Denver International Airport Signature Authority Performance Audit

Transcription

1 Denver International Airport Signature Authority Performance Audit December 2013 Office of the Auditor Audit Services Division City and County of Denver Dennis J. Gallagher Auditor

2 The Auditor of the City and County of Denver is independently elected by the citizens of Denver. He is responsible for examining and evaluating the operations of City agencies for the purpose of ensuring the proper and efficient use of City resources and providing other audit services and information to City Council, the Mayor and the public to improve all aspects of Denver s government. He also chairs the City s Audit Committee. The Audit Committee is chaired by the Auditor and consists of seven members. The Audit Committee assists the Auditor in his oversight responsibilities of the integrity of the City s finances and operations, including the integrity of the City s financial statements. The Audit Committee is structured in a manner that ensures the independent oversight of City operations, thereby enhancing citizen confidence and avoiding any appearance of a conflict of interest. Audit Committee Dennis Gallagher, Chair Maurice Goodgaine Leslie Mitchell Rudolfo Payan Robert Bishop Jeffrey Hart Timothy O Brien, Vice-Chair Audit Staff John Carlson, Deputy Director, JD, MBA, CIA, CRMA Sonia Montano, Internal Audit Supervisor, CGAP, CRMA Rudy Lopez, Lead Internal Auditor, MS Tim Waddingham, Senior Internal Auditor, MS Kelsey Yamasaki, Senior Internal Auditor, MPP You can obtain copies of this report by contacting us at: Office of the Auditor 201 West Colfax Avenue, Department 705 Denver CO, (720) Fax (720) Or download and view an electronic copy by visiting our website at:

3 City and County of Denver 201 West Colfax Avenue, Department 705 Denver, Colorado FAX Dennis J. Gallagher Auditor December 19, 2013 Ms. Kim Day, Manager of Aviation Department of Aviation City and County of Denver Dear Ms. Day: Attached is our Denver International Airport (DIA) Signature Authority performance audit. The purpose of the audit was to assess whether a consistent signature authorization policy is in place for the review, approval, and authorization of transactions necessary to commit DIA funds, obligations, contracts, and assets. The ability to bind an organization or expend funds on its behalf is an important responsibility. Well run activities place a high degree of precision surrounding who can obligate the business and for what particular purpose. An enterprise as large as DIA needs a robust system of internal controls surrounding the expenditure of resources. Our performance audit reviewed the system of internal controls dedicated to this noble purpose. Limited signature authority governance policies can result in inconsistent processes and outcomes, which can impact operations and weaken internal controls. Further, managers and their subordinates may not have a thorough understanding of their roles and responsibilities and may approve items inappropriately. Our review identified several areas of opportunity that will enhance DIA s ability to implement an effective signature authority governance structure and, in addition, improve guidance for employees with signature authority and implement various policies and procedures to enhance internal controls. We hope that our findings and the thoughtful recommendations presented in our report will assist with the development and implementation of a well-defined and structured signature authority governance policy. If you have any questions, please contact Kip Memmott, Director of Audit Services, at Sincerely, Dennis J. Gallagher Auditor To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

4 Ms. Kim Day December 19, 2013 Page 2 DJG/sm cc: Honorable Michael Hancock, Mayor Honorable Members of City Council Members of Audit Committee Ms. Cary Kennedy, Deputy Mayor, Chief Financial Officer Ms. Janice Sinden, Chief of Staff Ms. Beth Machann, Controller Mr. Doug Friednash, City Attorney Ms. Janna Young, City Council Executive Staff Director Mr. L. Michael Henry, Staff Director, Board of Ethics Mr. Patrick Heck, Chief Financial Officer, Aviation To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

5 City and County of Denver Dennis J. Gallagher Auditor 201 West Colfax Avenue, Department 705 Denver, Colorado FAX AUDITOR S REPORT We have completed an audit of the internal controls related to signature authority for Denver International Airport (DIA) agreements. The purpose of the audit was to assess whether a consistent signature authorization policy is in place for the review, approval, and authorization of transactions necessary to commit DIA funds, obligations, contracts, and assets. We also sought to determine whether the signature authority policy is a functional component of DIA s internal control system. This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, General Powers and Duties of Auditor, and was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The audit found that DIA does not have a signature authority governance structure in place to assist management in determining who should have signature authority and at what limits. DIA is also lacking guidance detailing the purpose of and responsibilities associated with signature authority. The lack of a governance structure surrounding signature authority has led to inefficiencies such as employees not understanding the roles and responsibilities of signature authority, a wide range of authority limits that do not necessarily align with purchasing needs, and limited policies related to granting access to the purchasing system. Further, we found that the policy for documenting, storing, and maintaining signature authority is cumbersome and time consuming; purchasing controls are adequate, but could be enhanced to improve efficiency and security; and there is no policy in place that requires employees with signature authority to attend training regarding their roles and responsibilities. Although our review identified areas to improve signature authority controls for the DIA purchasing system, we found sufficient controls are in place related to the DIA contracting system. We extend our appreciation to the personnel at DIA who assisted and cooperated with us during the audit. Audit Services Division Kip Memmott, MA, CGAP, CRMA Director of Audit Services To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

6 City and County of Denver Office of the Auditor Audit Services Division REPORT HIGHLIGHTS Denver International Airport Signature Authority December 2013 The audit assessed the signature authority policy as an internal control mechanism regarding the review, approval, and authorization of transactions to commit DIA funds, obligations, contracts, and assets. Background Signature authority is delegated by the Manager of Aviation and deputy managers to individuals across the airport to approve the purchases of goods and services that are essential to operations. For fiscal year 2013, there are 138 individuals with the ability to approve purchases of goods or services at various limits. Signature authority limits range from $1,500 to $10 million. Although numerous individuals can approve purchases, only the Manager of Aviation can approve contracts. Contracts greater than $500,000 must be reviewed by the Denver City Council and are only approved upon signature of the Mayor. Purpose The objective of the audit was to evaluate whether DIA has an appropriate governance structure in place to delegate signature authority and monitor the activities of individuals with signature authority. We also sought to determine whether the current oversight procedures for monitoring electronic signature authority in applicable systems were appropriate. Highlights Denver International Airport (DIA) does not have an airport-wide signature authority governance structure in place specifying who should have signature authority, at what limits, or detailing the purpose and responsibilities associated with signature authority. DIA is a robust operation and, from July 2012 through July 2013 alone, made nearly $100 million in purchases as part of its routine business operations. The lack of a signature authority governance structure prevents employees from fully understanding the roles and responsibilities of signature authority. Further, it results in a wide range of authority limits that do not necessarily align with purchasing needs and limited policies related to granting access to the purchasing system. In addition, we found the following: The policy for documenting, storing, and maintaining signature authority is cumbersome, time consuming, and incomplete. Purchasing controls are adequate but could be enhanced to improve system workflow controls, and review of purchase requisition data would increase efficiency and security. There is no policy in place that requires employees with signature authority to attend training regarding their associated roles and responsibilities. Although our review identified areas to improve signature authority controls for the DIA purchasing system, we found that sufficient controls are in place related to the DIA contracting system. For a complete copy of this report, visit or contact the Auditor s Office at

7 TABLE OF CONTENTS INTRODUCTION & BACKGROUND 1 Signature Authority at Denver International Airport 1 Governance and Structure 1 Denver International Airport s Finance and Administration Division Is Responsible for Managing Purchases 3 DIA Purchasing Process 3 DIA Purchasing and Contract Management Systems 5 SCOPE 7 OBJECTIVE 7 METHODOLOGY 7 FINDING 9 Denver International Airport Lacks a Formal Signature Authority Governance Structure, which Impacts Efficiency 9 RECOMMENDATIONS 23 APPENDICES 25 Appendix A Executive Order 8: Contract Procedures 25 Appendix B Fiscal Accountability Rule 2.1: Expending Authority Delegation 39 Appendix C Fiscal Accountability Rule 8.1: Procurement 40 Appendix D Career Service Rule 6: Employee Training and Organizational Development 46 Appendix E Denver International Airport Sub-process 3.1: Purchase Requisition 48 Appendix F Denver International Airport Sub-process 3.8: Invoice Processing Contracts/Payment Applications 51 Appendix G Denver International Airport Sub-process 3.11:

8 TABLE OF CONTENTS (continued) Expenditure Authorization Lists 55 AGENCY RESPONSE 57

9 INTRODUCTION & BACKGROUND Signature Authority at Denver International Airport Denver International Airport (DIA) is a robust operation, employing more than 31,000 people, more than 1,000 of whom are employees of the City and County of Denver. From July 2012 through July 2013 alone, DIA made nearly $100 million in purchases as part of its routine business operations. These purchases included supplies and utilities, among other transactions necessary for day-to-day operations. As such, thousands of purchasing requests are considered and approved by DIA personnel on an annual basis. Further, as of August 2013 there were approximately 278 active expenditure contracts, which amounted to over $2 billion in contract values. Signature Authority as a Governance Tool Governance is the foundation that sets rules, policies, and expectations that must be followed to establish consistency within an organization. Similarly, signature authority governance establishes a set of rules, policies, and expectations that must be followed when committing an organization to a financial or legal obligation. Signature authority grants certain employees the ability to authorize and commit an organization to purchases, obligations, contracts, or assets. Without specific governance policies in place, inconsistent processes and outcomes may impact an organization s ability to operate as efficiently and effectively as possible. DIA management empowers employees to commit the airport through signature authority authorizations. Some examples include the approval of purchase requisitions, lease agreements, memoranda of understanding, contract selection and approvals, and contractor payments. This audit focused on signature authority governance as it relates to purchasing and contract approvals. Governance and Structure Purchasing at DIA is governed by several City rules and policies, as well as DIA-specific rules and policies, specifying how purchases should be authorized. These rules and policies were established to guide City agencies and ensure consistency in purchase requisitions, purchase orders, and the signature authority that permits various commitments. These rules and policies include but are not limited to the following seven general areas. Executive Order 8 Requires that the following procurement categories are conducted by the Purchasing Division and controlled by Fiscal Accountability Rule 8. 1 Supplies Equipment 1 See Appendix A Executive Order 8: Contract Procedures. Page 1 Office of the Auditor

10 Personal property Services for the repair or maintenance of supplies, equipment, and personal property Official publications Office services common to several departments that have been formally centralized by the Mayor Services that cost $5,000 or less Emergency requirements Additionally, Executive Order 8 requires approval by City Council for contracts that may require the City to expend $500,000 or more or sell personal property worth $500,000 or more, including amendments which cause the total contract to exceed that amount. Fiscal Accountability Rule 2.1 Requires that all City financial transactions be authorized by an Expending Authority. 2 Each Expending Authority is responsible for the management of funds in his or her organization and for assuring that all transactions are reasonable, necessary, and consistent with City Charter, ordinances, policies and procedures, and other applicable laws. The Expending Authority may delegate signature authority for requisition and journal transactions by completing and authorizing the Expending Authority Delegation Form; delegated signature authority shall remain in effect until a new Expending Authority Delegation Form is accepted by the City Controller s Office. Fiscal Accountability Rule 8.1 Holds that a Purchase Order is the primary method for procurement and all purchase requisitions shall be approved by the Expending Authority of the requisitioning agency or department affirming that the goods or services are necessary and that sufficient, unencumbered funds exist to pay for the purchase. 3 Career Service Authority Rule 6 Sets forth the responsibility, under the Denver Revised Municipal Code, for developing and administering employee training and organizational development programs. 4 DIA Sub-Process Policy 3.1 Provides an overview of the policies and procedures regarding procurement, purchase requisitions, purchase orders, and overall signing authority at DIA. 5 DIA Sub-Process Policy 3.8 Provides a process for ensuring that invoices and Payment Applications pertaining to construction projects and/or other contracts are reviewed for correctness and processed in a timely manner. 6 2 See Appendix B Fiscal Accountability Rule 2.1: Expending Authority Delegation. 3 See Appendix C Fiscal Accountability Rule 8.1: Procurement. 4 See Appendix D Career Service Rule 6: Employee Training and Organizational Development. 5 See Appendix E Denver International Airport Sub-process 3.1: Purchase Requisition. 6 See Appendix F Denver International Airport Sub-process 3.8: Invoice Processing Contracts/Payment Applications. City and County of Denver Page 2

11 DIA Sub-Process Policy 3.11 Requires that Expenditure Authority Lists (EALs) are updated annually and include documentation of individuals with signing authority for each section of DIA, their signatures, and approval of the EALs by Deputy Managers. 7 Denver International Airport s Finance and Administration Division Is Responsible for Managing Purchases The DIA Finance and Administration Division oversees the purchasing function at DIA. DIA s Accounts Payable Section processes all invoices for goods and services received at DIA, and purchases are reviewed by the City s Purchasing Division under the Department of General Services. 8 In general, any purchase of a product or service for DIA must be initiated as a purchase requisition (PR). 9 A PR is generated in Maximo, DIA s purchasing system, and assigned to someone with signature authority to be approved before it is processed into a purchase order (PO). From July 2012 through July 2013, DIA generated and approved nearly 15,000 PRs totaling $98.4 million. Purchases at DIA are approved at several different signing authority limits, ranging from $1,500 to $10 million. The purchases for $5,000 and below amounted to $8.8 million; the purchases for $5,001 to $50,000 amounted to $17.9 million; and the purchases for $50,001 and above amounted to $71.7 million. DIA Purchasing Process DIA Purchasing is responsible for assuring that the details of all PRs are sufficiently described to enable the PR to be processed. This includes verifying that the correct fund, division, section, cost center, and general ledger accounts are properly assigned to each PR as well as ensuring that all required authorizations have been obtained. Finally, all PRs must be properly classified under either DIA Purchasing or the Department of General Services. PRs may be initiated by an employee with access to Maximo. However, PRs can only be approved by employees with authority to commit DIA funds. 10 Additionally, the Financial Planning and Analysis Department (FPAD) must verify that there is sufficient budget to fund the purchase before a PR can be processed into a PO. If there is insufficient budget to fund the transaction, FPAD personnel contact the end user to assign the transaction to the correct budget, transfer funds from another project, or cancel the PR. If the budget has sufficient funds for the purchase, and all required approvals have been electronically affixed to the PR, it is forwarded to DIA Purchasing. At this point, DIA Purchasing technicians verify that employees with appropriate signing authority have approved the PR in Maximo. Finally, the PR can be released for PO processing at either DIA Purchasing 7 See Appendix G Denver International Airport Sub-process 3.11: Expenditure Authorization Lists. 8 See Appendix E Denver International Airport Sub-process 3.1: Purchase Requisition. 9 There are exceptions that include: a) the amount of the purchase is less than $2,000; b) the purchase is for a good or service covered by a bid negotiated by the City s Department of General Services; c) the purchase is for items covered by a blanket purchase order covered by the City s Department of General Services. 10 Employees with signature authority for each section are recorded on Expenditure Authorization Forms that are updated annually or more frequently by the Accounting Section in DIA Finance. Page 3 Office of the Auditor

12 or the City s Department of General Services. Figure 1 provides a summary of the purchasing process at DIA. DIA Purchasing handles the following types of POs: Contract Purchases made against a City-approved contract 11 Delegated Purchase Authority Small dollar purchases of goods and services (less than $2,000) Unauthorized Purchase (UNA) A purchase that was made without a purchase requisition or purchase order and normal approvals Unauthorized is a term used by DIA personnel that refers to uncategorized or unusual purchases, as even unauthorized purchases must be approved. For example, for any unauthorized purchase, DIA Purchasing contacts the end user and requires them to create a letter or memo explaining the reason for the unauthorized purchase. This letter must be routed through and signed by the Assistant Deputy Manager of Aviation, the DIA Purchasing Administrator, and the DIA Manager of Aviation. Examples of an unauthorized purchase are if an invoice amount is greater than $2,000 and not related to a bid contract or training services less than $5,000 performed by the Purchasing Administrator. In these cases, PO type UNA is created when invoices are forwarded by end users to DIA Purchasing. Emergency POs When there is an immediate need for a purchase, the end user completes an Emergency Purchase Request (EPR) form documenting the nature of the emergency and the need for accelerated processing of the EPR. The form must be signed by the person who created the EPR, approved by the employee with delegated authority to approve the purchase for that section, and signed by the appropriate Assistant Deputy Manager of Aviation. The following types of purchases must be processed directly by the City s Purchasing Division under the Department of General Services: Blanket POs Initial contracts for recurring purchases under a blanket purchase order Vendor Contracts Competitively bid contracts for goods and services Regular PO Purchases not specifically designated for DIA processing; in general, a Regular PO refers to any order with a value of $2,000 or greater that is not covered by a Vendor Contract or a Blanket PO 11 See Appendix F Denver International Airport Sub-process 3.8: Invoice Processing Contracts/Payment Applications. City and County of Denver Page 4

13 Figure 1 Summary of Denver International Airport s (DIA) Purchasing Process Initation of Purchase Requisition Purchase requisitions are prepared by end users in the Maximo system, which routes the requisition to appropriate reviewers, approvers, and the DIA Purchasing Unit. Requisitions must provide a description and price of the item or service being purchased. Approval of Purchase Requisition Purchase requisitions must be approved by an individual who has been delegated signature authority by section managers. Purchase Requisition Review by Purchasing Purchase requisitions are forwarded to the DIA Purchasing Unit so that Purchasing Technicians can verify that the requisition is reasonable, aligns with the section's budget, and was appropriately approved by an individual with signature authority. Processing Purchase Requisition Once a purchase requistion is reviewed and approved by the DIA Purchasing Unit, it is routed to the City's Purchasing Division under the Department of General Services to be processed into a purchase order. Source: Denver International Airport Sub-Process 3.11: Expenditure Authorization Lists DIA Purchasing and Contract Management Systems DIA utilizes Maximo and Alfresco to help manage PRs and the contracting process. Maximo DIA s purchasing system used to process all PRs. Maximo provides access to the workflow tool that routes PRs to an employee with signature authority for approval. Maximo is also used for inventory management. Alfresco Alfresco is the City s system of record and is used to manage the contracting process by ensuring that only charter-approved contract signers and delegated employees are able to sign a City contract. Currently, the City Attorney, Mayor, Clerk and Recorder, Manager of Finance, and Auditor are required to sign a contract. According to the City Attorney s Office only the Mayor can officially bind the City to a contract, and any changes to the contract signature requirements would require a City Charter amendment. Page 5 Office of the Auditor

14 Alfresco has automated the process of requesting, drafting, reviewing, and approving City contracts. As such, the contracting process is no longer a manual process, but rather an automated web-based workflow process. 12 The workflow functionality moves an agency contract request from an initial request to an official Contract Record. Depending on an employee s access level, Alfresco users can view City contracts, amendments, and expenditures and locate information regarding the progress and status of a contract, among other features. 12 A workflow is a sequence of connected steps or tasks through which an artifact or work product moves on its way to a final desired goal. City and County of Denver Page 6

15 SCOPE The scope of the audit was to assess the internal controls related to signature authority for DIA agreements, including but not limited to signature authority authorization, approval limits, and the procurement process. OBJECTIVE The objective of the audit was to assess whether a consistent signature authorization policy is in place for the review, approval, and authorization of transactions necessary to commit DIA funds, obligations, contracts, and assets. We also sought to determine whether the signature authority policy is a functional component of DIA s internal control system. METHODOLOGY We utilized several methodologies to achieve the audit objective. These evidence gathering techniques included, but were not limited to: Conducting interviews with DIA management and staff Obtaining and reviewing established policies and procedures Reviewing City and state rules and regulations Verifying whether DIA has a signature authority governance policy Identifying the various systems utilized by DIA and understanding the purposes related to signature authority Reviewing and assessing Maximo and Alfresco internal controls and oversight functions Conducting benchmarking activities on similar airports and non-airport organizations Conducting a survey of DIA employees with signature authority to gain a better understanding of how well employees understand their roles and responsibilities associated with signature authority Conducting data analysis to determine whether appropriate employees have signature authority, the optimal number of employees have signature authority, authority levels are appropriate, and delegation is uniform across DIA Verifying whether purchase requisitions and approvals were appropriate Verifying whether contracts are signed by the appropriate employee with signature authority Page 7 Office of the Auditor

16 Assessing whether employees with signature authority are able to generate, approve, and receive an item Assessing the quality of Maximo and signature authority training City and County of Denver Page 8

17 FINDING Denver International Airport Lacks a Formal Signature Authority Governance Structure, which Impacts Efficiency In order to efficiently and effectively manage an organization, leaders must delegate certain aspects of responsibility, accountability, and powers to their direct reports. Signature authority is an example of this type of delegation, which Denver International Airport (DIA) uses to provide employees with the authority to review and approve transactions that commit DIA funds, obligations, contracts, and assets. Signature authority and authority limits, in conjunction with workflows within DIA s purchasing system, Maximo, provide an internal control mechanism designed to prevent inappropriate purchase requisitions from being processed and ensure proper review. In general, authority limits flow from top to bottom, where members of senior management are authorized to approve higher expenditure requests than their subordinates. Delegating authority to others does not imply reduction in accountability, which still rests with the Manager of Aviation, who is ultimately responsible for all transactions at DIA. Our audit focused on signature authority governance surrounding purchase requisitions and contracts at DIA, which included a review of system internal controls and processes. We found six areas that impact the effectiveness of DIA s signature authority governance policy, which include: Minimal guidance for managers and employees with signature authority regarding their roles and responsibilities Inefficient processes for documenting, storing, and maintaining signature authority No policies and procedures outlining how access to Maximo should be delegated, documented, and maintained for decisions regarding purchases and contracts Limited Maximo workflow controls Limited analysis and review of purchase requisition data No policies and procedures or formalized training regarding signature authority governance DIA Provides Minimal Guidance regarding Signature Authority Roles and Responsibilities Our review indicated that DIA does not have a signature authority governance structure in place. Specifically, we found that there is no guidance for the Manager of Aviation or deputies to assist them in determining who should have signature authority and what authority limits are appropriate. Further, there is no guidance detailing the purpose of and responsibilities associated with signature authority. As a result, some DIA employees Page 9 Office of the Auditor

18 have been delegated signature authority at a wide range of authority limits without a complete understanding of their associated roles and responsibilities Our research indicates that other airports and non-airport organizations have more robust signature authority governance policies. For example, Dallas/Fort Worth International Airport and Los Angeles International Airport both have policies and procedures that document signature authority levels and specific positions that may delegate authority. Further, the non-airport organizations we researched all have policies and procedures regarding signature authority governance. For example, the signature authority policy at California State University Long Beach provides the purpose, a guideline statement, a definition of authority, general scope of signature authority with five different levels, allowable types of transactions by level, and an explanation of the internal controls in place. DIA does have a purchase requisition (PR) policy and procedure that explains the process for ensuring that all PRs are properly prepared, authorized, and entered into the Maximo system. The There is no signature authority governance structure in place at DIA, leading to limited understanding of roles and responsibilities. policy states that PRs can be initiated by an employee with access to Maximo and that all PRs must be approved by someone designated by a section manager as having signing authority in order to commit DIA. 13 Although this policy provides information on how to process a PR and states that it must be approved by someone with signing authority, there is no guidance regarding the roles and responsibilities for employees with signature authority. During our testing, an employee with signature authority indicated that they were not sure what their signature limit was, but believed it was low since they do not use it. Another employee stated that having signature authority meant approving the invoice or expenditure for payments at my dollar amount. Overall, DIA employees with signature authority did not indicate having a clear understanding of how signature authority limits were determined and how signature authority responsibilities impact the overall internal control environment. According to DIA management, it is the responsibility of each section manager to determine who should have signature authority, and employees limits should be based on the section s unique needs. Thus, authority limits and the total number of employees with the authority are informally determined by each DIA section. Without specific guidance in place for management to reference, there may be several employees with signature authority who do not need it. When employees do not understand their responsibilities associated with having signature authority, or how this function serves as an internal control mechanism to ensure that a PR is appropriate and necessary, inappropriate PRs may be approved. From July 2012 through July 2013 there were 138 individuals at DIA with signature authority. Of these individuals, seventy-three had signature authority at or above $50,000, six had signature authority from $10,000 up to $35,000, and fifty-nine had signature 13 See Appendix E Denver International Airport Sub-process 3.1: Purchase Requisition. City and County of Denver Page 10

19 authority at or below $5, Table 1 highlights the total number of individuals with signature authority, the various limits, and percentage of total users by limit. Table 1 Distribution of Signature Authority Limits at Denver International Airport, 2013 Signature Authority Limits Number of Employees % of Total Users $1, % $2, % $5, % $10, % $25, % $35, % $50, % $10 million 26 19% Total % Source: Denver International Airport Maximo System Based on Table 1 it appears that the signature authority limit structure is bifurcated: 43 percent of employees have signature authority at or below $5,000 and 53 percent of employees have signature authority at $50,000 and above. Although the signature authority limit structure is bifurcated, the vast majority of PRs that were generated and approved during the test period were for goods and services amounting to less than $5,000. Table 2 provides a breakdown of PRs that were generated and approved by dollar amount. Table 2 Purchase Requisition by Dollar Amount at Denver International Airport, July 2012 through July 2013 Purchase Requisition Amounts No. of Purchase Requisitions % of Total $5,000 and Below 13,606 91% $5,001 to $50,000 1,070 7% $50,001 and Above 267 2% Total 14, % Source: Denver International Airport Maximo System As shown in Table 2, 91 percent of all PRs that were generated and approved were for goods and services amounting to $5,000 or less. Only 2 percent of PRs were for goods and services greater than $50,000. Furthermore, we found that over 25 percent of all PRs for $5,000 or less were approved by an employee with a signature authority limit of $50,000 and greater. This analysis indicates that DIA s signature authority limits are not aligned with purchasing needs and trends. As such, authority limits need to be reassessed and adjusted, and the number of employees at each authority limit should be redistributed. Additionally, these facts suggest that employees with high authority limits 14 Signature authority limits allow employees to authorize purchase requisitions up to their limit. For example, employees with a $50,000 limit may authorize purchase requisitions from one dollar to $50,000 while employees with a $10 million limit may authorize purchase requisitions from one dollar to $10 million. Page 11 Office of the Auditor

20 are responsible for approving too many low-dollar PRs that could be reviewed by their subordinates with lower authority limits. If authority limits were adjusted to align with purchasing needs and trends, employees with high authority limits such as deputy and section managers and directors could rely on their subordinates to review and authorize more PRs. The purchasing review process would be more efficient and employees with high signature authority limits would have more time to devote to other areas under their purview. For example, of the four hundred PRs reviewed and approved by deputy managers, 65 percent were for goods and services less than $5,000. If it took each deputy manager five minutes to review and approve each PR that was less than $5,000, the group collectively spent nearly twentytwo hours reviewing and approving PRs. If they had been reviewed by another employee, the twenty-two hours could have been spent on more productive and valuable endeavors befitting of a deputy manager s level of experience and expertise. In the absence of a signature authority governance structure, DIA management and employees may not be held accountable for approvals due to the lack of defined oversight responsibilities. Establishing a consistent signature authority governance policy regarding the review, approval, and authorization of transactions is a necessary internal control component that ensures the funds, obligations, and resources committed are in the best interest of DIA and the City. Thus, the Manager of Aviation should develop an airport-wide signature authority governance structure and policy that provides details of the purpose of having signature authority and associated responsibilities. The policy should include a general framework and internal control overview that all sections at DIA can follow when determining who should have signature authority and at what limits. Additionally, the Manager of Aviation in conjunction with deputy managers should conduct an analysis to determine the appropriate levels of signature authority and optimal number of employees who should have signature authority by section. The analysis should consider signature authority best practices implemented at other airports and non-airport organizations in order to establish a good signature authority governance structure. Alfresco Internal Controls are Sound Our review of Alfresco internal controls related to signature authority indicated that adequate controls are in place. We identified several controls including, but not limited to, the following: An audit trail is available showing a history of completed tasks. Administrative rights are limited to only three individuals. Once the contractor s signature is obtained, the system prevents users from making any change to the contract. Each contract is assigned a unique password. Individuals with signature authority are assigned a unique PIN number in order to review and approve a contract. City and County of Denver Page 12

21 Alfresco data is backed up on two servers. Thus, Alfresco internal controls appear to be adequate to prevent individuals from inappropriately approving a contract. DIA s Process for Documenting, Storing, and Maintaining Signature Authority Can Be Enhanced Although DIA does not have a formal signature authority governance structure, there is an established policy and procedure to document, store, and maintain signature authority. Sub-process 3.11, Expenditure Authorization Lists, provides a process for creating and updating an Expenditure Authorization List (EAL) for each DIA section showing employees with Section Signature Authority, their respective authority limits, and their signatures. The Staff Financial Management Analyst (Analyst) of the DIA Accounting Section is responsible for maintaining the EALs. 15 At the beginning of each fiscal year, the Analyst obtains a completed EAL from all sections, each of which must be approved in writing by the section s deputy manager and include the names, signatures, and authorization limits of all employees to whom he or she has delegated signature authority. Figure 2 outlines the EAL documentation, storage, and maintenance policy and procedures. Figure 2 Denver International Airport Process for Documenting, Storing, and Maintaining Signature Authority Step 1: Step 2: Step 3: Step 4: Step 5: The Analyst sends out the Expenditure Authorization List to all section managers. This form has the names of all individuals in each section with signature authority. Deputy managers complete the Expenditure Authorization List and obtain the signatures of all individuals. Deputy managers sign and return the form to the Analyst. If no changes are made from the previous year, the form does not need to be revised. The Analyst forwards copies of the form to Purchasing, Accounting, the Maximo Administrator, Financial Planning & Analysis, and Accounts Payable Processors. The Analyst ensures that all forms are properly stored and up-to-date, and if necessary recirculates the form for revisions and reauthorizations. Source: Denver International Airport Sub-process 3.11: Expenditure Authorization Lists 15 The Expenditure Authorization List that the Staff Financial Management Analyst is responsible for is not the same Expenditure Authorization Form that must be submitted to the City Controller s Office in accordance with Fiscal Accountability Rule 2.1. Page 13 Office of the Auditor

22 Although the EAL is the official record of employees with signature authority and their authority limits, the Maximo system controls signature authority and enforces authority limits. 16 As such, the Analyst must align Maximo signature authority and authority limit controls with the EAL. Once all EALs are submitted, the Analyst inputs the data into Maximo, setting the signature authority and authority limit controls for the year. Signature authority and authority limit controls are set by the Analyst to expire in Maximo every year unless updated or modified. In addition to aligning the EAL and the Maximo system controls, the Analyst is responsible for updating both Maximo and the EAL to reflect the arrival and departure of personnel throughout the year. Our analysis of the policy and procedures for maintaining the EAL for all sections found them to be time consuming, manually intensive, and incomplete. In addition, there is no formalized quality assurance review to ensure that all documentation and systems align. First, the process requires the Analyst to collect signatures from nearly 150 employees across 54 sections on an annual basis. In addition, the Analyst must periodically collect additional signatures when a new hire is delegated signature authority or gather documentation from a deputy manager confirming when an employee with signature authority departs. Both efforts require the Analyst to follow up with employees who are delinquent in submitting and signing the EAL on time and working with deputy managers to ensure that each section s EAL is up to date throughout the year. Such efforts have the potential to lead to misalignment between employees who need or do not need signature authority, the EAL, and the Maximo signature authority and authority limit controls. Second, the policy and procedures for documenting, storing, and maintaining the EAL are incomplete for extended absences. Although the policies are specific regarding how the Analyst will maintain the EAL when individuals are hired and depart, it does not prescribe how the EAL will align with Maximo signature authority and authority limit settings when signature authority is delegated on a temporary basis due to an extended absence from the office. Currently, when employees with signature authority typically deputy and section managers are absent from the office for an extended period of time, they can the Analyst with the name of the employee who will have their authority, and for how long, while they are out of the office. Deputy and section managers are reminded on an annual basis that they should notify the Analyst of extended absences. Despite having a clear and consistent practice specifying how signature authority will be There is no formal policy for deputy or section managers if they need to temporarily delegate their signature authority when absent from the office for an extended period. delegated on a temporary basis, without a formal policy and procedures for handling the matter, the potential for confusion about how to handle signature authority in extended absences increases. 16 Maximo is an asset, inventory, and procurement management system used by DIA to handle purchasing and inventory management. City and County of Denver Page 14

23 In addition, we tested whether the EAL aligned with the Maximo system controls for signature authority. Of the 22 sections and 102 names tested, we found only one instance where an employee was delegated signature authority by a deputy manager but had not signed the EAL. 17 This error was immediately fixed. Overall, the policy and procedures for documenting, storing, and maintaining signature authority, although time consuming, are thoroughly and properly implemented. To improve how signature authority is documented, stored, and maintained, the Chief Financial Officer of Aviation should revise Denver International Airport Sub-process 3.11 to: Streamline the process to document, store, and maintain the EAL Include provisions that require the Analyst to verify that the EAL and Maximo signature authority and authority limit controls are aligned Include guidance on how signature authority will be delegated and documented when deputy and section managers are out of the office for extended periods of time DIA Does Not Have Policies or Procedures that Appropriately Outline How Maximo Access Will Be Delegated, Documented, and Maintained Signature authority and authority limits are controlled by DIA s Maximo purchasing system, access to which is granted through completion of a Maximo Account Request Form that is approved by the Staff Financial Management Analyst. Technology Services then uses the form to grant appropriate access to Maximo security groups, according to the justification provided on the form. Security group access can also be granted as needed once an employee has a Maximo account. Security groups in Maximo allow users different levels of access. For example, one security group has read-only access and another with administrative rights allow users unfettered access to the system. Despite having a clear process for granting access to Maximo, access is not governed by any specific policy or procedures. As such, access to Maximo and different security groups could be granted inappropriately or excessively. Additionally, the current process that is used to delegate access to Maximo and different security groups is not sufficiently controlled. Through interviews with DIA personnel, we learned that access to Maximo and different security groups is essentially granted to whoever makes a request. There are 675 employees with Maximo accounts at DIA, of which 138 have signature authority rights, 28 have status change rights, and 8 have administrative rights. 18, 19 Of the 17 At DIA there are 54 sections, each with its own Expenditure Authorization List. There are a total of 245 names across all 54 Expenditure Authorization Lists. 18 Status change rights allow an employee to change the workflow status of a PR. For example, the status of a PR may need to be changed if it needs to be broken up into multiple requisitions, if information is missing from the requisition, or if it needs to be approved by someone else. Nine of the twenty-eight employees with status change rights do not have signature authority. 19 Employees with administrative rights can change settings in Maximo, provide employees with access to different security groups, and set up accounts for new users. None of the employees with administrative rights have signature authority or status change rights. Six of the eight employees with administrative rights are in the IT division while two employees have limited administrative rights because they are responsible for controlling the signature authority and authority limit settings. Page 15 Office of the Auditor

24 675 Maximo users, only 325 of them generated or approved a PR during the test period of July 2012 through July Of the 350 who did not generate or approve a PR during the test period, some use Maximo to check inventoried and stocked items. However, the employees who do not use Maximo for inventory purposes or to generate and approve PRs may not need access to the system. Removing access would reduce the risk of processing inappropriate PRs. In addition to not having policies and procedures that govern access to Maximo and the various security groups, there is no policy or procedure that clearly outlines who is responsible for reviewing the security settings and security group membership. During our interviews with DIA personnel, we learned that there have been instances where IT personnel have checked the system and have found security groups with no members, so the security groups were deleted. The Manager of Aviation should adopt a policy and procedure that: Specifies who has the authority to delegate access to Maximo Specifies who should be given access to Maximo and various security groups and how access will be documented Specifies who is responsible for reviewing Maximo security settings and security group membership Delineates how often Maximo security groups should be reviewed Prohibits DIA IT personnel with Maximo administrative rights from modifying the signature authority and authority limit controls except in emergencies when the Staff Financial Management Analyst is not available In addition, the Manager of Aviation should establish a policy outlining status change rights for employees without signature authority. Maximo Workflow Controls Are In Place but Could Be Enhanced to Improve Efficiency and Security DIA has clear and comprehensive purchasing policies and procedures that outline the proper process that all employees should follow to generate and approve a PR. In addition, Maximo workflows are configured to prevent employees without signature authority to approve PRs or allow employees to approve PRs that are above their authority limit. To ensure that this activity is indeed being prevented by current system configurations, we analyzed all PRs that were generated and approved from July 2012 through July We did not find any improper PRs or PRs that were inappropriately approved in our testing. From July 2012 through July 2013, nearly 15,000 PRs were generated and approved. Table 3 provides a summary of the PRs that were generated and approved by signature authority limit. Initially, we found that 97 percent of all PRs were appropriately processed, 20 Maximo is also used as an inventory management system. As such, not all Maximo users use the system to generate or approve PRs. Many employees use Maximo to check inventoried and stocked items. City and County of Denver Page 16

25 2 percent were approved by someone without signature authority, and 1 percent were approved by employees without the appropriate authority limit. Table 3 Summary of Generated and Approved Purchase Requisitions by Authority Limit at Denver International Airport (DIA), July 2012 through July 2013 Authority Limit (n = # of employees with authority) No. of Purchase Requisitions Approved Average Amount Median Amount No Signature Authority (n=32) 357 $3,745 $12,879 $1,500 to $5,000 (n= 59) 9,709 $699 $183 $10,000 to $35,000 (n=6) 180 $5,322 $760 $50k and Above (n= 73) 4,697 $19,017 $1,125 Total 14,943 $6,585 $278 Source: DIA Maximo Purchase Requisition Data Note: The purchase requisitions that were approved by employees without signature authority were confirming requisitions. These requisitions have already been approved and are entered into the Maximo system so that bills and invoices for services, provided by vendors such as FedEx and Verizon Wireless, can be paid. We conducted further testing on the 3 percent of PRs that appeared to be inappropriately approved. Of the 2 percent of PRs that were approved by an employee without signature authority, a 10-percent sample was selected to test whether they were actually approved by an employee with signature authority. All were confirmed by the Purchasing Administrator at DIA to have been approved by an employee with signature authority with the appropriate authority limit. It was further explained to us by the Purchasing Administrator that these PRs were confirming PRs that were entered into Maximo only to issue a PO. These confirming PRs were for items or services that are under contract or a master purchase order such as FedEx shipping, ARAMARK uniform cleaning, or Verizon Wireless cellular telephone services. Of the 1 percent that were approved by employees without the appropriate authority limit, a 10-percent sample was selected for further testing. All POs in the sample were eventually found to have been appropriate because the employee had the correct authority limit when the PR was approved or because they were confirming PRs. Overall, we did not find any improper PRs or PRs that were inappropriately approved. As such, we concluded that the Maximo workflow controls and security settings are working. Although there are Maximo workflow controls currently in place, they could be enhanced to improve efficiency and security. For example, during our interviews with DIA personnel, we found that Maximo has the capability to require high-dollar purchase requisitions to be approved by multiple employees, and provide notifications to employees when a PR has been in their queue for an extended period of time. We also found that other airports have workflow controls that DIA does not currently utilize. For Page 17 Office of the Auditor

26 example, Dallas/Fort Worth International Airport does not allow employees to generate and approve their own PRs, Los Angeles International Airport only allows two employees within each division the ability to generate PRs, and Miami International Airport requires that PRs above a certain dollar amount be approved by two employees. Non-airports, particularly colleges and universities, also have workflow controls that DIA management should analyze. For example, California State University Long Beach prohibits subordinates from approving PRs originating from their supervisors. We recognize that, although the aforementioned controls may work for other airports, they may not necessarily work for DIA. As such, as DIA re-implements the Maximo system in 2014, deputy and section managers should analyze which workflow controls are necessary to enhance efficiency without compromising security, and vice versa. 21 For instance, adopting a policy that prohibits employees from generating and approving their own PRs may enhance security, but it may not be efficient for DIA management to implement such a control. Based on the PR data we analyzed, 56 percent of all PRs were generated and approved by the same employee, of which the vast majority were for purchases under $5,000. On the other hand, setting up an notification system that alerts employees when a PR is in their queue may be beneficial as it takes an average of two business days for DIA PRs to be approved. The Assistant Deputy Manager of Aviation for the Finance and Administration-Business Management Services Section should determine which purchasing workflow controls are necessary and proper to enhance efficiencies and security so that they can be deployed when Maximo is re-implemented in Contract Workflow and Approvals DIA utilizes Alfresco to manage and process contracts electronically, which includes obtaining charter-approved signatures. As such, our testing of DIA contracts in Alfresco did not identify any instances where contracts were inappropriately approved by individuals without signature authority. Thus, workflow features, which included signature authority controls and oversight, appeared to be adequate to prevent unauthorized individuals from signing a City contract. DIA Purchasing Managers Do Not Routinely Analyze and Review Purchase Requisition Data DIA PRs are reviewed by employees with signature authority, the Purchasing or Materials Management Section at DIA, and the City s Purchasing Division under the Department of General Services before they are processed and converted into a PO. This process provides multiple reviews before a PR is officially approved. Although reviews are conducted to verify that the PR is for legitimate purposes, and that the PR was appropriately approved, the primary purpose of these reviews is to ensure that the items 21 DIA is re-implementing the Maximo system in 2014 because when it was originally implemented it was highly customized upon the request of DIA management at the time. This customization made it extremely difficult to modify workflows and settings. The system re-implementation will move DIA away from its customized processes and adhere to generally accepted standard operating procedures that are built into the basic Maximo operating system. City and County of Denver Page 18

27 align with the end user s section budget. 22 These reviews include high-dollar and high-risk PRs. 23 Figure 3 provides a summary of the PR review process. Figure 3 Summary of Denver International Airport (DIA) Purchase Requisition Review Process Purchase Requisition Generated by End User Review of Purchase Requisition by Individual with Signature Authority within Section Review of Purchase Requisition by DIA Purchasing Section Review of Purchase Requisiton by the City's Purchasing Division for Processing Delivery of Item to Airport Office Building or Materials Management Item Picked Up by End User at Airport Office Building or Materials Management Source: Denver International Airport Sub-Process 3.11: Expenditure Authorization Lists Although PRs are reviewed multiple times before they are processed and converted to POs, employees with signature authority particularly purchasing administrators and supervisors do not routinely generate and analyze PR reports to ensure that their original reviews were accurate, valid, complete, and in accordance with relevant policies and procedures. We did not find any improper PRs or inappropriately approved PRs during our audit, which we believe indicates that the review process and Maximo workflow controls are functioning as intended. Other institutions have PR data review requirements. For example, the Oregon Department of Human Services outlines in its signature authority policies and procedures that employees with signature authority have the responsibility to monitor and oversee expenditures they have authorized in addition to being subject to fines and penalties or personally financially liable for authorizing improper use of funds. Further, Yale University s signature authority policies and procedures specify that PR data shall be reviewed on a monthly basis for accuracy, completeness, and validity. DIA s PR review process could be improved by having purchasing administrators and supervisors review PR data quarterly to: 22 Although employees can generate and approve their own PRs, the DIA Purchasing Section reviews all PRs. Employees cannot directly receive the good(s) they requisitioned, which acts as an internal control to deter and detect misconduct. Employees must go to either the Airport Office Building Receiving Center or the Materials Management Warehouse. In our testing, we confirmed that employees cannot directly receive the items they requisitioned. 23 High-risk purchases may not necessarily correspond with high-dollar purchases. High-risk purchases can also be for goods or services that would result in the misuse of DIA funds. For example, low-dollar, high-risk purchases could include purchases of furniture and electronic equipment. Page 19 Office of the Auditor

28 Improve the understanding of deputy and section managers with regard to how signature authority and authority limits should be delegated, based on the PRs that are generated and approved Ensure that Maximo signature authority and authority limit controls are properly implemented Prevent or detect inappropriate approval of high-dollar or high-risk PRs Prevent split purchases intended to circumvent signature authority or authority limits DIA Does Not Have a Formalized Signature Authority Governance Training Program or Policy in Place DIA offers Maximo training and has developed a user manual for employees who utilize the system as part of their job function. Further, a Maximo trainer is readily available to provide assistance to employees who have specific system questions or need additional training. However, DIA does not have an official policy mandating who should take a Maximo training class or how often. Since there is no signature authority governance in place at DIA, no specific training has been DIA does not require Maximo or signature authority training, which can lead to inconsistencies and errors. developed regarding the roles and responsibilities for employees with signature authority. This has led to employees not having a thorough understanding of their roles and responsibilities associated with signature authority, which includes understanding how signature authority improves the internal control environment. If employees do not have a thorough understanding of their roles and responsibilities, errors and mistakes may increase, inappropriate PRs and approvals may be made, and the opportunity for fraud may increase. In general, literature related to training suggests that training improves employee morale, decreases necessary supervision, results in fewer mistakes or accidents, and increases promotional opportunities, efficiency, and productivity. 24 Training typically occurs when a new employee is hired, for existing employees to refresh and enhance their current skills and knowledge, when an employee is promoted, or when existing systems are updated or replaced. The City and DIA require that new employees and supervisors take the following training within their initial probation period. 25 New Employee Orientation Ethics 24 Employee Training and Development: Reasons and Benefits, Free Management Library, accessed September 26, 2013, 25 As of September 30, 2013, the City s Office of Human Resources listed on its website several employee and supervisor training classes offered. City and County of Denver Page 20

29 Preventing Harassment The following training classes are offered to new supervisors or employees who would like to gain additional knowledge for their new position or in preparation for promotional opportunities. 26 Leadership and the Role of the Supervisor Career Service Authority Rules, Sexual Harassment, and Employment Law* Selecting and Retaining the Right People Delegation, Documentation and Duty Performance Enhancement Program Workshop* Effective Counseling and Discipline* Problem Solving and Decision Making Coaching, Training and Developing Employees *This supervisor training class is mandatory for new supervisors. Further, Career Service Rule 6 establishes the responsibility for developing and administering employee training and organizational development programs. Appointing authorities are responsible for assuring that training programs are geared toward specific department or agency needs, are planned and established, and that employees have an opportunity to participate in the training offered. 27 Mandatory training for Maximo users and specific training designed around signature authority governance would provide employees with a consistent understanding and general foundation across the airport of the Maximo workflow process and roles and responsibilities associated with having signature authority. Employees with signature authority should have knowledge and an understanding of the following five concepts. 1. What is being approved 2. Whether the transaction is allowable, reasonable, and justified 3. Whether the information and supporting documentation are accurate and complete 4. Whether adequate funds are available to cover the request and the potential impact to the reviewer s section 5. How signature authority serves as an internal control mechanism Thus, when the airport-wide signature authority governance policy becomes effective, DIA's Agency Trainer for Maximo should develop specific training for employees who have been granted signature authority. The training material should include the key elements of the new signature authority governance structure including roles and 26 Ibid. 27 See Appendix D Career Service Rule 6: Employee Training and Organizational Development. Page 21 Office of the Auditor

30 responsibilities, an internal control overview, and failure-to-comply consequences. This training should be required for all employees with signature authority. Additionally, the Manager of Aviation should require Maximo training for all employees who use Maximo as part of their job function. City and County of Denver Page 22

31 RECOMMENDATIONS We offer the following fourteen recommendations to improve internal controls over Denver International Airport s Signature Authority practices. 1.1 Signature Authority Governance Policy The Manager of Aviation should develop an airport-wide signature authority governance policy. The policy should provide a good understanding of the purpose and responsibilities of having signature authority. The policy should also include a general framework and internal control overview that all sections at DIA can follow when determining who should have signature authority and at what limits. 1.2 Signature Authority Governance Analysis The Manager of Aviation in conjunction with deputy managers should conduct an analysis to determine the appropriate levels of signature authority and optimal number of employees who should have signature authority by section. The analysis should consider signature authority best practices implemented at other airports and non-airport organizations in order to establish a good signature authority governance structure. 1.3 Updating Expenditure Authorization Lists The Chief Financial Officer of Aviation should streamline Denver International Airport Sub-process 3.11 for updating the Expenditure Authorization Lists to make it more efficient for the Staff Financial Management Analyst to collect the names and signatures of individuals with signature authority on an annual basis. 1.4 Expenditure Authorization List and Maximo Alignment The Chief Financial Officer of Aviation should enhance Denver International Airport Sub-process 3.11 to ensure that the Staff Financial Management Analyst is responsible for periodically verifying that the Expenditure Authorization List and the Maximo signature authority and authority limit controls are aligned Delegation of Signature Authority for Extended Absences The Chief Financial Officer of Aviation should amend Denver International Airport Sub-process 3.11 to include guidance regarding how signature authority will be delegated and documented when deputy and section managers are out of the office for extended periods of time. 1.6 Access to Maximo The Manager of Aviation should adopt a policy and procedure that specify who has the authority to delegate access to Maximo, who should be given access to Maximo and security groups, and how access will be documented. 1.7 Security of Maximo The Manager of Aviation should adopt a policy and procedure that specify who is responsible for reviewing the security settings and membership to Maximo security groups and how often the system should be reviewed. 1.8 Administrative Rights for Signature Authority Controls The Manager of Aviation should adopt a policy that specifically outlines that IT personnel with administrative rights should not modify the signature authority and authority limit controls in Maximo except in emergencies when the Staff Financial Management Analyst is not available. The policy should outline that if IT personnel need to modify authority limit controls, they should have Page 23 Office of the Auditor

32 documented authority from a deputy manager or the Staff Financial Management Analyst. 1.9 Status Change Rights The Manager of Aviation should establish a policy outlining status change rights for employees without signature authority Maximo Workflow Controls The Assistant Deputy Manager of Aviation for the Finance and Administration-Business Management Services Section should determine which purchasing workflow controls are necessary and proper to enhance efficiencies and security so that they can be deployed when Maximo is re-implemented in Delegation of Signature Authority and Signature Authority Limits Once the airport-wide signature authority governance policy has been developed, the Manager of Aviation should ensure that all deputy managers delegate signature authority and authority limits based on the purchase requisitions that are generated and approved and these limits are properly implemented in Maximo Review of Purchase Requisition Data Once the airport-wide signature authority governance policy has been developed, the Manager of Aviation should ensure that employees with signature authority, particularly purchasing administrators and supervisors, review purchase requisition data to prevent or detect inappropriate approvals of purchase requisitions and prevent split purchases. Purchasing data should be reviewed, at a minimum, on a quarterly basis Signature Authority Training When the airport-wide signature authority governance policy becomes effective, DIA's Agency Trainer for Maximo should develop signature authority training to include the key elements of the new signature authority governance policy including roles and responsibilities, an internal control overview, and failure-to-comply consequences. This training should be required for all employees who have signature authority Maximo Training The Manager of Aviation should require Maximo training for all employees who use Maximo as part of their job function. City and County of Denver Page 24

33 APPENDICES Appendix A Executive Order 8: Contract Procedures Page 25 Office of the Auditor

34 Appendix A Continued City and County of Denver Page 26

35 Appendix A Continued Page 27 Office of the Auditor

36 Appendix A Continued City and County of Denver Page 28

37 Appendix A Continued Page 29 Office of the Auditor

38 Appendix A Continued City and County of Denver Page 30

39 Appendix A Continued Page 31 Office of the Auditor

40 Appendix A Continued City and County of Denver Page 32

41 Appendix A Continued Page 33 Office of the Auditor

42 Appendix A Continued City and County of Denver Page 34

43 Appendix A Continued Page 35 Office of the Auditor

44 Appendix A Continued City and County of Denver Page 36

45 Appendix A Continued Page 37 Office of the Auditor

46 Appendix A Continued City and County of Denver Page 38

47 Appendix B Fiscal Accountability Rule 2.1: Expending Authority Delegation Page 39 Office of the Auditor

48 Appendix C Fiscal Accountability Rule 8.1: Procurement City and County of Denver Page 40

49 Appendix C Continued Page 41 Office of the Auditor

50 Appendix C Continued City and County of Denver Page 42

51 Appendix C Continued Page 43 Office of the Auditor

52 Appendix C Continued City and County of Denver Page 44

53 Appendix C Continued Page 45 Office of the Auditor

54 Appendix D Career Service Rule 6: Employee Training and Organizational Development City and County of Denver Page 46

55 Appendix D Continued Page 47 Office of the Auditor

56 Appendix E Denver International Airport Sub-process 3.1: Purchase Requisition City and County of Denver Page 48

57 Appendix E Continued Page 49 Office of the Auditor

58 Appendix E Continued City and County of Denver Page 50

59 Appendix F Denver International Airport Sub-process 3.8: Invoice Processing Contracts/Payment Applications Page 51 Office of the Auditor

60 Appendix F - Continued City and County of Denver Page 52

61 Appendix F Continued Page 53 Office of the Auditor