TxDOT Internal Audit Internal Audit Report. Facilities Management Audit

Transcription

1 TDOT Internal Audit Internal Audit Report Facilities Management Audit Objective The objective of the audit was to determine whether Facilities Management (FM) operations are optimized to provide consistent and safe environments. Opinion Based on the audit scope areas reviewed, control mechanisms require improvement and only partially address risk factors and eposures considered significant relative to impacting operational eecution and regulatory compliance. The organization's system of internal controls requires significant improvement in order to provide reasonable assurance that key goals and objectives will be achieved. Etensive improvements are required to correct control gaps and to address ecessive residual risk that may result in potentially significant impacts to the organization including the achievement of the organization's business/control objectives. Finding 1 Overall Assessment Title Statewide Routine Facility Contract (RFC) data is not available in one centralized location or database. Findings Control Design Needs Improvement Operating Effectiveness Rating Needs Improvement Finding 2 Inadequate Routine Facility Contract (RFC) Administration Needs Improvement Finding 3 No standardized statewide Facilities Preventive Maintenance (PM) program Needs Improvement Management concurs with the above findings and prepared management action plans to address deficiencies. Internal Environment The Facility Management program operates under a decentralized structure with no single point of authority, responsibility or accountability for the program. The Facilities Management Section believes the decentralized reporting structure results in minimal control over how department facility assets are maintained and how Capital Improvement Plan (CIP) budget funds are epended. 1 of 10 November 16, 2012

2 Summary Results Scope Area Finding Evidence Routine Facility Contract (RFC) Administration Routine Facility Contract (RFC) Administration Facility Preventive Maintenance 3 Facility Budgetary Ependitures N/A No findings identified Facility Security N/A No findings identified 1 2 statewide RFCs are not controlled in one central location three of si (50%) districts sampled reported MNT/FM contracts as their own one of twelve (8%) sampled contracts reported by the district was found not to be an RFC one of twelve (8%) sampled contracts reported by the district as current had actually been cancelled seven of twelve (58%) RFCs contained incomplete or no inspection documentation one of two (50%) RFCs containing a HUB goal had no supporting HUB documentation two of nine (22%) RFCs sampled did not forward original documentation for MNT/FM managed contracts at project completion for archival purposes one of eighteen (6%) change orders did not provide supporting documentation to justify the change order siteen of twenty-one (76%) warranties were not available for review four of si (67%) districts tested are not performing consistent routine facility preventive maintenance two of si (33%) districts tested were not in possession of new system warranties limiting their knowledge of any applicable warranty required preventive maintenance the Facility Periodic Inspection Schedule found in the Regional Facilities Management Standard Operating Procedures offers very limited guidance on preventive maintenance Audit Scope The scope of this audit covered RFC Administration, Facility Preventive Maintenance, Facility Budgetary Ependitures and general Facility Security. The following process areas were evaluated: 1) RFC administration post-let, to include eecution authority, monitoring and inspection 2) performance and documentation of preventive maintenance to include the use of warranties 3) budget epenses and coding to proper budget accounts, and 4) basic eception reporting reviews of TDOT assets. 2 of 10 November 16, 2012

3 The staff performing the audit work from July 16, 2012 through September 21, 2012 included: Julie Atchison, Brenda Meyers, Omar Elsaad, Romy Grimmell, Jennifer Stanush, Albert Bourque, Sabra Vaughan, (co-lead) and Suzy Oviedo, Engagement Lead. Methodology Interviews, data analysis, observations, and record review were performed at the Maintenance Division (MNT), the North and South Regions, and the following districts: Austin, San Antonio, Ft. Worth, El Paso, Bryan and Lufkin. Sample methodology was based on high risk factors including dollar amount of contracts, facility system assets, facility budget ependitures and asset losses. Background The Maintenance Division s Facilities Management (MNT/FM) section is responsible for centralized strategic planning, policy making, design & construction, standards & guidelines, program implementation, and facility asset management of all TDOT facilities statewide. Facilities assets consists of 3,167 buildings and a total of 9.9 million gross square feet of building space. Statewide building operations, maintenance and repairs are supported by MNT/FM, region, and district employees. This report was prepared for the Transportation Commission, TDOT Administration, and Management. The report presents the results of the Facility Management Audit which was conducted as part of the Fiscal Year 2012 Audit Plan. We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards and in conformance with the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. A defined set of control objectives was utilized to focus on operational and regulatory goals for the identified scope areas. Our audit opinion is an assessment of the health of the overall control environment based on (1) the effectiveness of enterprise risk management activities throughout the audit period and (2) the degree to which the defined control objectives were being met. Our audit opinion is not a guarantee against operational sub-optimization or regulatory non-compliance, particularly in areas not included in the scope of this audit. Best Practices The Lufkin District implemented a Preventive Maintenance (PM) program that incorporates the following requirements not found in the Regional Standard Operating Procedures (SOP). the facilities management section maintains a PM folder for each building the folder contains a monthly PM checklist for each system in each building 3 of 10 November 16, 2012

4 the checklist includes the work to be performed, frequency, system specific requirements and a signature line the FM employees are responsible for the District headquarters each Maintenance section has a designated person responsible to perform monthly PM and then faes the inspection checklist to the FM office In addition, the San Antonio District maintains an inventory spreadsheet of all systems. It includes location, model, serial number, type and date installed. 4 of 10 November 16, 2012

5 Detailed Findings and Management Action Plans (MAP) Finding No. 1: Statewide Routine Facility Contract (RFC) data is not available in one centralized location or database A total of 51 RFCs were provided by the regions/districts and 86 RFCs were provided by MNT/FM. A judgmental sample of 12 RFCs was selected for testing based upon location and dollar amount. The following was noted in the sample tested: MNT/FM does not have knowledge of all RFCs eisting statewide three of si (50%) districts sampled reported contracts already reported by MNT/FM, resulting in duplication one of twelve (8%) contracts reported by the district was not a RFC one of twelve (8%) contracts reported by the district had been cancelled RFCs are processed by districts, regions, and the MNT/FM based on defined dollar limits. However, MNT does not require the Regions and Districts to report eecuted RFCs. There is no centralized database to collect and maintain statewide RFC information in a single repository. Good business practices require knowledge of all liabilities in order to manage funds. TDOT currently uses systems of varying compleity from voucher number assignment to Construction/Maintenance Contract System and SiteManager to collect, manage, and maintain other types of data. Effect/Potential Impact: The following were noted as possible effects or potential impacts due to the identified risks: the lack of a single centralized repository increases the risk that MNT/FM may not be able to accurately manage the Capital Improvement Plan Budget in accordance with the Teas Appropriations Act inaccurate inventory of contracts can result in liabilities being under/over stated Management Action Plan (MAP): Develop and create a centralized repository for collecting and maintaining statewide RFC financial data. MAP Owner: John Warrick R.A., CIP Supervisor MAP The following will be completed: fill MNT/FM Accounting Specialist position to manage centralized Capital Improvement Plan (CIP) financial business and database develop stand-alone financial database for Regions/Austin Headquarters (AHQ) to maintain and track RFC financial data develop SOP for forecasting, budgeting, tracking and reporting CIP financial information conduct applicable staff training to implement above action items Completion Date: April 15, of 10 November 16, 2012

6 Finding No. 2: Routine Facility Contract (RFC) administration is inadequate Testing was performed to verify proper contract administration procedures were followed including documentation for inspection, change order justification, regulatory compliance, payment authorization, and adherence to the contract terms and conditions: seven of twelve (58%) RFCs contained incomplete or no inspection documentation (a) one of two (50%) RFCs containing a HUB goal had no supporting HUB documentation (b) one of eighteen (6%) change orders did not provide supporting documentation to justify the change order (c) two of nine (22%) RFCs sampled did not forward original documentation for MNT/FM managed contracts at project completion for archival purposes (d) There is limited guidance and monitoring to ensure the work is completed. The RFC Handbook (June 2012) contains thorough directions regarding contract creation and award; however, it does not provide detailed post-letting contract administration procedures. (a) & (c) The RFC Handbook (June 2012) states in Item 32.1, The work will be observed and inspected by the Owner s representative and performed to his satisfaction in accordance with the contract s plans and specifications. (b) The RFC Handbook (June 2012), HUB Subcontracting Plan (HSP) states that the Department will monitor the Contractor s effort to involve HUBs during the performance of this contract. (d) The Records Management Manual states, The record copy is the official record that must be retained to fulfill statutory retention requirements it originates or is retained at the office responsible for the operations or function the record or file concerns. The State of Teas Record Retention Schedule states that contract records, including all related documents, must be kept for four years after completion of the contract. Effect/Potential Impact: The following were noted as possible effects or potential impacts due to the identified risks: erroneous contractor payments potential loss of liquidated damages no inspections and/or inadequate inspections increased cost to TDOT non-compliance regarding applicable HUB regulatory requirements increased potential for conflict of interest and/or fraud Management Action Plan (MAP): MAP Owner: John Warrick R.A., CIP Supervisor 6 of 10 November 16, 2012

7 MAP 2.1 The following will be completed: fill MNT/FM Contract Specialist position to manage building contract letting, processing and record filing revise/epand RFC Handbook to include contract administration SOPs for field reporting, Change Orders, project close-out and required supporting documentation clarify HUB bidder requirements, letting compliance and pre-payment monthly HUB submittals conduct applicable staff training to address above action items Completion Date: March 15, of 10 November 16, 2012

8 Finding No. 3: The department does not have a standardized facilities preventive maintenance (PM) program Forty facility systems (27 high dollar systems and 13 emergency systems) were identified by the si sampled district headquarters and MNT Building Operations. From the population, a judgmental sample of 14 high dollar systems (chillers, boilers, etc.) and 7 emergency systems (generators, fire alarms, etc.) was selected based on value, emergency need, and location. Testing was performed to determine: 1) if PM is being performed and documented - four of si (67%) districts are not performing consistent routine preventive maintenance 2) if warranties are being utilized - siteen of twenty-one (76%) systems tested did not have warranties available for review two of si (33%) districts were not in possession of new system warranties limiting their knowledge of any applicable warranty required preventive maintenance There is limited direction for facilities employees. Facility employees work within a decentralized structure with no single point of authority. There are no standardized detailed procedures for facilities preventive maintenance, nor any control activities in place to monitor PM performance and warranty utilization. The Regional Facilities Management Standard Operating Procedures approved by TDOT Administration in January 2010 contains a periodic inspection schedule. The State of Teas Record Retention Schedule states that non-vehicular equipment includes: history records not under vendor service agreements be kept for the life of the asset service and repair records maintained under vendor service agreements be kept for three years after the life of the asset Effect/Potential Impact: The department is currently operating in a non-preventive reactive mode which could result in: decreased life epectancy of facility assets possible adverse budgetary impact (i.e. higher cost of repair/replacement vs. PM and unnecessary ependitures for warranty covered repairs) potential safety risks to internal/eternal stakeholders Management Action Plan (MAP): 8 of 10 November 16, 2012

9 MAP Owner: Bob Ray, Engineering & SRA Supervisor MAP 3.1 The following will be completed: develop and implement a standardized PM schedule for Regions/Districts/AHQ develop Region/District/AHQ SOPs for maintaining and updating facility equipment and equipment warranties using (FMS) Equipment Inventory & Equipment Warranty Modules conduct applicable staff training to address above action items Completion Date: March 15, of 10 November 16, 2012

10 Summary Results Based on Enterprise Risk Management Framework Closing Comments The results were discussed with the MNT Director and designated MNT staff; the Austin, Bryan, El Paso, Ft. Worth, Lufkin and San Antonio District Engineers or their designee; and the North and South Region Directors. The audit team appreciates the cooperation received from everyone contacted during the performance of this audit. 10 of 10 November 16, 2012