Internal Audit Report: Tenant Parking Charges Monitoring Item 2E July 20, 2018 Tenant Services Committee TSC: (BIFAC: )

Transcription

1 Page 1 of 5 : Item 2E July 20, 2018 Tenant Services Committee Report: To: From: TSC: (BIFAC: ) Tenant Services Committee ( TSC ) Manager, Internal Audit Date: July 6, 2018 PURPOSE: The purpose of the report is to provide the BIFAC with the Internal Audit report. RECOMMENDATION: It is recommended that the BIFAC receive this report for information. REASONS FOR RECOMMENDATION: BACKGROUND The Toronto Community Housing Corporation ( TCHC ) parking program governs over 32,000 parking spaces throughout its portfolio. The purpose of the parking program is to ensure that parking facilities in TCHC communities are used properly in order to build healthier communities, provide better service to tenants and other clients, and improve revenue generation. Parking charges at TCHC buildings are applicable to tenants, commercial tenants, and other non-tenants, including charges for some visitor parking. In addition, certain visitors, staff, agencies and contractors may park at TCHC buildings with the applicable permits with no charge.

2 Page 2 of 5 In 2016, parking revenue was approximately $11M, split between $8M (73%) for tenant parking charges and $3M (27%) for commercial/nontenant parking charges. The parking program encompasses two distinct functions: parking permits the issuance and cancellation of parking permits, and the collection of parking fees; and parking enforcement ensures that only those vehicles that have paid parking permits are parking in TCHC parking lots. Parking Permits The Asset Management Division has oversight of the parking permit program; however, the actual day-to-day functions of this are administered by: TCHC s Operating Units ( OU ) for direct managed ( DM ) buildings; third party property managers for contract managed ( CM ) buildings; and TCHC s Commercial Business Unit for other non-tenant parking categories at the time of the audit. The parking billing process differs between DM and CM developments: for DM developments, parking charges are billed through the Housing Management System; and for CM developments the contractors advise TCHC of their parking billings via monthly spreadsheets. Parking Enforcement Parking enforcement is administered by the Parking Enforcement Unit of the Community Safety Unit. AUDIT OBJECTIVES The objective of this assignment was to provide Management with an assessment of the effectiveness of charging for tenant parking for DM and CM developments.

3 Page 3 of 5 SUMMARY OF OBSERVATIONS Parking Permit Program There are some internal controls lacking in the Management of the parking process: the parking-to-permit process is manual and provides limited reconciliation between inventory and billing for both DM and CM properties. In addition, the systems are outdated and not designed to support: accurate and timely data entry and reconciliation; or reliable information with respect to (i) the inventory of parking spaces and (ii) vacancy rates. This leads to errors in the recording and billing of the parking charges and lost revenue, which we estimated at $153,000 for the year under review for tenant parking (or approximately 1.9% of the total tenant parking revenue). Parking Enforcement The data that would help establish a risk-based approach to parking enforcement is currently not systemically captured and/or readily available in a usable format. In addition, there are currently no effective tools available to support the mobile function of the Parking Enforcement Officers ( PEOs ). SUMMARY OF RECOMMENDATIONS Parking Permit Program Conduct an inventory count of parking spaces in the TCHC portfolio, and reconcile the results to TCHC parking records; improve the security and integrity of the data in the parking spreadsheets (e.g. access controls, version control, audit trails, etc.); and perform periodic analysis of a sample of tenant parking data to billing information to ensure that tenants are paying for parking. Parking Enforcement Support the PEO s access to parking information enforcement by (i) replacing the barcode reader program with a simpler, more viable option and (ii) ensuring PEOs can access all relevant parking data from the field; and

4 Page 4 of 5 develop a risk-based method of assigning PEOs to patrol parking lots based on improved information in order to make the best use of limited resources. Parking Program and Parking Enforcement Processes and Systems: Review the functionality of all processes and systems used to record all parking data (i.e. parking permits and parking enforcement), and, where feasible, identify opportunities to replace the current legacy systems that would allow for better data integrity and security, increased automation of the data capture, and extraction of data for proper and relevant analysis. Third Party Parking Management Management determine the feasibility, including the cost/benefit, of increasing the use of a third-party service provider to administer part of or the entire TCHC Parking Program, including enforcement. We would like to thank the management and staff of Asset Management and the Community Safety Unit for their support and cooperation during this engagement. IMPLICATIONS AND RISKS: The purpose of the parking program is to ensure that parking facilities in TCHC communities are used properly in order to build healthier communities, provide better service to tenants and other clients, and improve revenue generation. Having the proper controls over the parking program, and adequate enforcement tools will provide good customer service to TCHC tenants and reduce the risk of revenue leakage. SIGNATURE: Genevieve Segu Genevieve Segu Manager, Internal Auditor

5 ATTACHMENT: 1. : Page 5 of 5 STAFF CONTACT: Genevieve Segu, Manager, Internal Auditor Genevieve.Segu@torontohousing.ca

6 Internal Audit Department Report Tenant Parking Monitoring Charges 1

7 Page 2 Table of Contents Executive Summary... 3 Background... 3 Audit Objectives... 4 Scope... 4 Methodology... 5 Summary of Observations... 5 Summary of Recommendations... 5 Detailed Observations... 7 Oversight of the Tenant Parking Program... 7 Parking Enforcement... 9 Parking Program and Parking Enforcement Processes and Systems Third Party Parking Management Appendix A: Management s Action Plan

8 Page 3 Executive Summary Background The Toronto Community Housing Corporation ( TCHC ) parking program governs over 32,000 parking spaces throughout its portfolio. The purpose of the parking program is to ensure that parking facilities in TCHC communities are used properly in order to build healthier communities, provide better service to tenants and other clients, and improve revenue generation. Parking charges at TCHC buildings are applicable to residents, commercial tenants, and other non-tenants, including charges for some visitor parking. In addition, certain visitors, staff, agencies and contractors may park at TCHC buildings with the applicable permits with no charge. The breakdown of the TCHC parking spaces is as follows 1 : Category Tenant Parking Tenant Paid Parking Non-Paid Visitor Parking No. of Spaces 12,243 2,108 14,351 % of Total Inventory Non-Tenant/Commercial/Pay & Display 3, Other Vacant Unrentable 2 Other 3 8,463 1,561 3,860 13, Total 32, March 9, 2017 memorandum to BIFAC from the Senior Manager, Commercial & Business Development, TCHC Parking Program Additional Requested Details. 2 Unrentable parking spaces include spaces affected by capital repair issues, revitalization, those used for storage of TCHC equipment such as tractors, snow plows, etc., and snow piles. 3 Other includes agencies, contractors and staff parking. 3

9 Page 4 In 2016, parking revenue was approximately $11M, split between $8M (73%) for tenant parking charges and $3M (27%) for commercial/non-tenant parking charges. The parking program encompasses two distinct functions: Parking Permits the issuance and cancellation of parking permits, and the collection of parking fees; and Parking Enforcement ensures that only those vehicles that have paid parking permits are parking in TCHC parking lots. Parking Permits The Asset Management Division (AM) has oversight of the parking permit program. However, the actual day-to-day functions of this are administered by: TCHC s Operating Units (OU) for Direct Managed (DM) buildings; Third party property managers for Contract Managed (CM) buildings; and TCHC s Commercial Business Unit for other non-tenant parking categories at the time of the audit. The parking billing process differs between DM and CM developments: For DM developments, parking charges are billed through the Housing Management System (HMS); and For CM developments the contractors advise TCHC of their parking billings via monthly spreadsheets. Parking Enforcement Parking enforcement is administered by the Parking Enforcement Unit of the Community Safety Unit. Audit Objectives The objective of this assignment was to provide management with an assessment of the effectiveness of charging for tenant parking for DM and CM developments. Scope The scope of the engagement was limited to tenant parking charges for both DM and CM managed buildings 4. Our scope included, but was not limited to: Interviewing selected TCHC employees; 4 Future references to the TCHC parking program in this report is with respect to tenant parking only, unless otherwise noted. 4

10 Page 5 Obtaining and reviewing appropriate documentation and data; Observing and documenting processes, as required; Conducting certain tests and procedures; and Performing analytical reviews of data and other documents. The parking data that was analyzed covered a one month period in December Methodology The audit objectives were accomplished through: Review of the controls over the parking program, including relevant procedures and processes; Interviews with staff; and Data analytics of tenant parking information. Summary of Observations Parking Permit Program There are some internal controls lacking in the management of the parking process: the parking-to-permit process is manual and provides limited reconciliation between inventory and billing for both Direct Managed and Contract Managed properties. In addition, the systems are outdated and not designed to support: Accurate and timely data entry and reconciliation; or Reliable information with respect to (i) the inventory of parking spaces and (ii) vacancy rates. This leads to errors in the recording and billing of the parking charges and lost revenue, which we estimated at $153,000 for the year under review for tenant parking (or approximately 1.9% of the total tenant parking revenue). Parking Enforcement The data that would help establish a risk-based approach to parking enforcement is currently not systemically captured and/or readily available in a usable format. In addition, there are currently no effective tools available to support the mobile function of the Parking Enforcement Officers (PEOs). Summary of Recommendations Parking Permit Program Conduct an inventory count of parking spaces in the TCHC portfolio, and reconcile the results to TCHC parking records; 5

11 Page 6 Improve the security and integrity of the data in the parking spreadsheets (e.g. access controls, version control, audit trails, etc.); and Perform periodic analysis of a sample of tenant parking data to billing information to ensure that tenants are paying for parking. Parking Enforcement Support the PEO s access to parking information enforcement by (i) replacing the barcode reader program with a simpler, more viable option and (ii) ensuring the PEOs can access all relevant parking data from the field; and Develop a risk-based method of assigning PEO s to patrol parking lots based on improved information in order to make the best use of limited resources. Parking Program and Parking Enforcement Processes and Systems: Review the functionality of all processes and systems used to record all parking data (i.e. parking permits and parking enforcement), and, where feasible, identify opportunities to replace the current legacy systems that would allow for better data integrity and security, increased automation of the data capture, and extraction of data for proper and relevant analysis. Third Party Parking Management Management determine the feasibility, including the cost/benefit, of increasing the use of a third-party service provider to administer part of or the entire TCHC Parking Program, including enforcement. Management s Action Plan with respect to our recommendations is attached to this report as Appendix A. We would like to thank the management and staff of Asset Management and the Community Safety Unit for their support and cooperation during this engagement. Prepared by: Jane Schope, CPA, CMA Internal Audit Analyst Reviewed by: Geneviève Segu, CPA, CMA, CIA, CRMA, CISA Manager Internal Audit Approved by: Michael Vear, CPA, CA, CPA (Illinois) Chief Internal Auditor 6

12 Page 7 Detailed Observations Oversight of the Tenant Parking Program Parking Program Overview Overall, the parking program is administered using a manual process, briefly described as follows: Each OU office 5 manually maintains their parking inventory in spreadsheets for each parking lot in their OU. We estimate that there are 569 parking lots at TCHC, each with an associated spreadsheet ( the parking spreadsheet ); Tenants and non-tenant clients complete the requisite parking application and cancellation paper forms and submit them in person to their local OU office; The OU staff enter the tenant parking billing information both in their requisite billing system and (ii) in the parking spreadsheets. The OU staff issue the parking permit, which for long term parking is a sticker with a barcode and associated numeric code that is affixed to the inside of the vehicle s windshield; The Parking Clerk at Head Office provides oversight to parking applications and cancellations by reviewing them for accuracy and completeness, including billing for DM buildings; and The Parking Clerk also enters the issued long-term parking permits in the Automated Issuance Management System (AIMS) 6. Parking Inventory Monitoring and analyzing parking inventory and vacancy rates is essential for TCHC to operate an effective parking business that both maximizes revenue and provides good customer service. Key management information such as the inventory of parking spaces and vacancies is not necessarily accurate, as: An inventory count of parking spaces, including reconciliation with the parking spreadsheets, has not been performed in recent years; and 5 For purposes of this report OU office refers to the operating unit office that is managed either by TCHC staff or contract managed staff, unless otherwise noted. 6 The AIMS system maintains the inventory record of the long term parking permits that have been issued or cancelled. 7

13 Page 8 We were informed that there are some parking lots and spaces not included in the parking spreadsheets. The parking spreadsheets are constantly subject to updates by OU staff. They are also subject to delays in being reviewed by the Parking Clerk if there are delays in sending parking permit information to the Parking Clerk; Security and data integrity of the parking spreadsheets needs improvement: Password protection is not effective with multiple users able to make changes to key data; Version controls are not in place to ensure that only the most recent and updated parking spreadsheet is maintained; Access controls are not in place to ensure that only staff who are authorized and have a business reason can review or edit the parking spreadsheet; and Changes made to the parking spreadsheet have no audit trail. Recommendation #1: (a) Management conduct an inventory count of parking spaces in the TCHC portfolio. The results of the inventory count should be reconciled to the parking spreadsheets. (b) Management take steps necessary to ensure the security and integrity of the data in the parking spreadsheets (e.g. access controls, version control, audit trails) Completeness of Tenant Parking Revenue Direct Managed Buildings The Parking Clerk will ensure parking charges are accurately reflected in HMS when the parking forms are received. However, if these documents are not received the Parking Clerk has no way of knowing if all parking charges have been recorded in HMS. For DM buildings there is no formal reconciliation and/or data analysis of data between the parking spreadsheets and the parking billing information on HMS. Contract Managed Buildings For CM buildings the parking billing process is different: The property managers directly bill tenants for rent and parking charges; On a monthly basis the property managers send to TCHC staff a list of tenant charges (rent and parking) they have made during the month; and 8

14 Page 9 This financial information is not entered individually by tenant into HMS, but rather it is entered directly into the TCHC financial systems in summary form. The Parking Clerk reviews the parking information forms for accuracy, reviews the Parking Spreadsheet, and will enter the permit information into AIMS. However, the Parking Clerk will not check for accuracy of input into HMS because the information has not been entered into HMS. In addition, the list of parking information submitted monthly by the property managers is not forwarded to the Parking Clerk. This prevents the Parking Clerk from comparing the application forms received to the data submitted by the property managers. We do not believe that there are any other steps taken to ensure the accuracy and completeness of the parking information submitted by the property managers. Accordingly, there appears to be no effective oversight of parking revenue derived from CM buildings. Internal Audit Test on Completeness of Tenant Parking Revenue To determine if tenant parking spaces were properly billed we performed data analytics on the parking spreadsheets by comparing the billing information for both DM and CM tenants to the parking inventory information in the spreadsheets. We found that there are approximately 247 parking spaces for which payment may not have been billed. This represents a potential revenue leakage of approximately $153,000 per year. As a result of the data integrity issues, manual procedures within the parking process, and the lack of controls (such as a full reconciliation of the parking information for both DM and CM buildings), the recording and billing of parking charges is subject to errors and potential lost revenue. Recommendation #2: Management perform a periodic analysis of a sample of tenant parking data to billing information for both DM and CM buildings, as a detective control to ensure tenants are paying for parking. Parking Enforcement TCHC s Parking Enforcement Unit is part of the Community Safety Unit (CSU). TCHC has a complement of seven Parking Enforcement Officers (PEOs) who carry out their duties as City of Toronto Municipal Law Enforcement Officers. In 2016, they wrote approximately 45,800 tickets for parking offences which resulted in approximately $1M in revenue going directly to the City of Toronto, our Shareholder. 9

15 Page 10 Inefficiencies and Lack of Up to Date Information Despite the ability to write many thousands of parking tickets per annum, the enforcement activities of PEOs are limited by the following challenges: Barcode Readers Tenant long-term parking permits are affixed to their vehicle s windshield. The parking permit has (i) a barcode (intended to be scanned by a handheld device), and (ii) an associated numeric code (traceable to the tenant and vehicle information maintained in AIMS). This process does not adequately support the enforcement efforts of the PEOs, however, because the handheld readers (that would provide information on the owners of the vehicles by scanning the barcodes on the car windshield), are not actually able to read the barcodes. As such, they are not used by PEOs. AIMS Information Information in AIMS is not necessarily up to date - it is not uncommon for there to be delays in the entering of parking permit information in AIMS. In addition, PEOs in the field are not able to electronically access the AIMS database in real time. If they do require confirmation about a barcode permit, they have to contact the CSU dispatch office to acquire this information. This is a time consuming exercise and is not commonly used. Parking Spreadsheets The parking spreadsheets are cumbersome to use in the field. In addition, due to potential time lags in updating the parking spreadsheets, they can be inaccurate and/or not contain up to the minute current information at the time they are being used in the field. In summary, there is some inefficiency and lack of effectiveness in the parking enforcement process. Recommendation #3: Management support the PEO enforcement process by (i) replacing the current barcode reader program/process with a simpler, more viable option and (ii) ensuring the PEOs can access up-to-date parking data and information from the field. 10

16 Page 11 Risk-Based Enforcement The Manager of Community Safety Programs will assign the PEOs to patrol specific parking lots based on several factors, including: The geographic location; Daily individual complaints from tenants; and Professional judgment. These are valid parameters to take into consideration for parking enforcement assignments, which has resulted in a high volume of parking tickets issued each year. However, management should consider using a more formal risk-based approach to parking enforcement in order to make the best use of limited resources. A risk-based approach towards parking enforcement assignments would help to prioritize parking patrol assignments based on the risk that potential parking violations would occur. Such higher risk factors to consider could include such items as: Ease of access to parking lots (e.g. parking lots that do not require fob access may be more susceptible to illegal parking); Parking lots with high vacancy rates, which make them vulnerable to inappropriate parking; and Trends in the nature, volume, and location of tickets written Recommendation #4: Management develop a risk-based method of parking enforcement assignments in order to make the best use of limited resources. Parking Program and Parking Enforcement Processes and Systems Parking Program The processes used in the Parking Program are problematic as: They are manual processes; There are approximately 569 parking spreadsheets in use at any one time; The spreadsheets are subject to data integrity and security issues; and The information in the AIMS system is subject to delays with respect to the entering of parking information. For a parking program that contains a little over 32,000 parking spots, the entire process is cumbersome to use and susceptible to errors. 11

17 Page 12 There is no parking system that gathers parking data that would enable any type of data analysis to ensure completeness of parking revenue. Parking Enforcement Similarly, the processes and systems used in the Parking Enforcement function program are challenging to use effectively: The barcode readers are not able to scan parking permits through vehicle windshields; PEOs do not have real time access to information on AIMS; and PEOs must use physical spreadsheets to verify parking information, which may not contain current data. Accordingly, there are currently no effective tools available to support the mobile function of the PEOs enforcement task. In addition, all parking ticket information is entered into a CSU database called CORA. A dated system, CORA s primary use is for the CSU security program. It is not best suited for data input and retrieval for parking infractions. Though it does serve a purpose for retrieving data about particular parking infractions and the like, it is not designed for practical extraction of parking enforcement data, on a global basis, which would assist in identifying high risk parking lots that should receive more enforcement attention. With approximately 45,800 being issued annually, having the ability to use the data from these tickets in a meaningful way would be of great assistance in developing a riskbased approach to parking enforcement. In summary, the processes and systems that support the Parking Program and the Parking Enforcement program are not meeting the needs of the organization. Recommendation #5: Management review the functionality of all processes and systems used to record parking permits and offence data and, where feasible (i) increase the automation of the data capture and (ii) identify fewer systems to replace the current legacy systems. Third Party Parking Management There are numerous third-party service providers who provide parking program services and parking enforcement for residential and commercial properties to allow corporations 12

18 Page 13 to (i) focus on their core business and (ii) lower costs. The following presents the type of services they offer: Rent parking spaces to both tenants and commercial/non-tenant clients; Ensure that parking signage is maintained; Manage visitor parking; and Monitor parking lots, and ticket vehicles for parking violations. Asset Management has already partnered, on a limited basis, with some external organizations to rent commercial and non-tenant parking spaces on TCHC s behalf. Recommendation #6: Management determine the feasibility, including the cost/benefit, of increasing the use of a third-party service provider to administer all or part of the TCHC Parking Program, including enforcement. 13

19 Appendix A: Management s Action Plan # Recommendation Agree or Disagree Management s Action Plan Timeline 1 (a) Management conduct an inventory count of parking spaces in the TCHC portfolio. The results of the inventory count should be reconciled to the parking spreadsheets. (b) Management take steps necessary to ensure the security and integrity of the data in the parking spreadsheets (e.g. access controls, version control, audit trails). Agree (a) Asset Management will conduct an inventory count of all parking spaces, and reconcile the results to the parking spreadsheets. (b) In partnership with ITS, Asset Management will take steps to strengthen the security and integrity of the data in the parking spreadsheets. Q Q Management perform a periodic analysis of a sample of tenant parking data to billing information for both DM and CM buildings, as a detective control to ensure tenants are paying for parking. 3 Management support the PEO enforcement process by (i) replacing the current barcode reader program/process with a simpler, more viable option and (ii) ensuring the PEOs can access up-to-date parking data and information from the field. 4 Management develop a riskbased method of parking enforcement assignments in order to make the best use of limited resources. Agree Agree Agree Asset Management will conduct a periodic, sample based reconciliation of parking data to billing information for both DM and CM buildings. In partnership, Asset Management and CSU will explore options for a more effective program that will strengthen the parking enforcement process. CSU will develop a risk-based method of parking enforcement assignments with the resources available at the current time. Q Q Q

20 # Recommendation Agree or Disagree Management s Action Plan Timeline 5 Management review the functionality of all processes and systems used to record parking permits and offence data and, where feasible (i) increase the automation of the data capture and (ii) identify fewer systems to replace the current legacy systems. Agree CSU and Asset Management, in partnership, will review all aspects of the program and explore the possibilities to increase functionality of the Parking Program systems. Q Management determine the feasibility, including the cost/benefit, of increasing the use of a third-party service provider to administer all or part of the TCHC Parking Program, including enforcement. Agree In partnership with CSU, Asset Management will investigate and evaluate the use of a thirdparty service provider for all or part of the TCHC Parking Program, including enforcement. Q