiscal Year 2015 (as of September 30, 2015) Final Billing to Garden City Sewer District was not complete as of October 6, 2016 over a year later. Billing true-ups are not occurring in a timely manner, and remain unreconciled for the previous fiscal year. While the contract does not establish a timeframe for the City of Boise to compute the difference between the projected and actual costs, the City should provide the Final Billing in a moretimely fashion. Internal Audit recommends that management review current procedures to ensure the final billing is completed in a timely manner, upon completion of the City s audited financials. MANAGEMENT RESPONSE: Public Works management provided the following response: The 2015 Final Billing was not completed in a timely manner. For FY 2016, staff has already done prep work for the FY 2016 Final Billings. Work will officially begin in December 2016 as soon as final fiscal year numbers are available, with a completion expected in February 2017 once the FY 2016 CAFR is complete. (Audit Note: CAFR refers to the City s Consolidated Annual Financial Report, which is released no later than March 31 each year, and covers the previous fiscal year.) 11

12 CONCLUSION Review of the Sewer Operations Division suggests that the business practices and oversight of the regulatory requirements and asset management appear to be comprehensive. The revenue and expense analyses suggest the identification of trends and efficiencies from a personnel and project perspective. The implementation of the recommendations noted within this report should, if implemented, strengthen the control environment of the Sewer Operations Division. Internal Audit would like to acknowledge the staff and management of the Public Works Sewer Operations Division, the Department of Finance & Administration Financial Services Division, and the Department of Human Resources for the assistance they provided throughout the audit project. MANAGEMENT PARTICIPANTS Marcia Schmelzer, Public Works Operations Sr. Manager Heather Buchanan, Public Works Support Systems Sr. Manager John Tensen, City Engineer Michael Comeskey, Public Works Utilities Asset Manager Yvette Harris, Finance Manager Shawn Miller, Human Resources Director 12

13 APPENDIX A Evaluation and Grading of Audits Each audit will be evaluated or graded, and will receive one of the three following ratings. Grades will be assigned based on the perceived best fit. Thus, not all attributes associated with an assigned grade may be present within a given Department or Division. Satisfactory No significant weaknesses or operational issues were noted during the audit. If any issues were noted, they did not materially detract from the business unit s ability to deliver services and / or to accomplish defined mission, goals, and objectives. Overall, systems of internal control are effective, and management oversight is adequate and effective. Needs Improvement Weaknesses or issues detrimental to operational efficiency or effectiveness existed within the audited area, and were encountered frequently enough to lose the appearance of isolated. Issues noted were strongly suggestive of an impaired ability to provide services at needed levels, or to accomplish mission, goals, and objectives successfully. Internal control mechanisms may not be universally in place, implemented, or actively observed. Management oversight is weak. Unsatisfactory Material or significant issues were noted within the operations under review. Issues posed risks that were mission-fatal; the business unit could not successfully deliver services in an acceptable fashion. Management failed to implement appropriate internal control mechanisms. Management oversight is ineffective, absent, or willfully avoided. 13