A REPORT FROM THE OFFICE OF INTERNAL AUDIT PRESENTED TO THE CITY COUNCIL CITY OF BOISE, IDAHO AUDIT / TASK: #12-08S1, Purchasing Compliance AUDIT CLIENT: Purchasing / Cross-Functional REPORT DATE: August 27, 2012 AUDIT GRADE: Satisfactory REPORT AUTHORS: APPROVED FOR RELEASE: Mariano Caputto, Audit Intern; and Steven Rehn CIA, CFSA Steven Rehn CIA, CFSA AUTHORITY: Boise City Code, 1-09-03 FY2012 Work Plan
Task #12-08 Series 1, Purchasing Compliance Date of Audit: February 6, 2012 INTRODUCTION The Office of Internal Audit has historically undertaken a series of reviews each year relative to the conduct of purchasing activities within the City. This report pertains to an assessment of the overall level of compliance with purchasing code, policy, and regulation currently being realized. The City utilizes PeopleSoft s systems to facilitate its purchasing activities. The system houses all created vendor data, serves as the platform for issuing and managing purchase orders, and is utilized to process payments through the accounts-payable module. Various levels or strata of purchasing activities have been established based on dollar values, and characteristics of the transactions. These are generally referred to as Informal, Semi-Formal, and Formal levels of purchases. Each of these levels carries with it differing requirements as to solicitations, bidding, and approval authorities. Informal purchases typically involve transactions that are less than $25,000. Semi-Formal processes are followed for purchases of goods and services between $25,000 and $49,999 - $99,999 in the case of construction projects. Formal purchase transactions involve the acquisition of goods or services at amounts of $50,000 or more - $100,000 or more in the case of construction projects. Purchase Order (PO) requirements do not necessarily follow the strata noted above. Small purchases up to $4,999 are at the discretion of Department Directors; PO s are not required. At $5,000 and above, however, Purchase Orders are mandatory for the great majority of transactions. Price comparisons are encouraged but are not mandatory below $5,000. Thereafter, as the transaction size increases, the amount of attention directed toward solicitation, pricing, and bids grows as each successive step is reached or surpassed. The table in Appendix A presents a summary of the requirements currently in place. 2
SCOPE AND METHODOLOGIES The scope period for purchasing activities included in this review was limited to records supporting that portion of Fiscal Year 2011 (10/1/10 to 9/30/11) that was available as of the audit date. The objectives established for this review included a determination of the following: Review Semi-formal Purchase transactions for basic metrics, evidence of best-price selection techniques, and proper approvals. Review Formal Purchases for basic transaction metrics, evidence of bestprice selection techniques, City Council approvals (when necessary), and completeness of the purchasing file. Review type, timeliness of submission, approvals, and accuracy of Change Orders. Also confirm that the related Purchase Orders have been updated. Determine if Sole Source declarations were made in accordance with Policy, City Code, and State Statue; documents were prepared and approved, and publication requirements were followed and documented. Review the administration of Task Orders for compliance with established guidelines. Determine if surplus property disposals were made in accordance with Policy, City Code, and State Statute. Internal Audit employed various methodologies during the review which included staff interviews, the review of associated documentation, statistical testing of purchase transactions, and such validation techniques as were appropriate to the circumstances. The methods employed and the evidentiary materials developed were deemed to be adequate to support the conclusions contained within this report. 3
EVALUATION AND COMMENTS Based on the work performed, it appears that administrative controls and processes related to Purchasing are functioning in a Satisfactory manner. The evaluation scale used by Internal Audit in assigning grades to audits defines one of the key attributes of a Satisfactory level of performance as: Reportable issues may exist within the audited area, but they are not deemed to be representative of pattern or practice within the area. Issues are typically of an isolated nature. Overall, systems of internal control are effective, and management oversight is adequate and supportive of the accomplishment of goals and objectives Internal Audit reviewed and / or analyzed electronic and hardcopy records related to 59 purchase orders with a combined total of $10,467,710.10. The total target population from which this sample was drawn amounted to $71,696,377.06. The random sample of Purchase Orders represents 14.18% of the total number of PO s in the target population, and 14.60% of the dollars expended in that same population. During the engagement, Internal Audit noted a number of issues related to compliance and documentation, and several more material issues that related to the administration of purchasing activities and contracts. Compliance and documentation issues tended to involve missing items and / or erroneous documentation. Those issues that were deemed to be more material in nature involved the failure to obtain proper approvals, and the continuation of work after the contracts / agreements authorizing the work had expired. Several minor process-related issues were also communicated to management as an Other Area of Concern (OAC). As is common to these types of communications, follow-up and correction is left to management s discretion. During the previous year s review, Internal Audit communicated its concerns to management relative to the number of documents that were not locate-able in the document management system. Observations during the current review suggest the Purchasing function has achieved improvements in this area. After extensive fieldwork, Audit did not identify deficiencies that were suggestive of patterns or practice. Rather, they appeared to be more isolated in nature. Overall, a generally satisfactory level of compliance with the City s purchasing protocols appears to have been achieved. (Refer to Appendix B for additional details concerning Internal Audit s existing grading scale.) 4
FINDINGS AND RECOMMENDATIONS Audit s Findings are detailed below; including any recommendations that were made, and management s responses to those suggestions. 1. FINDING: Transaction Documentation / Administration The City has adopted a number of measures, in the form of policies, procedures, training, and guidelines in order to create a control environment that promotes the effective and efficient procurement of goods and services, and the construction of facilities. During compliance testing, Internal Audit identified areas for improvement in documentation and compliance: An Intent to Award letter for one of the Formal Bids tested could not be located. Two state tax notifications that were reviewed contained incorrect activity dates. Testing revealed instances where projects were not always completed within the terms of the contract; activity appeared to have occurred after agreements had expired in three instances. Proper documentation and administration of contracts contributes to the reduction of risk, in terms of both compliance and financial exposure. RECOMMENDATION: By taking steps to determine causal factors, and to address those going forward, the City can help to ensure accurate documentation is present to support transactions, and contractual requirements are consistently observed. MANAGEMENT RESPONSE: Relative to Award Letters and tax notifications, the responsible Department provided the following response. Finance and Administration Response: The Purchasing support staff position, which is responsible for State Tax Notices and scanning and indexing documents into OnBase, has had a high turnover in the last couple of years. The missing Intent To Award referred to in the Finding has been added to and indexed in OnBase. Management concurs that the dates on the State Tax Notices referenced were dated 5
incorrectly. In the future, all new support staff will be given up-front training and will have additional oversight to ensure the accuracy of these notices. This oversight will consist of periodic checks of work product to verify accuracy. Checks will be conducted by DFA supervisory staff, and / or by Purchasing staff. Relative to issues associated with contract completion within specified terms, the Departments / Divisions involved with those transactions provided the following responses. Purchasing Division Response: Purchasing generally has no visibility of on-going contract activity or invoices. If projects are not completed within the time specified, it is the assigned Project Manager s responsibility to complete an Amendment or Change Order to extend the Contract. Public Works Response: Management agrees that a stronger effort should be made at keeping the completion dates updated and will do so going forward. On Professional Service contracts, the interest is centered more on cost and quality of work. The timeframe, in many cases, is not the major driver for the project; and in some cases can be almost impossible to predict because it generally is somewhat outside the control of the Consultant. It can involve parties that are not under the control of the Consultant. Management will not go back and issue change orders on completed, closed out Task Orders since there is bona fide acceptance of extension. However, management will discuss this issue with staff, and require that they pay more attention to keeping the Task Order timeframes up to date. Airport Response: Management reviewed this issue with the assigned project manager, and will process a change order to increase contract time. Also, management has reviewed this issue with all the project managers to reinforce the need to manage the contracts in accordance with City policy. Fire Department Response: (Audit Note: This project was co-sourced with Public Works by the Fire Department due to Public Works specialty skills and knowledge in this area. The following response was received from the Public Works Department.) Public Works Response: The project manager did note the date expiring but did not think it warranted a change order as the original completion date was considered more of a target date rather than a 6
critical contract completion date. The developer did have a valid reason why they could not complete the work in the original time frame for reasons both staff and the developer informally acknowledged and agreed was justified. (ie: there were issues involving the dedication of a needed right-of-way). The extended completion did not have any impact on the City. There have been several contract completion time issues in recent audit reports, which has made this issue more visible. The Public Works Department now recognizes it is considered "Best Practices" to execute a change order in these types of situations and agrees to implement this practice going forward in the future. 7
2. FINDING: Change Order Processes Change Orders to contracts are most commonly pursued when changes to terms or expenditure authority are needed. Usually, the need to change terms and conditions materializes in order to address circumstances that were not foreseeable during original specification-writing and bidding processes. Risks associated with these actions are minimized through defined approval authorities. Audit tests revealed the following: There was a failure to obtain Purchasing Agent approval for a series of three (3) Change Orders; Purchasing Agent approval was required due to the size of those changes. A deductive Change Order (a decrease in contract expenditure limits) was approved but never applied to the associated Purchase Order. The Purchase Order reflects excess purchasing authority as a result. The Department / Division responsible for managing the associated contract failed to pursue the appropriate authorizations before increasing spending authority. In the case of the deductive Change Order, they did not make the necessary changes in the Purchase Order system to reflect the reduction in expenditures that was anticipated. RECOMMENDATION: By identifying causal factors associated with these deficiencies and pursuing corrective actions, the City will strengthen internal controls surrounding contract changes. This in turn will add assurances that expenditures are authorized, effective, and efficient in the procurement of goods and services, and the construction of Public Works projects. MANAGEMENT RESPONSE: The Departments / Divisions involved with the transactions in question provided the following response: Purchasing: As soon as Purchasing became aware of the oversight in obtaining approval, we notified the Public Works Department s Purchasing Specialist. Relative to the deductive Change Order, these types of transactions are not within the control of the Purchasing Staff. 8
Public Works / Government Buildings: This incident highlighted the fact that because we have some less experienced project managers being placed into action due to workload that we need to provide a brief contract administration refresher course for both our old and new project managers. We will also include several program managers from within the department. The Department s Purchasing Specialist will conduct and complete this training as soon as possible. Completion date will be contingent on working around ERP activities, scheduled vacations, and any other absences that may occur. Once the new purchasing rules go into place, we will have much broader training to cover the details of the new regulations. (Audit Note: Due to an unexpected absence of the Department s purchasing specialist, this training has been delayed. Training will be re-scheduled upon that staff member s return.) 9
3. FINDING: Notification Requirements Idaho state statutes provide considerable regulatory structure around cities purchasing activities. According to one of those statutes: Within thirty (30) days after any public works contractor.. has been awarded a contract for construction to be performed within the state of Idaho involving the expenditure of any public moneys, the contract awarding agency shall notify the state tax commission that the contract has been awarded and shall provide to the state tax commission the name and address of the prime contractor... During the testing of construction projects, Internal Audit identified three (3) contracts that appeared to be in noncompliance with the above mentioned criteria. No documentation was present that would demonstrate this requirement had been satisfied. Department of Finance & Administration staff indicated the possible cause for the deficiency was related to turnover in the position that was responsible for the notifications. At the time of Audit s review, DFA staff was unable to affirm whether or not the required notifications had been performed. RECOMMENDATION: Internal Audit recommends management review workflow protocols to ensure compliance with State Statute, and implement changes to internal controls in order to increase the likelihood of compliance. MANAGEMENT RESPONSE: Finance and Administration Response: While researching the three (3) exception findings noted on the audit report, administrative staff found that one of the State Tax Notices was sent and received by the State within the 30 days allowed by Idaho Statute 54-1904A. The remaining two Notices were not sent within the 30 days allowed. The Purchasing support staff position, which is responsible for filing the State Tax Notices, has had a high turnover in the last couple of years. In the future, all new support staff will be given up-front training and will have additional oversight to ensure timely filing of these notices. This oversight will consist of periodic checks of work product to verify accuracy. Checks will be conducted by DFA supervisory staff, and / or by Purchasing staff. Furthermore, State Tax Notices will be submitted weekly. 10
OTHER AREAS OF CONCERN Internal Audit utilizes Other Areas of Concern to comment on issues noted during a project that appear to deserve management attention at some level. Audit noted two such areas during the review. One, pertaining to a recordation error in Council Minutes, was provided to City Clerk and left to their discretion as to correction. The second, appearing below, concerned issues of direct concern to the Purchasing function. Activity Documentation The City has adopted a number of measures that are designed to foster a control environment that is effective and efficient relative to the procurement of goods and services. Although the Purchasing function generally exhibited a high level of compliance with State Statute and City Code, there exist opportunities for improvement in specific aspects of the Purchasing function relative to electronic document submission and contract administration. Specifically: OnBase naming conventions: The state of the data could be improved by consistently labeling documents associated with contracts that involve multiple vendors with the appropriate contract letters (e.g., 12-001A, 12-001B, etc.). Audit noted this was not always accomplished. Task Order administration: A Task Order tally sheet was missing for one of the contracts. The Task Order itself was missing for a second. This condition is inconsistent with task order training, and also complicates tracking contract consumption. Purchase Order administration: On several Purchase Orders, the bid number, and bid information and prices were not documented as required in bidding regulations. PO / TO Matching: Purchase Order lines did not always match Task Order amounts, which was inconsistent with task order training. By taking steps to address these items, the City may continue to realize benefits by reducing time and resources utilized in validating / over-seeing expenditures, and minimizing potential loss due to contract misadministration. 11
CONCLUSION Overall compliance with statute and code appears to have been achieved by the Purchasing function within the Department of Finance and Administration Financial Services Division. The Purchasing function has adopted a mission statement that includes the following: to ensure that City Departments obtain quality and cost efficient goods, services, and products in a timely manner, and to ensure that all bid processes are fair and equitable Although the review suggested opportunities for improvement were available in certain areas, purchasing processes and procedures generally appear to be effective in helping the function to satisfy its defined mission, goals and objectives. As a result, risks associated with this important function are mitigated; and an acceptable level of compliance with laws, rules, and regulations is achieved. Internal Audit would like to thank management and staff of the Department of Finance and Administration for their valuable assistance and input during the course of the project. We would also like to acknowledge the input provided by management of Airport and Public Works that were involved in the review. MANAGEMENT PARTICIPANTS Debbie Broughton, Chief Financial Officer / City of Boise Mollie Holt, Financial Services Manager / City of Boise Tonya Wallace, Strategic Planning & Budget Manager / City of Boise James McMahon, Controller / City of Boise 12
APPENDIX A Boise City Purchasing Requirements Transaction Type Items Purchased Dollar Limits Solicitation Method Purchase Order Bid Requirements Approval Level Informal All Purchases < $5,000 Informal Solicitations Optional Optional / Recommended Department Director Informal All Purchases < $25,000 Informal Solicitations Mandatory Written Quotes Purchasing Agent Semi-Formal Goods and Services < $50,000 Written Request to Vendors Mandatory Written Bids Public Opening Purchasing Agent Semi-Formal Construction < $100,000 Written Request to Vendors Mandatory Written Bids Public Opening Purchasing Agent Formal Goods and Services > $50,000 Published Invitations Mandatory Sealed Bid Public Opening City Council Formal Construction > $100,000 Published Invitations Mandatory Sealed Bid Public Opening City Council Sole Source All Purchases < $25,000 Satisfy Statutory Requirements Mandatory above $4,999 Sole Source Declaration by Purchasing Agent Purchasing Agent with City Council Review Sole Source All Purchases > $25,000 Satisfy Statutory Requirements Mandatory Sole Source Declaration by City Council City Council Change Orders All Purchases < $10,000, and < 10% of Contract n/a n/a n/a Department Director Change Orders All Purchases < 10% up to $1 million n/a n/a n/a Purchasing Agent Change Orders All Purchases > 10% of Contract, and / or > $1million n/a n/a n/a City Council Note: This table presents a general overview of Boise City s purchasing requirements. It does not attempt to present all contingencies that might be encountered in any given purchasing situation. 13
APPENDIX B Evaluation and Grading of Audits Each audit will be evaluated or graded, and will receive one of the five following ratings. Grades will be assigned based on the perceived best fit. Thus, not all attributes associated with an assigned grade may be present within a given Department or Division. High Satisfactory No significant weaknesses or deficiencies were noted during the audit. If any issues were noted, they were clearly insignificant or inconsequential. The audited area displays a high degree of control and management oversight is effective. Satisfactory Reportable issues may exist within the audited area, but they are not deemed to be representative of pattern or practice within the area. Issues are typically of an isolated nature. Overall, systems of internal control are effective, and management oversight is adequate and supportive of the accomplishment of goals and objectives. Low Satisfactory Reportable issues exist within the audited area, and are encountered frequently enough to lose the appearance of isolated. Systems of internal control appear to be marginally adequate at best. Management oversight is not always effective to ensure the quality of operations. Needs Improvement Weaknesses or deficiencies are encountered on a relatively frequent basis within the audited entity or function. Issues noted, and their frequency, are suggestive of a pattern or practice of inadequate oversight. Internal control mechanisms may not be universally in place, implemented, or actively observed. Management oversight is weak, or is not always effective. Unsatisfactory Material or significant deficiencies are noted within the operations under review. Issues may pose risks that are either missioncritical or mission-fatal. Management has failed to implement appropriate internal controls. Management oversight is ineffective, absent, or willfully avoided. 14