Final Report. Project (b)

Transcription

1 Internal Audit Department Final Report Project (b) Audit Report Sarasota Board of County Commissioners Mark R. Simmons, CIA CFE - Director, Internal Audit Jody Maxwell, CPA Senior Internal Auditor Jennifer Beirau Ben Wagner Eric Troyer

2 TABLE OF CONTENTS AUDIT REPORT Summary 3 Audit Objective 4 Background 4 Findings and Recommendations 5 Non-Compliance: Split Transactions 5 Non-Compliance: Purchasing Thresholds 6 Other Issues: Policy Weaknesses 7 APPENDIX A Audit Scope and Methodology 8 APPENDIX B Detail by Business Unit 9 The Management Control Criteria and Framework 10 APPENDIX D Laws, Policies, Rules and Regulations 13 Report Distribution List: Sarasota County Board of County Commissioners Terry Lewis, Interim County Administrator Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 2 of 13

3 Summary We conducted an audit of the Sarasota County Purchasing Card (P-Card) Program which included the period of October 2009 through September During the Fiscal Year ended September 30, 2010 (FY10), there were 38,127 P-Card purchases totaling $17,280, made to 3,426 vendors by 441 cardholders. Compliance with P-Card Policy: The current P-Card policy contains conflicting statements which could hinder an employee s adherence to established policy and procedures. We identified twenty-five cardholders who split transactions through twenty-one vendors circumventing the $3, transaction limit established by P-Card policy. These twentyfive cardholders are responsible for approximately thirty-six percent of the County s FY10 P-Card purchases. Compliance with Procurement Thresholds: County P-Card procedures do not provide reasonable assurance that cardholders adhere to established competitive purchasing requirements. Monitoring activities were not implemented to evaluate expenditures by type of goods or services provided or by specific vendor to ensure that all goods and services purchased meet the established procurement thresholds and maximize the purchasing value of public funds. Sixty-four vendors were paid more than $50, in aggregate via P-Cards during FY10. Twenty-eight of these vendors did not have a corresponding purchase order, contract or annual agreement in place. These twenty-eight vendors were paid $3,264, via P-Card in FY10 or nineteen percent of total P-Card expenditures for the year. Extent of Non-Compliance: Although these instances were not isolated to one particular business unit, they were more predominant in the areas of Operations and Maintenance, and Environmental Services. Cardholders in these areas represent twenty-one of the twenty-five cardholders with identified splits. These twenty-one cardholders are responsible for approximately twentyseven percent of the County s FY10 P-Card expenditures. During our review we also evaluated the supporting documentation to determine whether the transactions appeared to be for a public purpose. We noted no exceptions to this test criterion. Evidence of Criminal Activity: Information obtained during this review has been provided to the Sarasota County Sheriff s office and active investigations are pending for potential criminal violations. Other Issues/Observations: Due to the lack of supporting documentation we were unable to determine if all cardholders have received adequate training on purchasing policies and procedures. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 3 of 13

4 Audit Objective The objective of our audit was to determine if reasonable assurance exists that purchasing card activity is appropriate and made in compliance with established laws, rules, agreements, and guidelines. Specifically: Determine if P-Card policies were followed by Sarasota Board of County Commissioner employees. Determine if P-Cards were used to circumvent threshold levels established by the procurement code. Determine if recently discovered breeches in policy and procedures were wide-spread throughout County government or isolated to specific business units. Determine if there was any evidence that would suggest that criminal activity may have occurred. Background Sarasota County Code of Ordinances, Part II, Chapter 2, Article VI County Procurement Code authorizes Sarasota County to establish in a clear manner the fundamental law governing the Sarasota County Procurement system; to provide for the fair and equitable treatment of all persons involved with public purchasing by this County; to maximize the purchasing value of public funds in procurement; to provide safeguards for maintaining a procurement system of quality and integrity, and to foster effective competition for all procurements. This ordinance is based upon Florida Statute Chapter 125. As such the Board of County Commissioners has established a system for the procurement for goods and services for Sarasota County. All procurements are processed through the central procurement system, under the direction of the County Procurement Official who is designated by the County Administrator. The Procurement Official had created and periodically updated and maintained the Sarasota County Procurement Manual to provide a mechanism for more detailed implementation of this Article VI County Procurement Code. The use of P-Cards was established to provide an efficient and cost effective method of purchasing and paying for goods and services not exceeding $3, per purchase and reducing the time and money spent processing low dollars transactions. Several reviews of P-Card transactions have been conducted by our office since the program implementation. These reviews noted instances of non-compliance with County P-Card policy including evidence of split transactions. Recommendations included but were not limited to: Policy revisions and greater management oversight. Increased cardholder training Development and implementation of monitoring controls and spend analysis. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 4 of 13

5 Additionally, P-Card activity was included in the Procure to Pay Process review performed by RSM McGladrey in October Their report dated January 15, 2010 indentified 1,224 transactions as potential split invoices and noted the top 50 vendors for P-Card purchases in FY09. Recommendations from this report included but were not limited to: Conducting an internal review of historic P-Card activity with root cause analysis. Development of a routine monitoring process for P-Card transactions including spend analysis. Updated policies along with enhanced training and communications. Findings The Procurement Official is responsible for ensuring that appropriate controls are in place and purchases are in compliance with established controls and applicable laws, rules, and guidelines. The findings described throughout this report highlight the absence of key internal controls, and noncompliance with other established controls. In this procurement environment, management has limited assurances that P-Card activity is appropriate, efficiently executed, and made in compliance with established laws, rules, agreements, and guidelines. NON COMPLIANCE WITH PURCHASING POLICIES: SPLIT TRANSACTIONS Section IV of the Sarasota County Purchasing Card Policies states that A purchase may be made of multiple items, but the invoice cannot exceed $ or the cardholders limit. Purchases over $ must be made by Purchase Order under the County Purchasing Policies and Procedures. Charges for purchases shall not be split to stay within the single purchase limit. Splitting charges will be considered abuse of the Purchasing Card Program. The county s P-Card software is equipped and configured to monitor for purchases which are split and in violation of this section of the purchasing policy, however, this feature has not been routinely utilized by Procurement staff. We identified the following instances of non-compliance with Section IV of the County P-Card policies during our review. Thirty-two instances where the same vendor was paid over $3, through multiple transactions by a single employee in a single day. An instance where two transactions occurred on the same day, with the same vendor, paid by two separate employees, and totaled more than $3, (Although this misuse was noted during testing, our tests were focused on detecting transaction splitting by a single employee and were not designed to detect splitting between multiple employees.) Two instances where multiple purchases were processed on the same day; shipped on the same day yet charged to the employees P-Card on consecutive days. We recommend that management take the following actions concerning these issues: Implement and utilize periodic monitoring activities to identify potential split purchases and evaluate for root cause. Review and revise the P-Card policy as necessary to address the root cause of noncompliance with transaction limits. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 5 of 13

6 Re-train current cardholders, account managers and responsible business center managers on the P-Card policy and procurement thresholds. Take appropriate disciplinary action where willful disregard for the P-Card and Procurement policies is identified. Please read Appendix B on page 9 for details. NON COMPLIANCE: PURCHASING THRESHOLDS Section 5 of the Sarasota County Procurement Manual states; Sarasota County has adopted a centralized Procurement system designed to provide the maximum efficiency while maintaining security and control. All procurements for Sarasota County will be conducted in a manner that promotes competition and secures the best value. Splitting transactions to evade thresholds is prohibited. Minimum threshold requirements are: Less than $3,000 One Quote $3,000 to $10,000 Three verbal quotes $10,000 to $25,000 Three written quotes $25,000 to $50,000 Written quotes secured by Procurement Specialists Over $50,000 Formal Bid or RFP The purpose of these thresholds is to minimize the risk of excessive or unauthorized purchases charged to the County and to appropriately assign responsibility for ensuring that purchases meet the applicable competitive purchasing requirements. We compiled the following information regarding P-Card transactions for the Fiscal year ended September 30, 2010: Vendors Paid # of Transactions Amount Spent # of Vendors $.01-$2, ,966 $1,650, ,733 $3, $9, ,636 $2,283, $10, $24, ,883 $2,036, $25, $49, ,985 $2,630, $50, or more 13,657 $8,679, TOTAL 38,127 $17,280, ,426 We identified the following non-compliance with procurement thresholds during our review of P-Card transactions. Twenty-eight of the sixty-four instances where the total expenditure with the vendor exceeded the $50, threshold did not have a corresponding Purchase Order, Formal Bid or RFP in place. Four of the remaining thirty-six instances where an agreement was in place with the vendor but the products and/or services purchased with the P-Card were not related to the Bid or agreement on file and exceeded the $50, threshold. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 6 of 13

7 We recommend that management take the following actions concerning this issue: Implement and utilize an on-going monitoring routine which flags transactions in excess of purchasing thresholds. Ensure that P-Card cardholders are aware of and receive training on P-Card procedures as well as overall procurement policies, procedures and thresholds. Perform spend analysis on P-Card data to ensure that purchases stay within purchasing thresholds and to ensure that the P-Card program is utilized appropriately and effectively. Take appropriate disciplinary action where willful disregard for the Procurement policy is identified. OTHER ISSUES/OBSERVATIONS: POLICY WEAKNESSES Section IV of the county P-Card program policy states: A purchase may be made of multiple items, but the invoice cannot exceed $3, or the Cardholder s limit. Purchases over $3, must be made by Purchase Order under County Purchasing Policies and Procedures. However; Section VIII. 3. d. of this same policy states: A purchase may be made of multiple items, but the total invoice (including shipping) cannot exceed the lesser of $3, or the Cardholders single purchase limit. All purchases over $3, except those purchased off of Annual Agreements or State Contracts must be made by purchase order under the County s Purchasing Policies and Procedures. The policy as stated above poses a conflict for those employees whose single purchase transaction limit exceeds $3, The first section establishes that any purchase over $3, must be made via purchase order while the second section allows for purchases in conjunction with annual agreements and state contracts to exceed the $3, transaction limit. We recommend that the P-Card policy be clarified to ensure cardholder adherence to established purchasing thresholds. Currently the County P-Card policy is independent of the procurement code and procurement manual which include the competitive purchasing requirements. P-Cards are not a procurement method but rather a payment method and as such we recommend that the P- Card policy be integrated into the County s Procurement Policy. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 7 of 13

8 APPENDIX A Scope and Methodology The scope of this audit focused on the County s administration of its P-Card Program and Cardholder compliance with established policy and procedure. In conducting our audit, we interviewed County personnel, observed selected operations, tested selected County records, and completed various analyses and other procedures. We obtained records of all P-Card purchases for Fiscal Years 2009, 2010 and through the second quarter of FY11 and narrowed our scope to FY10 transactions for analysis and review. The audit included examinations of P-Card transactions and supporting documentation applicable to the period October 1, 2009 through September 30, Details of these transactions were analyzed to identify unusual activity which included but was not limited to: Transactions that occurred on the same day and were paid with the same P-Card that in the aggregate exceeded the $3, threshold; Transactions paid using the same P-Card that occurred on consecutive days that in the aggregate exceeded $3,000.00; Transactions to the same vendor that totaled more than $3, but did not have a specific pattern. Transactions which in aggregate exceeded established purchasing thresholds. Transactions identified for further review were traced to the original source documentation for analysis and determination as to whether the expenditure appeared to be for a public purpose and in compliance with established P-Card Policies. APPENDIX A Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 8 of 13

9 Detailed Results by Business Unit APPENDIX B Business Unit Total Cardholders in Business Unit Business Unit Aggregate FY10 P Card purchases (A) Employees identified with split purchases Aggregate FY10 expenditures for employees identified with split purchases (B) % of FY10 Aggregate Business Unit P Card dollars (B/A) % of FY10 Aggregate County P Card dollars (B/C) Operations & Maintenance 123 $6,883, $3,319, % 19.21% Environmental Services 76 $2,342, $1,333, % 7.72% Community Services 71 $1,382, $59, % 0.34% Emergency Services 44 $1,815, $567, % 3.28% Public Works 24 $1,244, $887, % 5.13% Totals: 338 $13,669, $6,166, % FY10 Aggregate P Card purchases: $17,280, (C) FY10 Total # of P Card Users in County: 441 APPENDIX B Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 9 of 13

10 Criteria for Evaluation of Management s Control of Business Risk The Nature of Internal Auditing Internal auditing is an integral part of the constitutional duties assigned to the Clerk of the Circuit Court and County Comptroller as Auditor of the Board of County Commissioners. The Clerk s internal audit department provides independent, objective assurance, attestation, and other services designed to add value and help improve County operations. This is accomplished by bringing a systematic, disciplined approach to evaluate the effectiveness of County business risk management, control, and business-governance processes. Our audit work is performed under guidance provided by the professional auditing standards of the Institute of Internal Auditors and the U.S. General Accountability Office. The Nature of Business Risk Management, Control, and Governance Processes Business risk management, control, and governance processes are all those activities designed and engaged in by the Board of County Commissioners, County Administration, executives, directors, and staff to provide reasonable assurance of (1) reliable financial and operating data and reports, (2) compliance with laws and regulations, (3) effective and efficient business practices, and (4) sound stewardship of the public resources and assets entrusted to them. Reasonable assurance that these core business objectives can be achieved is dependent upon the presence of the five components of management control listed below: The Control Environment Risk Assessment Practices Control Activities Information and Communications, and Monitoring Activities. To control business risk, all five components must operate effectively and in unison, and all County employees share in that responsibility. Please read Appendix C, pages 11 and 12, for additional information. The Nature of Reportable Issues The Institute of Internal Auditors defines these as situations that are of such significance that they require the attention of the senior leadership. Critical Conditions Any condition that has caused, or is likely to cause, errors, omissions, fraud or other adversities of such magnitude as to force immediate corrective actions to mitigate the associated business risk and possible consequent damage to the organization. Important Conditions Any condition that has caused, or is likely to cause, errors, omissions or other adversities that increase business risk and possible consequent damage to the organization, but does not require immediate corrective actions to mitigate the associated impact on operations or outcomes. Important conditions require attention within the short term (typically less than one year from disclosure). The Nature of Opportunities for Enhancement These represent improvements to the system of management control that the responsible manager may wish to consider as time and resources permit. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 10 of 13

11 DEFINITION OF MANAGEMENT CONTROL Management control is broadly defined as a process, affected by managers and other people, that provides reasonable assurance of achieving the three primary objectives for which all businesses strive: Effective and efficient operations, including achievement of performance goals and safeguarding of assets against loss Compliance with laws and regulations Reliable operational and financial data and reports COMPONENTS NECESSARY FOR EFFECTIVE MANAGEMENT CONTROL The CONTROL ENVIRONMENT The foundation for effective control. It sets the tone for the organization, and influences the control consciousness of its people. It addresses: Integrity, ethical and cultural values Competence of the organizations' people The manager s philosophy and operating style Assignment of authority and responsibility Organization and development of human resources The attention and direction given by senior management RISK ASSESSMENT The process of recognizing and prioritizing operational risks and obstacles. Statement of clear objectives Recognition of critical risks and obstacles Identification of factors critical for success Identification of significant changing conditions CONTROL ACTIVITIES Flow from Risk Assessment. Control Activities are the policies and procedures that managers establish to minimize risks and obstacles to desired outcomes. Examples include: Guidance, processes and practices Safeguarding resources Information systems and processing controls Approvals, authorizations, verifications, and reconciliations Division of work and separation of responsibilities INFORMATION and COMMUNICATION Provide the knowledge people need to meet responsibilities. The systems of information gathering The systems of internal/external communications flowing down, across and up the organization Internal and external data for decision-making Employees understanding of their control responsibilities Employees understanding how their work fits into the big picture MONITORING ACTIVITIES Involve assessment of control effectiveness by appropriate people on a timely basis. Measurement of outcomes Comparison of expected and actual results Performance comparisons and variance analyses Review of work assignments Upward reporting to senior management of significant concerns and issues Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 11 of 13

12 CRITERIA FOR ASSESSMENT OF EFFECTIVE MANAGEMENT CONTROL Management control can be judged effective if the responsible managers and senior leadership have reasonable assurance that they understand the extent to which desired outcomes are being achieved; the extent to which operational and financial data is being prepared reliably; and the extent to which legal and regulatory requirements are being met. This reasonable assurance exists when the five components of control are present and operating effectively. When this happens, the system of control should bring to light and routinely correct any critical or important conditions. These would be events that are likely to cause errors, omissions or other adversities of such magnitude that prompt corrective actions are required to mitigate the associated business risk and possible consequent damage. The expectation is that, in the normal course of operations, critical or important conditions can be identified, addressed and corrected; and not allowed to become persistent or pervasive. When significant issues are not detected and corrected, or when they become persistent or pervasive, then it can be inferred that operations are out of control. Should any one of the five components of the control framework be absent or seriously flawed, then it would be highly unlikely that effective control could exist. In practice, the need for efficient operations implies that the benefits derived from controls should exceed the cost to implement and maintain control processes. This acknowledges that there is a certain amount of residual risk associated with an effective system of management control. INHERENT LIMITIATIONS The effectiveness of controls changes over time. Moreover, controls designed to prevent all problems would not be cost effective. Limitations which may hinder the effectiveness of a system of controls include resource constraints, faulty judgments, unintentional errors, circumvention by collusion, and management overrides. The presence of these limitations may not always be detected by the audit process. Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 12 of 13

13 Laws, Policies, Rules and Regulations Project APPENDIX D Laws Chapter 125, Florida Statutes: County Government Sarasota County Ordinance ; Part II Code of Ordinances, Chapter 2- Administration, Article VI- County Procurement Code Policies Sarasota County Procurement Code Manual; Version 3.0 adopted 07/09/2009 Version 5.1 adopted 10/15/2009 Version 5.2 adopted 01/06/2010 Version 13.0 adopted 02/02/2011 Sarasota County Purchasing Card Policies; as adopted 09/18/2008 APPENDIX D Internal Audit Department - Clerk of the Circuit Court and County Comptroller Page 13 of 13