A REPORT FROM THE OFFICE OF INTERNAL AUDIT

Transcription

1 A REPORT FROM THE OFFICE OF INTERNAL AUDIT PRESENTED TO THE CITY COUNCIL CITY OF BOISE, IDAHO AUDIT / TASK: #16-04, PDS Permitting AUDIT CLIENT: Planning and Development Services REPORT DATE: July 25, 2016 AUDIT GRADE: Satisfactory REPORT AUTHOR: APPROVED FOR RELEASE: Mariano Caputto CIA Staff Internal Auditor Steven Rehn CIA, CFSA Director of Internal Audit AUTHORITY: Boise City Code, FY2016 Work Plan

2 TASK #16-02, PDS Permitting DATE OF ENGAGEMENT: January 11, 2016 INTRODUCTION The City of Boise, through the Department of Planning and Development Services, collects construction permit fees to cover the costs associated with regulating the design, construction, maintenance, and use of buildings and structures within municipal limits. The Department of Planning and Development Services also collects impact fees designed to finance public facilities needed to serve new growth and development. Construction permit fees include Building Division fees, such as structural, mechanical, plumbing, electrical, and erosion control; and Planning Division fees, such as zoning, design review, and subdivision platting. Impact fees include assessments intended for parks and recreation public facilities (neighborhood parks, community parks, special use parks, recreational trails, natural open space, park capital improvement plan surcharge), as well as public police facilities and public fire facilities. To effectively and efficiently administer those fees, as outlined in Boise City Code Title 4, the Department of Planning and Development Services (PDS) employs software (hereafter, Tidemark) designed to streamline the application, review, and permitting processes. The department also utilizes that software to assess and collect bonding deposits and impact fees as set forth in Boise City Code. The software is useful from both a logistical (inter-functional job routing and approval) and a financial processing standpoint. The complexity of the permitting process necessitates an internal control structure that is adequately programmed and monitored. Those controls include hard-coding of fees within the system by the Department of Information Technology, as well as ongoing review and monitoring by the Department of Planning and Development Services. Strong controls are necessary to ensure the accurate assessment, depositing, and tracking of permit fees and impact fees, which are major sources of governmental funds. 2

3 SCOPE AND METHODOLOGIES The overall purpose of the audit was to gain a reasonable degree of assurance that the control environment within the City is adequate to ensure the effective and efficient assessment and collection of building permit, plan check, inspection, impact, and other associated fees. The environment should ensure these activities are occurring in an efficient and effective manner, that resources are properly safeguarded, that goals and objectives are being met, and that activities comply with applicable policy, law, and/or regulation. Internal Audit also defined the following specific objectives for the review: Review current permit and impact fee processes, and determine whether management has implemented an adequate control environment relative to those processes. Test a sample of issued permits and impact fees to ensure that information, approvals, and necessary documents in support of the fees are being collected; that fees are accurately assessed and collected; and that management's goals and objectives for thru-put are being substantially achieved. Ensure that PDS is appropriately accounting for all deposits, fees, and revenues assessed and collected; and that all associated general ledger accounts are properly reconciled to existing subsidiary ledgers where appropriate. Determine the presence and effectiveness of any monitoring and control systems that have been put in place by management to measure progress toward achieving identified goals and objectives. Internal Audit established the scope of the review to include all permit fees and impact fees that were assessed and / or collected beginning on October 1, 2014 and ending on December 31, Where necessary, work was performed with specified as of dates, as described in the report sections that follow. A combination of interviews, observations, and detailed attribute testing was utilized in order to accomplish the defined objectives. The methods employed and the evidentiary materials developed were deemed to be adequate to support the conclusions contained within this report. 3

4 EVALUATION AND COMMENTS Based on the results of the work performed, the level of administrative effort and the oversight efforts associated with the permitting processes result in a Satisfactory level of performance. (Refer to Appendix A for additional details concerning Internal Audit s existing grading scale.) Internal Audit confirmed that permits were processed in a timely manner and showed proper signs of approval. We also matched related construction documents to the fee assessments, reviewed the depositing processes employed by PDS staff, and verified management s reconciliation of relevant liability accounts. Cancelled and refunded permit fees were substantiated in all sampled cases. However, we did identify and communicate opportunities for improvement related to building permit calculations and Tidemark system access. Those findings are presented in summary below; and in detail, with management responses, in the following section of this report. Computation of permit fees Internal Audit tested a random sample of 91 cases to verify that fees were correctly calculated. We tested those permits at a granular level, and verified that permit fees were being calculated within a tolerable rate of deviation. We also verified that impact fees were being calculated without exception. We issued one audit finding related to the computation of solar panel building permit fees. In addition to testing the imposition of fees, Internal Audit detail tested a small random sample of six permit fees and impact fees that had been refunded to the applicants, to ensure that approved procedures were being followed. We also confirmed that management adequately updated Tidemark records associated with returning 138 planning, subdivision, and building bonds to the respective applicants. No exceptions were noted in either area. Information technology controls Internal Audit reviewed a listing of Tidemark system user roles and settings to ensure that essential access security controls were present and functioning as intended. We reviewed segregation of roles, compared user roles and employee job descriptions, and examined role assignments on a principle of least privilege. We issued one audit finding related to potentially inactive user accounts and inappropriate user roles within the Tidemark permitting system. 4

5 FINDINGS AND RECOMMENDATIONS Audit s Findings are detailed below; including any recommendations that were made, and management s responses to those suggestions. 1. FINDING: Tidemark System Access Internal Audit received Tidemark system users, roles, and group memberships as of January 7, We reviewed the various tables extracted by the Department of Information Technology, and noted that: Fifteen (15) users had not logged into Tidemark in more than a year, based on the last login date as of review date. Two (2) users with potentially unsuitable system roles, based on their job descriptions, as of review date. The inactive accounts and potentially inappropriate system roles may compromise the security and integrity of the Tidemark system. RECOMMENDATION: Internal Audit recommends that management review identified access security concerns, and strengthen relevant internal controls to reduce the risk of inappropriate system access going forward. MANAGEMENT RESPONSE: Of the Fifteen (15) users noted in the above finding, it has been determined that Thirteen (13) do need and potentially access the Tidemark System. It should be noted that most of those listed fall within our mobile office user group. These users may or may not access Tidemark, however, must have an active Tidemark account in order to use the Inspector Module they need for daily work. Two (2) users on the list have been disabled. It was determined that these Team Members either do not access Tidemark with any frequency and/or their roles changed which eliminated the need for access. In addition to the above, the two (2) additional accounts were modified according to recommendation and based on current use. We have attached an Excel Spreadsheet which captures all PDS Active Tidemark users and will make every effort to update as usage changes throughout the year and as job duties/functions change. Additionally, we have confirmed that our Department of Information Technology project coordinator disables accounts when notified of terminations and reviews last login dates on all accounts twice a year. 5

6 2. FINDING: Building Permit Policy Internal Audit detail tested a representative sample of permits and project cases within Tidemark to ensure the accurate assessment of fees. We reviewed whether the fees collected from the developers matched information contained within the Permit Summary Reports. We attempted to trace each permit to the rates that were in place at the time of transaction consummation. In most scenarios, the fees were confirmed without exception. However, we identified two permits where we were unable to validate the accurate assessment of fees. Follow up with PDS indicates that management used the administrative fee of $46.31 times 3.5 hours ($162.09) and rounded down to $ flat fee. Internal Audit understands that City Code was recently amended to require building permit fees on solar panel installations, and we concur that $46.31 is the current, valid rate for those permits. RECOMMENDATION: Internal Audit recommends that PDS formalize a policy for assessing building permit fees on solar panel installations. That policy should consider how to treat rounding, partial hours, and flat fees. Implementing such a policy would ensure the accurate and consistent treatment of those permits going forward. MANAGEMENT RESPONSE: Our Building Official has published a written policy regarding Solar Photovoltaic Systems Building Permit Fees based on both the International Building code and the International Residential Code in order to clarify how residential and commercial solar photovoltaic systems building permit fees are to be calculated utilizing the schedule of permit fees established in the Boise City Building Code ordinance. The Policy is attached for review and is dated June 2, We have updated the residential administrative fee(s) in Tidemark to reflect the $ amount instead of the $ amount. (Audit Note: Management provided Internal Audit with the attachments referenced for both audit findings. They were not included given the detail provided by management in their responses.) 6

7 CONCLUSION The Department of Planning and Development Services demonstrated sound business practices and effective oversight of permitting activities. The corrective actions described by management in response to the audit findings should strengthen the control environment going forward. Internal Audit thanks the Department of Planning and Development Services as well as the Department of Information Technology for the assistance provided throughout the audit process. MANAGEMENT PARTICIPANTS Derick O Neill, Director of Planning and Development Services Shannon Harris, Senior Operations Manager, PDS Jason Blais, Building Official, PDS Rita DeYoung, Building Services Administrative Supervisor 7

8 APPENDIX A Evaluation and Grading of Audits Each audit will be evaluated or graded, and will receive one of the three following ratings. Grades will be assigned based on the perceived best fit. Thus, not all attributes associated with an assigned grade may be present within a given Department or Division. Satisfactory No significant weaknesses or operational issues were noted during the audit. If any issues were noted, they did not materially detract from the business unit s ability to deliver services and / or to accomplish defined mission, goals, and objectives. Overall, systems of internal control are effective, and management oversight is adequate and effective. Needs Improvement Weaknesses or issues detrimental to operational efficiency or effectiveness existed within the audited area, and were encountered frequently enough to lose the appearance of isolated. Issues noted were strongly suggestive of an impaired ability to provide services at needed levels, or to accomplish mission, goals, and objectives successfully. Internal control mechanisms may not be universally in place, implemented, or actively observed. Management oversight is weak. Unsatisfactory Material or significant issues were noted within the operations under review. Issues posed risks that were mission-fatal; the business unit could not successfully deliver services in an acceptable fashion. Management failed to implement appropriate internal control mechanisms. Management oversight is ineffective, absent, or willfully avoided. 8