2023-049 Informal Audit Follow-Up Report July 21, 2023 Report No. 2023-049
INFORMAL STAFF REPORT
TO MAYOR AND CITY COUNCIL
SUBJECT:
Fiscal Year 2022-23 Internal Audit Informal Follow-Up Review Report
BACKGROUND:
The Internal Audit Department has completed informal follow-up reviews of the audit projects
listed below. We conducted this performance audit per generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our
audit objectives.We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
Previously, the Internal Audit Department has completed formal follow-up reviews of the
following audit projects and found that only one or two recommendations were outstanding:
Project 001 —Audit of Customer Service Division;
Project 006—Audit of Roadwgy Quality Management;
Project 010—Audit of Capital Projects Administration: Property Acquisition; and
Project 018—Audit of Health Insurance Operations.
This report is intended to provide an update on the six outstanding recommendations from each of
these projects. Audit fieldwork was conducted during January, February, March, May and July
2023. The scope of the review varied depending on the procedure being performed. The following
list summarizes major procedures performed during this time:
• Reviewed documentation from the issued audit and follow-up reports relevant to the six
outstanding recommendations;
• Examined account history of the five outstanding accounts noted in the Audit of Customer
Service Division and discussed current account status with the Customer Service Division,
and the Finance and Legal Departments' staff;
• Reviewed Street Division standard operating procedures related to identifying, reviewing,
and approving street maintenance activities and selecting street rehabilitation design
standards;
• Observed a judgement sample of street maintenance selection and approval documentation
and street maintenance inspections;
• Reviewed a sample of 18 parcels acquired between March 2022 and January 2023 for
capital improvement projects; and
• Reviewed communication between the City's Human Resources Department and Third-
Party Administrator regarding the Service Organization Control Report and user access
list.
City management is responsible for ensuring that resources are managed properly and used in
compliance with laws and regulations; programs are achieving their objectives; and services are
being provided efficiently, effectively, and economically.
July 21, 2023 Report No. 2023-049
DISCUSSION:
Project 001 —Audit of Customer Service Division
Previously, the Internal Audit Department completed a follow-up review of the Audit of
Customer Service Division in June 2020. At that time, Staff found that 14 of the issued 15
recommendations had been implemented. The remaining recommendation and its follow-up
results are shown below:
15. The City Attorney and Finance Director need to collaborate to pursue collection on the above
four accounts and the Company 5 account.
Management Response: Concur
The Finance Director will continue to consult with the City Attorney's Office regarding
collection options for these large receivables and follow up with the Internal Auditor once a
collection option is identified.
Audit Follow-Up Finding: Implemented
The original audit had identified five companies that had large outstanding receivable
balances that were not being pursued by the Customer Service Division at the time. Table 1
compares the original outstanding balances identified in the audit to the balance as of January
2023 and summarizes the account's current status.
Table 1: Outstanding Commercial Receivables (January 2023)
Company Reference Status Original Audit Balance Current Balance
Company 5 Bankruptcy $977,446 $977,446
Company 1 Bankruptcy $206,299 $391,040
Company 2 Collections $187,639 $131,493
Company 3 Paid $34,132 $83
Company 4 Paid $24,050 $0
Total: $1,429,566 $1,500,062
The balances of Company 5 and Company 1 are being collected by the City through the
bankruptcy process that these companies are currently undergoing. Finally, for Company 2,
the balance has been sent to the Customer Service Division's contracted collections agency
per adopted standard operating procedures. Based on this information, this recommendation
appears to be implemented to the extent possible.
Project 006—Audit of Roadway Quality Management
Previously, the Internal Audit Department completed a follow-up review of the Audit of
Roadway Quality Mana eg ment in October 2021. At that time, Staff found that ten of the issued
12 recommendations had been implemented. The remaining recommendations and their follow-
up results are shown below:
1. Develop a standardized process for recording/approving street rehabilitation design
adjustments.
July 21, 2023 Report No. 2023-049
Management Response: Concur
Staff will implement process controls for deviation from recommendations. This will include
written documentation escalated and signed by management to approve the deviation. SOPS
(standard operating procedures) will be created and all employees will be trained on the
process.
Audit Follow-Up Finding: Implemented
The original audit found that some street maintenance activities did not align with the
recommended activity based on the overall condition index—or OCI—score of the relevant
street segment. Further, the reason for performing these unaligned maintenance activities was
not documented or approved by Streets Management.
In January 2023, the Streets Division implemented a standard operating procedure that
outlined the process for selecting and approving street maintenance activities as illustrated in
Figure 1. Based on a review of a sample maintenance project approved in February 2023, this
procedure appears to be in effect indicating this recommendation is implemented.
Figure 1: Street Maintenance Project Selection&Approval Process
/0*0�
Stakeholder Streets
•Generate list of Depts. •Complete field rd Management
potential segments inspection of
based on OCI -Review&clear cleared segments to -Review&approve
segments without verify needed maintenance
conflicts for maintenance projects
maintenance
IdStreets Business Streets
Services Supervisors
\44w� \,**M�
3. Require Street Field Supervisors to submit periodic inspection reports.
Management Response: Concur
Standardized inspection documentation will be created and implemented. These documents
will be specific to the work being performed, (mill and overlay, micro seal, reconstruction,
etc.), archived in the Cartegraph system, and tied to the work order. SOPS (standardized
operating procedures)will be created and all employees will be trained.
Audit Follow-Up Finding: Implemented
During the original audit, Streets staff stated that inspections of in-house street maintenance
projects—including micro sealing, mill and overlays, and reconstructions—were performed
by the City's Streets Supervisors; however, no documentation of completed inspection results
was produced. Since then, Streets has worked with the City's Public Works Inspections
Department to develop standard checklists for asphalt paving and roadway subgrade lime
July 21, 2023 Report No. 2023-049
stabilization activities. Based on a review of two sample maintenance projects performed
during April 2023, these inspection checklists were generally completed by a Streets Field
Services Supervisor and reviewed by a Public Works Inspector indicating this
recommendation is implemented.
Project 010—Audit of Capital Projects Administration: Property Acquisition
Previously, the Internal Audit Department completed a follow-up review of the Audit of Capital
Projects Administration: Property Acquisition in April 2022. At that time, Staff found that four
of the issued five recommendations had been implemented. The remaining recommendation and
its follow-up results are shown below:
1. Require Real Estate Staff to execute and maintain all required documents properly for the
acquisition of real estate properties in line with implemented real estate acquisition
process.
Management Response: Concur
Direction to execute and maintain documents had previously been given prior to audit.
Steps have been implemented to check/confirm compliance monthly.
Audit Follow-Up Finding: Implemented
In general, the City's real estate acquisition process requires the department to create and
acquire the following critical documents:
• Project Request Form • Project Introduction Letter • Title Commitment
• Property Appraisal • Initial Offer • Final Offer
• Counteroffer Justification • Payment Verification • Recording Instrument
The original audit and the first follow-up review found that critical property acquisition
documentation from some projects was not available. Most notably, some title
commitments and offer letters were not available and the original audit found that there
was no requirement for acceptance of a counteroffer to be justified. Based on a review of
28 parcels acquired between March 2022 and January 2023, all required documentation
was available indicating this recommendation is implemented as shown in Figure 2.
Figure 2: Missing Property Acquisition Documentation Comparison
too°io 1oo°io
■Original Audit E Initial Follow-Up ■Current Follow-Up
80% 75%
0%
60%
1%
40% —
20% o 0 40/12%0 4% o 0 4% o 0 7%5% 0 8% o 0 0 0 0 0 0
0% 0% 0% 0/00% 0/00% 0% NA 0% 0/00/00% 0/00/00%
0% ��
Project Request Project Title Appraisal Initial Offer Final Offer Counteroffer Payment Recording
Form Introduction Commitment Letter Letter Justification Verification Insturment
Letter
July 21, 2023 Report No. 2023-049
Project 018—Audit of Health Insurance Operations
Previously, the Internal Audit Department completed a follow-up review of the Audit of Health
Insurance Operations in June 2022. At that time, Staff found that five of the issued seven
recommendations had been implemented. The remaining recommendations and their follow-up
results are shown below:
3. Develop a process to report to City Management any control weaknesses identified in the
Third-Party Administrator's Service Organization Control Report.
Management Response: Concur
The Risk Management department concurs with this recommendation. The department
obtained the current report during the audit process and requested that moving forward,
McGriff provide the report on an annual basis as part of our Plan mid-year review. At the
mid-year review, the report will be reviewed, and we will work with McGriff and the
TPA to address any areas of concern. Should any areas of concern be identified, the Risk
and Compliance Manager will notify City leadership about the concerns and the
processes put in place to address the concerns on an ongoing basis.
Audit Follow-Up Finding: Implemented
In general, the City's Third-Party Administrator for its health insurance plans is required
to undergo an independent evaluation of their claim's administration process annually.
The results of this evaluation are then communicated in a Service Organization Control—
or SOC—report that describes the reviewed process, reports on any material control
weaknesses, and recommends controls that user entities should employ in their
organizations. The original audit found that the City's Third-Party Administrator was
required to provide their annual SOC report to the City; however, this had not been
regularly obtained and reviewed by City staff. Further, the first follow-up review found
that a process had not been established to regularly request this report.
Since then, a process to request this report has been developed and the report is discussed
with the City's Employee Benefits Consultant annually. Based on this information, this
recommendation appears to be implemented.
4. Annually verify that the City has adequate complementary user organization controls
based on the Third-Party Administrator's Service Organization Control Report.
Management Response: Concur
The Risk Management department concurs with this recommendation. Based on the SOC
report received and reviewed at our Plan mid-year review as described above, the
department will review and work with McGriff and the TPA to put in place any
additional complementary controls needed to address any concerns.
Audit Follow-Up Finding: Implemented
The original audit found that the City had not implemented all complementary user
controls recommended by the SOC report; however, these had been implemented as of
the completion of the first follow-up review. Based on this information, as well as the
implementation of Recommendation 3, this recommendation appears to be implemented.
July 21, 2023 Report No. 2023-049
CONCLUSION:
Based on the information presented in the above Discussion section, the status of each
recommendation is summarized below:
Recommendation Mgmt. Response Status
001 Audit of Customer Service Division
15. Pursue collection of identified delinquent
commercial accounts. Concur Implemented
006 Audit of Roadway Quality Management
1. Develop a standardized process for
recording/approving street rehabilitation design Concur Implemented
adjustments.
3. Require Street Field Supervisors to submit
periodic inspection reports. Concur Implemented
010 Audit of Capital Improvement Projects: Property Acquisition
1. Require Real Estate staff to execute and
maintain all required documents properly for
the acquisition of real estate properties in line Concur Implemented
with implemented real estate acquisition
process.
018 Audit of Health Insurance Operations
3. Develop a process to report to City
Management any control weaknesses identified Concur Implemented
in the Third-Party Administrator's Service
Organization Control Report.
4. Annually verify that the City has adequate
complementary user organization controls
based on the Third-Parry Administrator's Concur Implemented
Service Organization Control Report.
Based on the results of this informal follow-up review, Staff is recommending the following:
• Project 001 —Customer Service Division be closed and considered formally complete with
a 100% Implementation rate;
• Project 006 Roadway Quality Management be closed and considered formally complete
with a 100% Implementation rate;
• Project 010 Capital Projects Administration: Property Acquisition be closed and
considered formally complete with a 100% Implementation rate; and
• Project 018 Health Insurance Operations be closed and considered formally complete with
a 100% Implementation rate.
July 21, 2023 Report No. 2023-049
These recommendations will be presented to the Internal Audit Advisory Committee for review
and necessary action.If the City Council has any concerns about the above Staff recommendations,
please reach out to the City Auditor before June 23, 2023.
ATTACHMENTS:
None.
STAFF CONTACT:
Madison Rorschach, City Auditor
Internal Audit Department
(940) 349-7228
Madison.Rorschach&CityofDenton.com
REQUESTOR:
Staff Initiated
PARTICIPATING DEPARTMENTS:
Internal Audit, Customer Service, Streets, Real Estate, Human Resources
STAFF TIME TO COMPLETE REPORT:
22 Hours (Internal Audit only)