Loading...
1. Audit of Accounts Payable ABSTRACT Controls over$525 million of payments were Qp©© generally adequate. This audit recommends some II�V(�ICC QO QO©� improvements to documentation and supervisory Q©QG® review that will increase assurance that all s ` ©Q601 payments made are appropriate. 5 City Auditor's Office AUDIT OF ACCOUNTS PAYABLE I TYl DENTON The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Table of Contents ExecutiveSummary............................................................................................................................3 Introduction ......................................................................................................................................4 ManagementResponsibility.....................................................................................................................4 Audit Objectives, Scope, and Methodology..............................................................................................4 Glossaryof Terms......................................................................................................................................5 WhatWorks Well?.............................................................................................................................6 Obligation to Pay Procedures Ensure Purchasing Policy Compliance.......................................................6 Controls Over Payment Disbursements are Generally Adequate ............................................................8 Opportunities for Improvement.......................................................................................................10 Payment Procedures Should be Updated and Expanded.......................................................................10 Critical Purchasing System Access Needs to be Reviewed .....................................................................11 Duplicate Payment Controls Need Improvement...................................................................................13 Some Exempted Taxes Have Been Paid..................................................................................................14 Receiving Documentation Can be Improved..........................................................................................14 Some Check Requisition and Dispersal Practices are Inappropriate......................................................16 Staples Advantage Features are not Adequately Utilized ......................................................................18 Appendix A: Management Response Matrix.....................................................................................20 N v a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Executive Summary Honorable Mayor and City Council Members, We have completed a scheduled audit of Accounts Payable function. During fiscal year 2018, the City of Denton was invoiced for about $525 million from various suppliers and entities. The objective of this audit was to verify if the City has appropriately established controls over accounts payable in order to properly record and safeguard the spending of municipal funds. Overall, the controls over disbursements made by Accounts Payable were adequate and the audit did not identify any abuses of the system. However, some improvement in controls are necessary as described below: • Currently,Accounts Payable does not have a formal, written policy and procedures manual. A formalized policies and procedures manual helps ensure consistency in operations. In addition, it can act as a training tool during transition due to turnover. The current Materials Management and Payment Procedures Manual includes some written procedures, but they are not adequate for the Accounts Payable operation. • In today's heavily automated business environment, proper controls are necessary to ensure that employees can perform only authorized functions. Allowing employees to perform incompatible functions could lead to misuse. During this audit, we found that several employees had system access privileges in excess of necessity to perform their function. Due to the magnitude of resources processed through the account payable and purchasing functions, strengthening these controls is critical. • One of the accounts payable function's important controls is to ensure that the City only pays when: o The City has received the ordered quantity and appropriate quality of goods or services; and o The vendor has correctly billed for the quantity of goods or services at the agreed upon price. Generally,the above assurance is obtained by matching a purchase order, receiving document, and vendor bill before making a payment. This is a standard control mechanism used universally. We found that this control is not functioning because the City does not have an adequate process for verifying the receipt of goods or services. The City's practice of allowing employees to pick up checks for vendors compounds this risk. • The City is spending approximately $700,000 on the office supplies contract. Better controls are desired in this area. Currently, the employees can purchase items from the vendors website without the need for any approval.The vendors' website offers several items that can be used for personal consumption. Presently,the employee ordering the product may receive them from the vendor without anyone knowing. This situation can lead to abuses. This report recommends the implementation of control procedures. Management has concurred with 12 of 13 recommendations and partially concurred with the last. Management's response is attached to this report in Appendix A. We appreciate staff's cooperation during the audit. Please contact the City Auditor if you have any questions. Sincerely, m Umesh Dalal, City Auditor The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Introduction The City Internal Auditor is responsible for providing: (a) an independent appraisal of City operations to ensure policies and procedures are in place and complied with, inclusive of purchasing and contracting; (b) information that is accurate and reliable; (c) assurance that assets are properly recorded and safeguarded; (d) assurance that risks are identified and minimized; and (e) assurance that resources are used economically and efficiently and that the City's objectives are being achieved. The City Auditor's Office has completed a performance audit of the accounts payable process. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives.We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Management Responsibility City management is responsible for ensuring that resources are managed properly and used in compliance with laws and regulations; programs are achieving their objectives; and services are being provided efficiently, effectively, and economically. Audit Objectives, Scope, and Methodology This report is intended to provide assurance that the City has appropriately established controls over accounts payable in order to properly record and safeguard the spending of municipal funds. Audit fieldwork was conducted during May and June of 2019.The scope of review varied depending on the procedure being performed. The following list summarizes major procedures performed during this time: • Reviewed documentation to develop criteria including industry standards, best practices, policies, and procedures; • Developed a process narrative via staff interviews to identify current control activities, which was certified by the Controller, Assistant Controller, and Accounts Payable Supervisor; • Examined a sample' of 95 fiscal year 2018 payments to ensure that they were properly approved and verified; • Inspected a selection of 27 payment vouchers to calculate exempt tax payments; • Reviewed a targeted selection of 30 payment vouchers posted during fiscal year 2018 to ensure they were properly approved and verified; • Examined Staples Advantage expenses for the month of April 2019 and interviewed the City's Staples Strategic Account Manager; and lzzl- v • Inspected key user access reports for the City's financial system. a 'This sample size provides with 95%confidence that the true sample mean is within±10%of the sample estimate. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Glossary of Terms The following glossary of terms has been provided as reference material: ACH Payments are electronic payments made through the Automated Clearing House network. JD Edwards is the City's financial system and is utilized to track the City's financial transactions including purchases. Non-Purchase Order transactions typically involve the payment of non-commodity services such as a telephone or energy bill payment. These payments do not have a standard initiation, approval, or receiving process. Payment Disbursement process involves the processing and dispersal of checks and ACH payments. Payment Obligations or the obligation to pay is a contractual obligation of an organization to pay an amount owed to a supplier. Payment Requisitions are initiated by a department employee and approved by a supervisor at certain monetary levels— above $5,000 for checks and above $25,000 for ACH payments. AP staff require documentation of the receipt of goods or services typically via an invoice. Positive Pay is an automated fraud detection tool offered by most banks; simply it matches the account number, check number, and dollar amount of each check presented for payment against a list of checks previously authorized and issued by the company. Purchase Orders are initiated by a department employee in JDE via a requisition order (OR). This OR is then approved by an appropriate departmental supervisor and the Procurement Division before being converted into a purchase order (OP). An employee must then receive on this order in JDE before being vouched by AP. Refunds for utility customer service or the municipal court are typically initiated by a department employee and approved via reconciliation by a supervisor. These payments are automatically interfaced with JDE before being vouched by AP. Reimbursements & Advancements are initiated by a department employee and approved by a supervisor at all expenditure levels. These transactions typically involve the reimbursement of or payment advance to employees for travel and training expenses. Staff must submit receipts and other evidence of received goods or services in order to receive these payments. Three-Way Matching is an obligation to pay verification procedure that ensures the items ordered on a purchase order correspond to those received on a receiving document to those billed by the supplier on the invoice. In the City of Denton,this verification process is done automatically in the JD Edwards system. Vouchers are an internal document typically created by AP staff describing and authorizing the payment of a liability to a supplier. Wire Transfers are initiated by a department employee, approved by a supervisor, and reviewed by an appropriate Finance manager. These transactions typically involve the payment of employee benefits and are physically vouched by Treasury staff before being posted by AP. LI) v ao a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 What Works Well? During fiscal year 2018, the City of Denton was invoiced for about $525 million from various suppliers and entities.2 The City has centralized the responsibility for processing these payments within the Accounts Payable (AP) Division of the Finance Department; this process is summarized in Figure 1 below. The City's Materials Management and Payment Procedures Manual is available to guide the supplier procurement and payment process. Figure 1: Accounts Payable Payment Processing Steps Invoice Processing Collect Extract Validate Export ■ W/ Obligation to Pay Procedures Ensure Purchasing Policy Compliance Most simply, it is the function of an accounts payable division to verify an organization's obligation to pay suppliers and other entities that are owed money. In the City of Denton, this obligation to pay is verified in three ways: 1) automated three-way matching, 2) manual review by the Treasury Division, and 3) manual review by the Accounts Payable Division. Our findings are summarized in Table 1. The auditors found the following: Table 1: Obligation to Pay Verification Summary by Vouchers (FY 2018) Verification Procedure Est.Amount(Millions) Est.Vouchers Policy Compliance Three-Way Match $222.9 8,018 Adequate Manual Treasury $311.1 445 Adequate Manual AP $17.5 5,643 Adequate Refunds $0.4 Z376 Adequate Payment Req. $14.8 1,782 Adequate Reimb. &Adv. $1.8 1,118 Adequate Non-PO $0.5 297 N/A All: $551.5 14,106 N/A nA *Indicates level of compliance assurance with purchasing policies but does not indicate control effectiveness 2 This amount does not include purchases made via procurement card program,which is administered by the Procurement&Compliance Department,or payroll payments made to employees,which are processed by the Payroll Division of Finance. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Three-Way Match • Based on our sample,57%of payment vouchers were verified via a three-way match procedure in accordance with the Purchasing Manual. These vouchers amount to about 40% of all payments certified, or about$222.9 million. • The JD Edwards system requires departmental staff to enter a receiver on a purchase order created by the Purchasing Division as required by the Materials Management and Payment Procedures Manual. o AP staff then verify that the invoice and receiver match, that the invoice is accurate, and that the vendor address and name match before posting the voucher. Manual Treasury Review • Based on our sample, 3%of payment vouchers were verified manually by the Treasury Division as part of wire transfer procedures. These vouchers total to about 56% of all payments certified, or about$311.1 million. • Treasury staff have developed a standardized wire transfer request form that requires appropriate supervisor approval based on transaction value. o Current procedures require Controller approval for transactions less than $50,000, Assistant Finance Director approval between $50,000 and $100,000, and Finance Director approval above$100,000. o Payment procedures require that all wire transfers greater than $25,000 be approved by the Director of Finance and all transfers less than that be approved by the Controller. While current procedures do not comply with purchasing policy, these controls are adequate; policies should be updated to reflect current procedures. Manual AP Review • Based on our sample, 40% of payment vouchers were verified manually by Accounts Payable. These vouchers total to about 3%of all payments certified, or about$17.5 million. o These vouchers included: refunds, payment requisitions, reimbursements&advances to employees, and non-purchase order invoices and statements. • Refunds (42%of manual AP vouchers) are submitted weekly to Accounts Payable via a system interface with JD Edwards. o Customer Service identifies refunds on closed customer accounts weekly; for active accounts, customers may request a refund once their credit is greater than two average monthly bills. Once refunds are identified, a Customer Service supervisor verifies their accuracy before forwarding the requests to Accounts Payable. o Municipal Court refunds are identified weekly based on Docket Clerk documentation. A Municipal Court supervisor verifies the accuracy of these refunds before forwarding the requests to Accounts Payable. o AP staff then verify the refund recipient's name, address, and refund amount before posting the voucher. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 • Standardized check (30% of manual AP vouchers) and ACH requisition (3% of manual AP vouchers) forms have been developed and are required to be completed for a payment requisition to be processed. o Current Accounts Payable procedures ensure that a check requisition for more than $5,000 is approved by a department director,ACH requisitions for more than $25,000 are approved by a department director, and that there is some evidence of receipt such as an invoice. o Purchasing policy only requires check requisitions to be approved above $5,000; however, check requisitions for reimbursable employee expenses is prohibited. Current practices exceed the requirements of the purchasing policy and thus should be updated. • Employees must submit the appropriate form in order to be reimbursed or paid in advance for business related expenses. o To receive a travel advance(8%of manual AP vouchers),the online travel authorization form must be approved, and an approved travel advance form must be filled out and submitted to AP. Employees are required to justify these expenses after their travel is complete within 20 working days. o Current Accounts Payable procedures require proof of received goods or services and supervisory approval in order to be reimbursed (13% of manual AP vouchers) such as receipts, conference, brochures, mapped directions for mileage,etc. In addition,travel must have been preapproved using the online travel authorization form. The City allows for either per diem or receipted meals to be reimbursed. • A small number of invoices and statements are paid by Accounts Payable staff without formal approval or receipt documentation (5% of manual AP vouchers). These payments are not addressed in the Procurement Manual. Controls Over Payment Disbursements are Generally Adequate While Accounts Payable is responsible for verifying the obligation to pay, best practices suggest segregating the duties of this responsibility, authorizing the payments being made, and reconciling payments to the bank statement. Periodically, organizations initiate payment authorization via the payment disbursement process, which generally includes three stages: 1) Preparations of payment information to be forwarded to suppliers (checks) or the City's bank(ACH); 2) Review of prepared payment information; and 3) Dispersal of payments to suppliers. The auditors found the following: • Weekly, Accounts Payable staff initiate the disbursement process. All vouchers posted during 00 the week are summarized and reconciled to ensure that payments are processed correctly. Q a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 o Access to JD Edwards'Accounts Payable functions is restricted via user security groups that are managed by Technology Services. ■ We identified one City employee with unauthorized AP access;this access has since been removed. This being said, there is no way in the system to verify that these functions were not used by the unauthorized employee.Adequate compensating controls exist. • Check printing is then overseen by the City's Reprographics and Accounting staff and the ACH payment files are prepared by the Controller's office. o Check stock is adequately secured, and signatures are maintained by the City's Technology Services Department. A check log is maintained by the Reprographics Division and certified by Accounting staff after each check run. • Accounting staff reverifies the obligation to pay for checks issued for more than $5,000 after printing and the Controller's office spot checks ACH and check payment files. • ACH payments and the check positive pay files are uploaded to the bank's website by the Controller's office. o The bank verifies the integrity of these files and notifies the City that they have been received and are being processed.Any checks attempted to be negotiated that are not verified to the positive pay file are reviewed by the Accounts Payable Supervisor before payment or denial. ACH payment files include the invoice numbers being paid. If an ACH payment cannot be routed,the City is notified by the bank. G) r a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Opportunities for Improvement As discussed previously, many controls exist to ensure that the City is only making appropriate payments.This being said,our office has identified some areas where strengthening controls could mitigate remaining risk. Payment Procedures Should be Updated and Expanded According to best practices, every organization should have a policies and procedures manual for their Accounts Payable function. What We Found? • Accounts Payable has developed some written payment process information that is included in the City's Materials Management and Payment Procedures Manual.These procedures cover the following information: o Review and approval of check requisitions; o Purchase order three-way matching processes; o Travel advances and expenses approval and reporting; o Refund processing; petty cash reconciliation; o Check processing schedule and emergency check run requests; o Wire payment requests and approvals; and o Retention policies for payment supporting documentation. • Not all payment procedures within the Materials Management and Payment Procedures Manual appear to be up-to-date based on current practices as determined during conversations with AP staff. Why Does It Matter? A formalized policies and procedures manual helps an organization retain institutional knowledge, navigate emergency situations, and facilitate consistency. While the Materials Management and Payment Procedures Manual does include some written procedures information, it is generally aimed towards departments—meaning not all information relevant to Accounts Payable is covered. In addition, if the manual is not updated regularly, it may not reflect current procedures and practices—essentially becoming obsolete. Recommendation: 1. Update and formalize an accounts payable policies and procedures manual. Current procedures documentation can be utilized in this effort. Policies and procedures manuals should be reviewed annually and updated if necessary. Q Finance Comments: The process to update policies and procedures is under way. Staff has o received examples from multiple cities utilizing the some financial software. These examples The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 will assist in drafting changes to the policies and procedures manual. We want to ensure comprehensive policies are appropriately formal and cover all aspects of Accounts Payable practices and procedures. Critical Purchasing System Access Needs to be Reviewed The Government Accountability Office's Standards for Internal Control in the Federal Government states that "management should consider the need to separate control activities related to authority, custody, and accounting of operations to achieve adequate segregation of duties." Ideally, this means that the following duties should be performed by different functions: • Procurement Requisition/Approval • Goods Receipt • Purchase Order Issuance • Accounts Payable/Payment Disbursement What We Found? Critical purchasing system access within JD Edwards is restricted or granted through a series of security groups.All JD Edwards users are granted access to enter a requisition and a receiver unless this access is specifically removed through a security group. We reviewed the access of six users in a JD Edwards test environment created by Technology Services to better understand the access restricted and granted by the eight applicable purchasing security groups.'The results are divided up by function below: Approvers • The GENAPPROV security group restricts the user from creating a requisition and grants the ability to approve a requisition. No Accounts Payable or Warehouse employees are in this group and two Procurement supervisors are in this group. Accounts Payable • The ACCTPAY security group grants users access to Accounts Payable functions; however, it does not restrict a user's ability to add requisitions or receipts. • The ACCTPAYSV security group grants additional access to modify refund recipients' addresses and indicate which suppliers should receive a 1099 —this group does not restrict the user's ability to add requisition and receipts. Warehouse • The WAREHOUSE security group grants users access to Warehouse requisition and receiving functions and appears to be generally appropriate. • The WAREHOSUPV security group appears to restrict the user from creating receipts, but instead grants the user access to reverse receipts. a� 00 3 JDE security groups applicable to purchasing controls include:1)GE NAP PROV,2)ACCTPAY,3)ACCTPAYSV,4)WAREHOUSE,S)WAREHOSUPV, 6)PURCHASST,7)PURCH,and 8)PURCHSUPR. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Procurement • The PURCH & PURCHASST security groups grant users access to create & modify purchase orders, convert requisitions to purchase orders, and to modify the supplier master. • The PURCHASST security group restricts the user's ability to add a receipt; however,this ability is not restricted for the PURCH group and neither group restricts a user's ability to enter a requisition. • The PUCHSUPR security group appears to restrict the user from creating receipts, but instead grants the user access to reverse receipts. In addition, this group appears to remove the users access to create a purchase order; however, it allows the user to modify a purchase order and convert requisitions to purchase orders. Why Does It Matter? Allowing employees to perform incompatible duties within the system increases the risk of fraud, waste, and abuse. For example, it appears that under the current circumstances, it is potentially possible for a procurement employee to create a fake supplier, enter a purchase order for this supplier, and receive on this purchase. Once this is completed, the employee could create a fake invoice in order to receive payment, which is possible with available software. In addition to the above weakness, at least two individuals appear to be "superusers," which may grant them even greater access to incompatible duties. If this access is abused, it may not be detected in a timely manner. Recommendations: 2. Finance and Procurement need to ensure that Accounts Payable and Procurement staff do not have incompatible system access. Particularly,these functions should not be able to requisition orders, receive purchases, and make changes to supplier master if they can issue purchase orders or disburse payments. Finance Comments: Tech Services has now restricted the Accounts Payable Staffs ability to add purchase order requisitions and enter receipts. Purchasing Comments: Tech Services is working to create more restrictive user groups for Procurement Staffs system access to differentiate between the users who approve requisitions and the users who have access to the supplier master file. N v a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Duplicate Payment Controls Need Improvement As mentioned previously, the primary purpose of an Accounts Payable function is to verify the organization's obligation to pay. Ensuring that payments are not being made twice is an essential step in this verification process. While most invoices have unique numbers, some reoccurring payments use the same invoice number, requiring staff to create a unique number. What We Found? • The JD Edwards system contains a standard duplicate payment report that may be run by Accounts Payable staff. This report identifies payments made to a supplier with the same invoice number and transaction amount. o Accounts Payable does not have a formalized invoice numbering policy. • Accounts Payable does not have a procedure for verifying that submitted invoices have not been paid with a procurement card. o According to staff, this is because they do not have access to procurement card transaction information as this program is managed by the Procurement&Compliance Department. Why Does It Matter? Currently,Accounts Payable staff must rely on employees to notify them if an invoice has been paid via p-card. Additionally, without a standardized invoice numbering guideline, Accounts Payable staff run the risk of paying an invoice twice by entering slightly different invoice numbers. The risk of duplicating payments should be minimized in order to avoid inappropriate and unnecessary expenditures. Recommendations: 3. Include a standard invoice numbering guideline within the policies and procedures manual. This policy should promote consistency and decrease the risk of duplicate payments. Finance Comments: The standard invoice numbering practice will be incorporated into the updated Policy Manual. 4. Consider developing a procedure to verify that certain invoices have not already been paid on a procurement card. Finance Comments: Staff has been exploring ways to compare invoices paid by p-cards to invoices processed thru the Accounts Payable system. The only common data between the two systems is the date of transaction and the amount. The P-card system does not use the Vendor Master numbering system and the transaction number on the receipt is not in the JDE system. We are currently installing a new travel and p-card software which should enhance shared between the two systems to find data points that we can be used to search for duplicate transactions. Ultimately, the payments are from separate systems and staff will implement all procedures policy to mitigate the risk. m rl v ao a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Some Exempted Taxes Have Been Paid According to the Texas Administrative Code Section 3.322, the purchase, lease, or rental of a taxable item is always exempt from taxes when made by"any county, city,special district or other political subdivision of the State of Texas, and any college or university created or authorized by the State of Texas." What We Found? • As part of a targeted review, we identified about $1,300 disbursed during fiscal year 2018 to pay sales taxes from which the City is exempt. It should be noted that the reviewed payments do not represent all payments made to these suppliers and so are most likely are not the total exempt tax payments made by the City. o These sales tax payments were not detected by Accounts Payable or Accounting staff. • City staff have begun seeking reimbursement for these tax payments and have received about $6,700. Additional reimbursement of at least$8,000 is expected. Why Does It Matter? Under Texas state law, municipal governments are exempt from paying sales and use taxes. While the City is typically mindful of this exemption,at least$1,300 was disbursed inappropriately despite staff review. In the future, a process should be established to ensure these billing issues are detected by Finance staff. Recommendations: 5. Establish a process to ensure the City is not paying any taxes for which it is exempt. Finance Comments:Accounting staff is consistently being reminded to check for sales taxes being billed on vendor invoices while reviewing the Accounts Payable check run. Also, Accounts Payable staff has the responsibility to reduce any sales tax charges and file the proper paper work with the vendor to exempt any future sales tax charges. These practices will be incorporated into the updated Policy and Procedures Manual. Receiving Documentation Can be Improved As mentioned previously, most of the City's purchases (about 57% or $222.9 million) utilize the three-way match system control in JD Edwards.4 Typically, this system requires the quantities and amounts ordered on the purchase order to match the quantities received on the receiving document and the amount charged on the invoice; this is illustrated in Table 2. tao a� 4 28%of payments have controls to adequately assure payments are made appropriately;controls over the remaining 15%are addressed in the remaining sections of this report. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Table 2:Three-Way Match Control Summary Document Type Quantities Amount Purchase Order Yes Yes Receiving Document Yes Invoice Yes While the City's current three-way match procedures provide some assurance of receipt,we found the following weaknesses: What We Found? • Within each department, the receiving process is generally centralized with an Administrative Assistant; however, all JD Edwards users can create electronic receiving documents in the system. • JD Edwards three-way match control is currently setup to require lump sum, dollar amount receiver information, which may force employees to wait until the invoice is obtained to complete receiving information. Completing receiving documentation based on an invoice hinders a true three-way match control measure and does not provide adequate assurance of the obligation to pay. • While some departments are uploading adequate receiving documents in JD Edwards, this information is not consistently provided to or reviewed by Accounts Payable staff. o For instance, Warehouse staff attach a text document with the quantities received for each line item on a purchase order. On the other hand, Technology Services stamps invoices as "received" and signs and dates the stamp;these certified invoices are then forwarded to Accounts Payable. Why Does It Matter? The three-way match is one of the strongest payment controls as it provides assurance that the organization is paying the price agreed upon and receiving the desired quantities and specifications of the items ordered. While an electronic receiving document provides some assurance that the goods ordered were delivered, lump sum matching bypasses the quantity verification process.This requirement potentially limits the control to a two-way match if an invoice must be used to enter the receiver,which is inadequate.Additionally,the centralization of receiver entry—despite system flexibility—increases the risk that goods or services will be paid for before being received or despite potential quality issues, especially when using an invoice as the receiver. According to staff,the City began using lump sum matching due to difficulties with supplier quantity conventions(e.g.the City ordered 3 cases of paint, but the packing slip lists 15 cans of paint).While it may slow down the payment process, the City could require departments to use the supplier's quantity conventions or require the supplier to use the quantity conventions as described on the purchase order to provide adequate assurance that all goods ordered were received. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Recommendations: 6. Require employees to enter adequate receiving documentation for all goods and services. Particularly, the City should require staff to verify the quantities of goods, or potentially even services, received by departments. Finance Comments: As part of the update to the Accounts Payable Policy and Procedures manual, we will require the department personnel to upload an image of the receiving or shipping document with the invoice as a reference for City staff when processing payments to the vendor. 7. Consider requiring the employee who physically receives goods or services to enter the receiving document in JD Edwards via policy. In order to implement this policy, additional training or procedures material may need to be made available. Finance Comments:Agree.As part of the update to the Accounts Payable Policy and Procedures manual, we will require the department personnel to upload an image of the receiving or shipping document with the invoice as a reference for City staff when processing payments to the vendor. Some Check Requisition and Dispersal Practices are Inappropriate Minimizing the number of checks an organization issues will reduce costs related to check printing, mailing, and processing. Additionally, the implementation of several security controls over the storage and dispersal of checks minimizes the risks associated with check fraud or abuse, such as theft,forgery, or misappropriation. What We Found? • The City of Denton printed a little over 9,900 checks — about 70% of payment transactions— during fiscal year 2018.These checks are summarized by verification type in Table 3 below: Table 3: Check Payments by Verification Type (FY 2018) Verification Procedure Est.Amount(Millions) Est.Vouchers Controls Three-Way Match $73.0 5,102 Some Manual AP $1.1 4,827 Some Refunds $0.2 Z206 Adequate Payment Req. $0.7 1,379 Some Reimb. &Adv. $0.1 965 Adequate Non-PO $0.2 276 Some All: $74.2 9,929 N/A • As mentioned previously, check stock controls are generally adequate; however, some check requisitions and dispersals practices should be prohibited, namely: o Check requisitions under $5,000 do not require approval by a supervisor; while Accounts Payable typically requires an invoice from an authorized vendor to post a QO voucher,these controls do not adequately compensate for a deficiency in supervisory r_� controls, which may allow it to be abused. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 o Accounts Payable practices allow suppliers' checks to be collected and hand delivered by an employee to a vendor. Why Does It Matter? Supervisory review and approval are the most critical control over employee purchases as supervisors are able to review requisitions to verify that a legitimate business purpose exists. Conversely, reviews by Purchasing or Accounts Payable are intended to ensure compliance with state and federal regulations and City policies. In addition, allowing employees to collect checks for vendors increases the opportunity for fraud— especially given some areas of relatively weak supervisory control. In the current process, a City employee may set up a vendor account by completing a W-9 form. If this vendor account is used to process an invoice under 5,000, the current process may allow issuing a check because the supervisory controls are weak.The controls are further compromised due to employees'collection of checks. While a check log is maintained it does not necessarily protect against fraudulent invoice payment or individuals taking advantage of check cashing establishments that do not require identification. Fraud using this method is very common and the City must have proper safeguards to prevent it. Recommendations: 8. Require check requisitions under$5,000 to be approved by a supervisor. Finance Comments: We will distribute new forms requiring the Supervisor or Manager of the person submitting the check requisition to approve the under $5,000 purchase. Directors already are required to approve any check Requisition over$5,000. 9. Restrict physical collection of checks. Physical collection of checks should be minimized, and any allowable exceptions should be formalized via policy. Finance Comments:All Vendor checks will be mailed in the future. We will inform our vendors and City staff that we will no longer release check payments. We will encourage our vendors to choose ACH payments as an alternative. Exceptions to this policy will be allowed on a case by case basis. 10. Encourage the use of electronic payments instead of paper checks where possible. Finance Comments: Agree. The Procurement Office is responsible for setting up the Vendor Masters, including the method of payment the Vendor chooses. We also follow up with reviews of vendor payment registers to look for and request vendors to setup ACH Payments to eliminate the need for paper checks. The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Staples Advantage Features are not Adequately Utilized The City of Denton's Materials Management and Payment Procedures Manual allows employees to order office supplies online through the Staples Advantage website. What We Found? Supervisory Controls • In order to obtain access to the Staples Advantage website, an employee must complete and submit a user request form and be approved by Procurement&Compliance Department staff. o The City currently has 176 active Staples Advantage users.32 of these users have never logged on to the Staples Advantage website; an additional 39 users had not ordered an item since January 2018. • Once access has been obtained, employees may order items from the Staples Advantage website. This website offers several items that can be personally consumed by individuals. Documented approval of purchases is not required, and maximum spending levels are not set. Additionally,while employees do receive a packing slip, it is often not signed. Billing Process Efficiency • In addition, the City is currently billed for Staples Advantage purchases each time items on an order are delivered. This means that if three items were ordered, but were delivered on two separate days,the City would receive two invoices for the same order. o During April 2019, the City received 347 unique invoices. Some individuals received multiple invoices on the same day — about 36% of invoices received fell into this category. o During fiscal year 2018 the City received just over 2,800 unique Staples invoices.These composed about 6% of annual accounts payable vouchers, but the Staples payments represented only 0.1%of the total amount disbursed during the year. Why Does It Matter? Supervisory Controls During the month of April 2019, we did not find significant evidence of abuse of these control deficiencies; however, without increased supervisory control, employees could easily order items for personal use without being discovered. In addition, we identified several opportunities for potential cost savings. For example, eleven keyboards were purchased: the cheapest cost$23 while the most expensive cot $76—a different of almost $50. While these amounts may seem small, the City has a duty to be good stewards of the public's money. Without supervisory controls, employees may not use cost effective purchasing practices. According to the City's Staples' Account Manager, the Staples Advantage website offers approval 000 functionality that could be utilized with increased participation. In addition, the City currently has The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 several other methods of procurement (e.g. the purchase order process and procurement cards) that could be used to increase supervisory controls. Billing Process Efficiency According to the City's Staples'Account Manager,Staples Advantage offers several different billing methods that could decrease the number of invoices received by Accounts Payable — potentially increasing their efficiency. Exploring the above options will increase efficiency in Accounts Payable function. Recommendations: 11. Develop a process to ensure Staples Advantage purchases are properly approved and received. Finance Comments:All Staples invoices should include a PO number so that the purchases are authorized by department management and we can process the payment using the Accounts Payable system to match the PO and receiver against the invoice amount. We are anticipating adding software that will automate the processing of invoices received from our vendors. Using PO number on the Staples purchases will leverage the automation and speed the process of paying all of our vendor invoices including Staples. 12. Annually review Staples Advantage users to verify that access is still appropriate. Finance Comments: We agree that an annual review of city staff access to order from Staples should be performed to maintain the proper access of personnel and will be incorporated into the updated Policy and Procedures Manual. Purchasing Comments: The control of access to the Staples Advantage is with the Procurement Office. The Purchasing Office will request a user list from Staples annually or however frequently, as needed. Purchasing will send the list out to the departments to verify the users and then ask Staples to make the requested changes. 13. Consider changing current Staples Advantage billing practices to improve efficiency in the Accounts Payable Division. Finance Comments: We are anticipating adding software that will automate the processing of invoices received from our vendors. This will speed the process of paying all of our vendor invoices including Staples. Having a PO number on the invoice is key to the automation process. We will change our procedures to effectively leverage the ability of the software to scan and voucher a vendor's invoice to make the payment process more efficient. Purchasing Comments: We do not have the ability to change Staples' billing practices or procedures. We can limit the number of City staff that have access to order from Staples and agree that this should be reviewed annually to ensure the proper employees have access. Ol The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Appendix A: Management Response Matrix The following summarizes the recommendations issued throughout this report. The auditors found that staff were receptive and willing to make improvements to controls where needed. Management's responses to each recommendation is summarized below: Expected 1 Update and formalize an accounts payable policies and Concur Completion: procedures manual. December of 2019 Finance Comments: The process to update policies and procedures is under way. Staff Responsibility: has received examples from multiple cities utilizing the same financial software. These Melanie examples will assist in drafting changes to the policies and procedures manual. We want Beard, Brian to ensure comprehensive policies are appropriately formal and cover all aspects of Hogan, and Accounts Payable practices and procedures. Harvey Jarvis Finance and Procurement need to ensure that Accounts Expected 2 Payable and Procurement staff do not have incompatible Concur Completion: system access. Completed Finance Comments:Tech Services has now restricted the Accounts Payable Staff's ability Responsibility: to add purchase order requisitions and enter receipts. Jim Barnes, Harvey Jarvis Purchasing Comments: Tech Services is working to create more restrictive user groups for Procurement Staff's system access to differentiate between the users who approve requisitions and the users who have access to the supplier master file. Expected Include a standard invoice numbering guideline within the Completion: 3 policies and procedures manual. Concur December of 2019 Finance Comments: The standard invoice numbering practice will be incorporated into Responsibility: the updated Policy Manual. Melanie Beard, Brian Hogan, and Harvey Jarvis Consider developing a procedure to verify that certain invoices Expected 4 Concur Completion: have not already been paid on a procurement card. Unknown Finance Comments: Staff has been exploring ways to compare invoices paid by p-cards Responsibility: to invoices processed thru the Accounts Payable system.The only common data between Brian Hogan the two systems is the date of the transaction and the amount. The P-card system does and Harvey not use the Vendor Master numbering system and the transaction number on the receipt Jarvis is not in the JDE system. We are currently installing a new travel and p-card software which should enhance shared between the two systems to find data points that we can use to search for duplicate transactions. Ultimately, the payments are from separate systems and staff will implement all procedures policy to mitigate the risk. 0 N v a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Expected 5 Establish a process to ensure the City is not paying any taxes Concur Completion: for which it is exempt. December of 2019 Finance Comments: Accounting staff is consistently being reminded to check for sales Responsibility: taxes being billed on vendor invoices while reviewing the Accounts Payable check run. Melanie Also, Accounts Payable staff has the responsibility to reduce any sales tax charges and Beard, Brian file the proper paper work with the vendor to exempt any future sales tax charges.These Hogan and practices will be incorporated into the update Policy and Procedures Manual. Harvey Jarvis Expected Require employees to enter adequate receiving documentation Completion: 6 for all goods and services. Concur September of 2019 Finance Comments:As part of the update to the Accounts Payable Policy and Procedures Responsibility: manual, we will require the department personnel to upload an image of the receiving Department or shipping document with the invoice as a reverence for City staff when processing personnel and payments to the vendor. the Accounts Payable staff Consider requiring the employee who physically receives goods Expected 7 or services to enter the receiving document in JD Edwards via Concur Completion: policy. September of 2019 Finance Comments: Agree. As part of the update to the Accounts Payable Policy and Responsibility: Procedures manual,we will require the department personnel to upload an image of the Department receiving or shipping document with the invoice as a reference for City staff when personnel and processing payments to the vendor. the Accounts Payable staff Expected 8 Require check requisitions under $5,000 to be approved by a Concur Completion: supervisor. September 30, 2019 Finance Comments:We will distribute new forms requiring the Supervisor or Manager of Responsibility: the person submitting the check requisition to approve the under $5,000 purchase. Melanie Directors already are required to approve any check requisition overt$5,000. Beard and Brian Hogan Expected 9 Restrict physical collection of checks. Concur Completion: September 30, 2019 Finance Comments: All Vendor checks will be mailed in the future. We will inform our Responsibility: vendors and City staff that we will no longer release check payments. We will encourage Melanie our vendors to choose ACH payments as an alternative. Exceptions to this policy will be Beard and allowed on a case by case basis. Harvey Jarvis Encourage the use of electronic payments instead of paper Expected 10 Concur checks where possible. Completion: N ao a The City of Denton Internal Audit Report Audit of Accounts Payable October 2019 Already being done Finance Comments: Agree. The Procurement Office is responsible for setting up the Responsibility: Vendor Masters, including the method of payment the Vendor chooses. We also follow Melanie up with reviews of vendor payment registers to look for and request vendors to setup Beard and ACH Payments to eliminate the need for paper checks. Harvey Jarvis 11 Develop a process to ensure Staples Advantage purchases are Concur Expected properly approved and received. Completion: Finance Comments: All Staples invoices should include a PO number so that the Responsibility: purchases are authorized by department management and we can process the payment Melanie using the Accounts Payable system to match the PO and receiver match against the Beard, Brian invoice amount. We are anticipating adding software that will automate the processing Hogan and of invoices received from our vendors. Using PO number on the Staples purchases will Harvey Jarvis leverage the automation and speed the process of paying al of our vendor invoices including Staples. Expected 12 Annually review Staples Advantage users to verify that access Concur Completion: is still appropriate. December of 2019 Purchasing Comments: The control of access to the Staples Advantage is with the Responsibility: Procurement Office. The Purchasing Office will request a user list from Staples annually Melanie or however frequently, as needed. Purchasing will send the list out to the departments Beard and to verify the users and the ask Staples to make the requested changes. Brian Hogan Finance Comments: We agree that an annual review of city staff access to order from Staples should be performed to maintain the proper access of personnel and will be incorporated into the updated Policy and Procedures Manual. Consider changing current Staples Advantage billing practices Expected 13 Partially Concur Completion: to improve efficiency in the Accounts Payable Division. June of 2020 Finance Comments: We are anticipating adding software that will automate the Responsibility: processing of invoices received from our vendors. This will speed the process of paying Melanie all of our vendor invoices including Staples. Having a PO number on the invoice is key to Beard, Brian the automation process.We will change our procedures to effectively leverage the ability Hogan and of the software to scan and voucher a vendor's invoice to make to payment process more Harvey Jarvis efficient. Purchasing Comments: We do not have the Ability to change Staples' billing practices or procedures.We can limit the number of City staff that have access to order from Staples and agree that this should be reviewed annually to ensure the proper employees have access. N N v a