Loading...
2023-049 Informal Audit Follow-Up Report July 21, 2023 Report No. 2023-049 INFORMAL STAFF REPORT TO MAYOR AND CITY COUNCIL SUBJECT: Fiscal Year 2022-23 Internal Audit Informal Follow-Up Review Report BACKGROUND: The Internal Audit Department has completed informal follow-up reviews of the audit projects listed below. We conducted this performance audit per generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives.We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Previously, the Internal Audit Department has completed formal follow-up reviews of the following audit projects and found that only one or two recommendations were outstanding: Project 001 —Audit of Customer Service Division; Project 006—Audit of Roadwgy Quality Management; Project 010—Audit of Capital Projects Administration: Property Acquisition; and Project 018—Audit of Health Insurance Operations. This report is intended to provide an update on the six outstanding recommendations from each of these projects. Audit fieldwork was conducted during January, February, March, May and July 2023. The scope of the review varied depending on the procedure being performed. The following list summarizes major procedures performed during this time: • Reviewed documentation from the issued audit and follow-up reports relevant to the six outstanding recommendations; • Examined account history of the five outstanding accounts noted in the Audit of Customer Service Division and discussed current account status with the Customer Service Division, and the Finance and Legal Departments' staff; • Reviewed Street Division standard operating procedures related to identifying, reviewing, and approving street maintenance activities and selecting street rehabilitation design standards; • Observed a judgement sample of street maintenance selection and approval documentation and street maintenance inspections; • Reviewed a sample of 18 parcels acquired between March 2022 and January 2023 for capital improvement projects; and • Reviewed communication between the City's Human Resources Department and Third- Party Administrator regarding the Service Organization Control Report and user access list. City management is responsible for ensuring that resources are managed properly and used in compliance with laws and regulations; programs are achieving their objectives; and services are being provided efficiently, effectively, and economically. July 21, 2023 Report No. 2023-049 DISCUSSION: Project 001 —Audit of Customer Service Division Previously, the Internal Audit Department completed a follow-up review of the Audit of Customer Service Division in June 2020. At that time, Staff found that 14 of the issued 15 recommendations had been implemented. The remaining recommendation and its follow-up results are shown below: 15. The City Attorney and Finance Director need to collaborate to pursue collection on the above four accounts and the Company 5 account. Management Response: Concur The Finance Director will continue to consult with the City Attorney's Office regarding collection options for these large receivables and follow up with the Internal Auditor once a collection option is identified. Audit Follow-Up Finding: Implemented The original audit had identified five companies that had large outstanding receivable balances that were not being pursued by the Customer Service Division at the time. Table 1 compares the original outstanding balances identified in the audit to the balance as of January 2023 and summarizes the account's current status. Table 1: Outstanding Commercial Receivables (January 2023) Company Reference Status Original Audit Balance Current Balance Company 5 Bankruptcy $977,446 $977,446 Company 1 Bankruptcy $206,299 $391,040 Company 2 Collections $187,639 $131,493 Company 3 Paid $34,132 $83 Company 4 Paid $24,050 $0 Total: $1,429,566 $1,500,062 The balances of Company 5 and Company 1 are being collected by the City through the bankruptcy process that these companies are currently undergoing. Finally, for Company 2, the balance has been sent to the Customer Service Division's contracted collections agency per adopted standard operating procedures. Based on this information, this recommendation appears to be implemented to the extent possible. Project 006—Audit of Roadway Quality Management Previously, the Internal Audit Department completed a follow-up review of the Audit of Roadway Quality Mana eg ment in October 2021. At that time, Staff found that ten of the issued 12 recommendations had been implemented. The remaining recommendations and their follow- up results are shown below: 1. Develop a standardized process for recording/approving street rehabilitation design adjustments. July 21, 2023 Report No. 2023-049 Management Response: Concur Staff will implement process controls for deviation from recommendations. This will include written documentation escalated and signed by management to approve the deviation. SOPS (standard operating procedures) will be created and all employees will be trained on the process. Audit Follow-Up Finding: Implemented The original audit found that some street maintenance activities did not align with the recommended activity based on the overall condition index—or OCI—score of the relevant street segment. Further, the reason for performing these unaligned maintenance activities was not documented or approved by Streets Management. In January 2023, the Streets Division implemented a standard operating procedure that outlined the process for selecting and approving street maintenance activities as illustrated in Figure 1. Based on a review of a sample maintenance project approved in February 2023, this procedure appears to be in effect indicating this recommendation is implemented. Figure 1: Street Maintenance Project Selection&Approval Process /0*0� Stakeholder Streets •Generate list of Depts. •Complete field rd Management potential segments inspection of based on OCI -Review&clear cleared segments to -Review&approve segments without verify needed maintenance conflicts for maintenance projects maintenance IdStreets Business Streets Services Supervisors \44w� \,**M� 3. Require Street Field Supervisors to submit periodic inspection reports. Management Response: Concur Standardized inspection documentation will be created and implemented. These documents will be specific to the work being performed, (mill and overlay, micro seal, reconstruction, etc.), archived in the Cartegraph system, and tied to the work order. SOPS (standardized operating procedures)will be created and all employees will be trained. Audit Follow-Up Finding: Implemented During the original audit, Streets staff stated that inspections of in-house street maintenance projects—including micro sealing, mill and overlays, and reconstructions—were performed by the City's Streets Supervisors; however, no documentation of completed inspection results was produced. Since then, Streets has worked with the City's Public Works Inspections Department to develop standard checklists for asphalt paving and roadway subgrade lime July 21, 2023 Report No. 2023-049 stabilization activities. Based on a review of two sample maintenance projects performed during April 2023, these inspection checklists were generally completed by a Streets Field Services Supervisor and reviewed by a Public Works Inspector indicating this recommendation is implemented. Project 010—Audit of Capital Projects Administration: Property Acquisition Previously, the Internal Audit Department completed a follow-up review of the Audit of Capital Projects Administration: Property Acquisition in April 2022. At that time, Staff found that four of the issued five recommendations had been implemented. The remaining recommendation and its follow-up results are shown below: 1. Require Real Estate Staff to execute and maintain all required documents properly for the acquisition of real estate properties in line with implemented real estate acquisition process. Management Response: Concur Direction to execute and maintain documents had previously been given prior to audit. Steps have been implemented to check/confirm compliance monthly. Audit Follow-Up Finding: Implemented In general, the City's real estate acquisition process requires the department to create and acquire the following critical documents: • Project Request Form • Project Introduction Letter • Title Commitment • Property Appraisal • Initial Offer • Final Offer • Counteroffer Justification • Payment Verification • Recording Instrument The original audit and the first follow-up review found that critical property acquisition documentation from some projects was not available. Most notably, some title commitments and offer letters were not available and the original audit found that there was no requirement for acceptance of a counteroffer to be justified. Based on a review of 28 parcels acquired between March 2022 and January 2023, all required documentation was available indicating this recommendation is implemented as shown in Figure 2. Figure 2: Missing Property Acquisition Documentation Comparison too°io 1oo°io ■Original Audit E Initial Follow-Up ■Current Follow-Up 80% 75% 0% 60% 1% 40% — 20% o 0 40/12%0 4% o 0 4% o 0 7%5% 0 8% o 0 0 0 0 0 0 0% 0% 0% 0/00% 0/00% 0% NA 0% 0/00/00% 0/00/00% 0% �� Project Request Project Title Appraisal Initial Offer Final Offer Counteroffer Payment Recording Form Introduction Commitment Letter Letter Justification Verification Insturment Letter July 21, 2023 Report No. 2023-049 Project 018—Audit of Health Insurance Operations Previously, the Internal Audit Department completed a follow-up review of the Audit of Health Insurance Operations in June 2022. At that time, Staff found that five of the issued seven recommendations had been implemented. The remaining recommendations and their follow-up results are shown below: 3. Develop a process to report to City Management any control weaknesses identified in the Third-Party Administrator's Service Organization Control Report. Management Response: Concur The Risk Management department concurs with this recommendation. The department obtained the current report during the audit process and requested that moving forward, McGriff provide the report on an annual basis as part of our Plan mid-year review. At the mid-year review, the report will be reviewed, and we will work with McGriff and the TPA to address any areas of concern. Should any areas of concern be identified, the Risk and Compliance Manager will notify City leadership about the concerns and the processes put in place to address the concerns on an ongoing basis. Audit Follow-Up Finding: Implemented In general, the City's Third-Party Administrator for its health insurance plans is required to undergo an independent evaluation of their claim's administration process annually. The results of this evaluation are then communicated in a Service Organization Control— or SOC—report that describes the reviewed process, reports on any material control weaknesses, and recommends controls that user entities should employ in their organizations. The original audit found that the City's Third-Party Administrator was required to provide their annual SOC report to the City; however, this had not been regularly obtained and reviewed by City staff. Further, the first follow-up review found that a process had not been established to regularly request this report. Since then, a process to request this report has been developed and the report is discussed with the City's Employee Benefits Consultant annually. Based on this information, this recommendation appears to be implemented. 4. Annually verify that the City has adequate complementary user organization controls based on the Third-Party Administrator's Service Organization Control Report. Management Response: Concur The Risk Management department concurs with this recommendation. Based on the SOC report received and reviewed at our Plan mid-year review as described above, the department will review and work with McGriff and the TPA to put in place any additional complementary controls needed to address any concerns. Audit Follow-Up Finding: Implemented The original audit found that the City had not implemented all complementary user controls recommended by the SOC report; however, these had been implemented as of the completion of the first follow-up review. Based on this information, as well as the implementation of Recommendation 3, this recommendation appears to be implemented. July 21, 2023 Report No. 2023-049 CONCLUSION: Based on the information presented in the above Discussion section, the status of each recommendation is summarized below: Recommendation Mgmt. Response Status 001 Audit of Customer Service Division 15. Pursue collection of identified delinquent commercial accounts. Concur Implemented 006 Audit of Roadway Quality Management 1. Develop a standardized process for recording/approving street rehabilitation design Concur Implemented adjustments. 3. Require Street Field Supervisors to submit periodic inspection reports. Concur Implemented 010 Audit of Capital Improvement Projects: Property Acquisition 1. Require Real Estate staff to execute and maintain all required documents properly for the acquisition of real estate properties in line Concur Implemented with implemented real estate acquisition process. 018 Audit of Health Insurance Operations 3. Develop a process to report to City Management any control weaknesses identified Concur Implemented in the Third-Party Administrator's Service Organization Control Report. 4. Annually verify that the City has adequate complementary user organization controls based on the Third-Parry Administrator's Concur Implemented Service Organization Control Report. Based on the results of this informal follow-up review, Staff is recommending the following: • Project 001 —Customer Service Division be closed and considered formally complete with a 100% Implementation rate; • Project 006 Roadway Quality Management be closed and considered formally complete with a 100% Implementation rate; • Project 010 Capital Projects Administration: Property Acquisition be closed and considered formally complete with a 100% Implementation rate; and • Project 018 Health Insurance Operations be closed and considered formally complete with a 100% Implementation rate. July 21, 2023 Report No. 2023-049 These recommendations will be presented to the Internal Audit Advisory Committee for review and necessary action.If the City Council has any concerns about the above Staff recommendations, please reach out to the City Auditor before June 23, 2023. ATTACHMENTS: None. STAFF CONTACT: Madison Rorschach, City Auditor Internal Audit Department (940) 349-7228 Madison.Rorschach&CityofDenton.com REQUESTOR: Staff Initiated PARTICIPATING DEPARTMENTS: Internal Audit, Customer Service, Streets, Real Estate, Human Resources STAFF TIME TO COMPLETE REPORT: 22 Hours (Internal Audit only)