2. Follow-Up Review of Accounts Payable Audit (Mar. 2021) ABSTRACT
Improvements have been made to further ensure City
purchases of around $510 million are appropriately
supported and approved. Plans to further automate
�p accounts payable processes should provide additional
�IN �,C 000 ODE assurance that payments are not duplicated.
Internal Audit Department
City Auditor
` Madison Rorschach, CIA, CGAP
Audit Staff
AUDIT OF ACCOUNTS Amber Jackson, CFE, MBA
PAYABLE
Follow-Up Report
(I T},
11
DENTON
Project#: 007
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Table of Contents
Follow-Up at a Glance..........................................................................................................................3
Introduction.........................................................................................................................................4
ManagementResponsibility.....................................................................................................................4
Audit Objectives, Scope, and Methodology..............................................................................................4
Recommendation Status Update .........................................................................................................5
Payment Procedures Should be Updated and Expanded.........................................................................5
Critical Purchasing System Access Needs to be Reviewed .......................................................................5
Duplicate Payment Controls Need Improvement.....................................................................................6
Some Exempted Taxes Have Been Paid....................................................................................................7
Receiving Documentation Can be Improved ............................................................................................8
Some Check Requisition and Dispersal Practices are Inappropriate........................................................8
Staples Advantage Features are not Adequately Utilized ......................................................................10
N
v
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Follow-Up at a Glance
Why we did this Follow-Up:
This report is intended to provide information on what changes have been made in response to the
Accounts Payable Audit issued in October 2019. The original audit evaluated the effectiveness of
controls over accounts payable in order to properly record and safeguard the spending of municipal
funds. This follow-up is included on the City's Fiscal Year 2020-21 Audit Plan as approved by the City
Council.
What we Found:
A newly adopted Cash Disbursements Policy has provided additional guidance to Accounts Payable and
department staff including formalizing standards for receiving documentation and improving controls
overthe processing of checks. In addition,Accounts Payable has begun automating invoice and payment
request processing, which should help reduce the risk of duplicate payments. Finally, the City has
generally begun requiring supervisor approval for all Staples purchases; however, additional oversight
should further minimize the risk of inappropriate purchases. The status of each recommendation is
summarized below:
Recommendation Mgmt. Response Status
1. Formalize an AP policies & procedures manual. Concur Implemented
2. Ensure AP & Purchasing Staff don't have incompatible
Concur In Progress
system access.
3. Include standard invoice numbering guideline in
policies & procedures manual. Concur In Progress
4. Consider developing a procedure to verify invoices
weren't paid via p-card. Concur In Progress
5. Establish process to ensure the City isn't paying
Concur Implemented
exempt taxes.
6. Require employees to enter adequate receiving
documentation for all goods &services. Concur Implemented
7. Consider requiring employees who physically receive Concur Implemented
goods &services to enter receiving documentation.
8. Require check requisitions under$5,000 to be
Concur Implemented
approved.
9. Restrict physical collection of checks. Concur Implemented
10. Encourage use of electronic payments. Concur In Progress
11. Ensure Staples purchases are approved & received. Concur In Progress
12. Annually review Staples users to verify access. Concur In Progress
13. Consider changing Staples billing practices to improve Partially Concur Implemented
efficiency in the AP Division.
IO CITY
DENTON
Audit report translations may be requested by emailing InternalAudit@CityofDenton.com.
Introduction
The Internal Audit Department is responsible for providing: (a) an independent appraisal' of City
operations to ensure policies and procedures are in place and complied with, inclusive of
purchasing and contracting; (b) information that is accurate and reliable; (c) assurance that assets
are properly recorded and safeguarded; (d) assurance that risks are identified and minimized; and
(e) assurance that resources are used economically and efficiently and that the City's objectives
are being achieved.
The Internal Audit Department has completed a follow-up review of the Accounts Payable Audit
issued in October 2019. We conducted this performance audit in accordance with generally
accepted government auditing standards. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objectives.
Management Responsibility
City management is responsible for ensuring that resources are managed properly and used in
compliance with laws and regulations; programs are achieving their objectives; and services are
being provided efficiently, effectively, and economically.
Audit Objectives, Scope, and Methodology
This report is intended to provide a progress update on recommendations from the
Payable Audit(October 2019),which evaluated the effectiveness of controls over accounts payable
in order to properly record and safeguard the spending of municipal funds.
Audit fieldwork was conducted during February and March 2021. The scope of review varied
depending on the procedure being performed.The following list summarizes the major procedures
performed:
• Reviewed documentation from the issued audit to develop criteria including industry
standards, best practices, policies, and procedures;
• Evaluated the City of Denton's Cash Disbursements policy approved on January 26, 2021;
• Analyzed payments and vouchers issued during calendar year 2020;
• Examined supporting documentation for a randomly selected statistical sample of 95
payments issued during calendar year 2020;
• Inspected user access reports for the City's Staples Advantage and JD Edwards systems; and
• Interviewed City staff from the Accounts Payable Division and the Finance, Procurement &
Compliance, and Technology Services Departments.
'The City of Denton Internal Auditor's Office is considered structurally independent as defined by generally accepted government auditing
standard 3.56.
2 This sample provides with 95%confidence that the true population is±10%of the sample estimate.
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Recommendation Status Update
This report summarizes the Audit of Accounts Payable recommendations, management responses, and the
Internal Audit Department's follow-up findings, which describe to what extent City management has
implemented Internal Audit's recommendations since the publication of the original report(October 2019).
Most simply, it is the function of an accounts payable division to verify an organization's obligation to pay
suppliers and other entities that are owed money by an organization. In the City of Denton, this obligation
to pay is verified in three ways: 1) automated three-way matching, 2) manual review by the Treasury
Division, and 3) manual review by the Accounts Payable Division.
Table 1: Obligation to Pay Verification Summary (CY2020)
Verification Procedure No.of Payments Est. Payment Amount
(Millions)
Three-Way Match 6,760 $153.7
Manual Treasury 699 $354.1
Manual AP 3,613 $3.1
Refunds Z331 $0.3
Payment Requests 932 $2.4
Reimbursements 117 $0.0
Other 233 $0.3
All: 11,072 $510.9
Payment Procedures Should be Updated and Expanded
1. Update and formalize an accounts payable policies and procedures manual.
Management Response: Concur
Finance Comments: The process to update policies and procedures is under way. Staff has received
examples from multiple cities utilizing the same financial software. These examples will assist in
drafting changes to the policies and procedures manual. We want to ensure comprehensive policies
are appropriately formal and cover all aspects of Accounts Payable practices and procedures.
Audit Follow-Up Finding: Implemented
The City Council adopted a new Cash Disbursements policy on January 26, 2021 via ordinance. This
policy includes roles and responsibilities for Accounts Payable, Procurement, and departments
making and approving purchases with regards to the payment process.
Critical Purchasing System Access Needs to be Reviewed
2. Finance and Procurement need to ensure that Accounts Payable and Procurement staff do
not have incompatible system access.
Management Response: Concur
Finance Comments: Tech Services has now restricted the Accounts Payable Staffs ability to add
purchase order requisitions and enter receipts.
Purchasing Comments: Tech Services is working to create more restrictive user groups for Lr)
Procurement Staff's system access to differentiate between the users who approve requisitions and
the users who have access to the supplier master file.
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Audit Follow-Up Finding: In Progress
Currently, there are seven security groups in the City's financial system involved in the vendor
payment process as shown below:'
Table 2: Financial System Payment Process Security Groups
Accounts Payable Purchasing Warehouse
ACCTPAY PURCHASST WAREHOUSE
ACCTPAYSV PURCH WAREHOSUPV
PURCHSUPR
These security groups restrict access within the City's financial system so that users only have access
to the functions needed to perform their duties. Ideally, duties within the purchase process should
be segregated to minimize the risk of abuse.These duties include:
• Procurement Requisition/Approval • Receipt of Goods
• Purchase Order Issuance • Accounts Payable/Payment Disbursement
Based on a review of changes made to these security groups, some access has been restricted to
ensure users do not have incompatible system access. In particular, Accounts Payable
representatives are no longer able to enter procurement requisitions. That being said, the following
inappropriate actions still appear possible:
• Accounts Payable staff (i.e. ACCTPAY and ACCTPAYSV groups) appear to be able to enter
receipts for goods;
• Purchasing staff (i.e. PURCHASST and PURCH groups) appear to be able to create
procurement requisitions; and
• Some Purchasing staff(i.e. PURCH group) appear to be able to enter receipts for goods.
In addition,the number of superusers—or those users in more than one security group—appears to
have increased for the Warehouse function. This may grant these users even greater access to
incompatible duties. If this access is abused, it may not be detected in a timely manner.
Duplicate Payment Controls Need Improvement
3. Include a standard invoice numbering guideline within the policies and procedures manual.
Management Response: Concur
Finance Comments: The standard invoice numbering practice will be incorporated into the updated
Policy Manual.
Audit Follow-Up Finding: In Progress
The new Cash Disbursements policy, implemented in January 2021, does not include a standard
invoice numbering guideline; however, the Finance Department plans to address this issue once a
fully automated Accounts Payable software is implemented. Q
3 City departments must work with the Technology Services Department in order to make changes to security groups in the City's financial
system.
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
That being said, the City has begun using a semi-automated accounts payable processing system.
Through this system, department staff submit invoices for payment to a cloud-based application for
Accounts Payable representatives to process. This system includes a duplicate invoice verification
procedure that automatically determines if the invoice has been entered into the database twice
based on vendor name and invoice number.
There is a possibility that duplicate invoices are not caught due to data entry errors.Accounts Payable
staff believe this issue could be minimized through implementation of a fully automated accounts
payable system. Finance is currently preparing a solicitation for this type of system; funding for this
implementation was included in the fiscal year 2020-21 budget.
4. Consider developing a procedure to verify that certain invoices have not already been paid
on a procurement card.
Management Response: Concur
Finance Comments: Staff has been exploring ways to compare invoices paid by p-cards to invoices
processed thru the Accounts Payable system.The only common data between the two systems is the
date of the transaction and the amount. The P-card system does not use the Vendor Master
numbering system and the transaction number on the receipt is not in the JDE system. We are
currently installing a new travel and p-card software which should enhance shared between the two
systems to find data points that we can use to search for duplicate transactions. Ultimately, the
payments are from separate systems and staff will implement all procedures policy to mitigate the
risk.
Audit Follow-Up Finding: In Progress
The new Cash Disbursements policy, implemented in January 2021, does not include a process for
Accounts Payable representatives to verify that invoices have not been paid via procurement card.
According to Finance staff,they plan to begin sending a list of items scheduled to be paid to the City's
procurement card monitoring vendor each week. The vendor will then provide a report of possible
items to double check before payments are issued.
In addition, Procurement sends a list of the City's contracts to the City's procurement card monitoring
vendor each month. Using this list, the monitoring vendor identifies purchases that could potentially
have been on contract and provides these exceptions to Procurement staff for review. This process
could potentially identify payments that may have also gone through the accounts payable process.
Some Exempted Taxes Have Been Paid
5. Establish a process to ensure the City is not paying any taxes for which it is exempt.
Management Response: Concur
Finance Comments: Accounting staff is consistently being reminded to check for sales taxes being
billed on vendor invoices while reviewing the Accounts Payable check run. Also, Accounts Payable
staff has the responsibility to reduce any sales tax charges and file the proper paper work with the
vendor to exempt any future sales tax charges.These practices will be incorporated into the updated
Policy and Procedures Manual.
Audit Follow-Up Finding: Implemented
According to Finance staff, Accounts Payable manually verifies that invoices received do not include
exempt taxes as part of their standard review process. If exempted taxes are included, the amount is
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
deducted from the issued check and the vendor is notified of the City's exempt status. Based on a
sample review of 95 payments, no exempt taxes were paid.
Receiving Documentation Can be Improved
6. Require employees to enter adequate receiving documentation for all goods and services.
Management Response: Concur
Finance Comments:As part of the update to the Accounts Payable Policy and Procedures manual,we
will require the department personnel to upload an image of the receiving or shipping document
with the invoice as a reference for City staff when processing payments to the vendor.
Audit Follow-Up Finding: Implemented
The new Cash Disbursements policy, implemented in January 2021, states "appropriate
documentation to support expenditures is the detailed, itemized original 'invoice' or receipt listing
the items purchased."This policy clarifies what is considered adequate receiving documentation for
goods and services.This standard was not previously set.
Based on a sample review of 95 payments issued during calendar year 2020, only one appeared to
have receiving documentation that may be inadequate. In addition, based on this review, more
purchase orders for goods appeared to use a quantity and price order method instead of a lump sum.
The quantity and price methodology for purchase orders provides further assurance that goods are
received before payment because staff entering the receiver must enter the quantity of the goods
received instead of just the invoiced cost.
7. Consider requiring the employee who physically receives goods or services to enter the
receiving document in JD Edwards via policy.
Management Response: Concur
Finance Comments: Agree. As part of the update to the Accounts Payable Policy and Procedures
manual, we will require the department personnel to upload an image of the receiving or shipping
document with the invoice as a reference for City staff when processing payments to the vendor.
Audit Follow-Up Finding: In Progress
The new Cash Disbursements policy, implemented in January 2021, requires employees to "obtain
detailed, itemized transaction documentation for all purchases, review and verify the validity of all
transactions, reconcile transaction to documentation, indicate proper general ledger account coding
for transactions and submit required records to the Approver."This new policy appears to place the
responsibility for ensuring all goods and services are appropriately received on the employee making
the purchase, while still giving departments the flexibility to centralize receiver input.
Some Check Requisition and Dispersal Practices are Inappropriate
8. Require check requisitions under$5,000 to be approved by a supervisor.
Management Response: Concur
Finance Comments: We will distribute new forms requiring the Supervisor or Manager of the person
submitting the check requisition to approve the under $5,000 purchase. Directors already are 00
required to approve any check requisition over$5,0000.
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Audit Follow-Up Finding: Implemented
The new Cash Disbursements policy, implemented in January 2021, requires that check requisitions
under $5,000 be approved by a supervisor. In addition, based on a review of 95 sample payments
issued during calendar year 2020, eight were vouchered by a check requisition. Of these, one was
missing a supervisor's signature. This check requisition had adequate supporting documentation to
verify the City's obligation to pay but was requested on the old Check Requisition Form.
Despite this oversight, the recommendation appears to be generally implemented; however,
Accounts Payable staff should ensure that all check requisitions are made with the revised form and
have appropriate approvals.
9. Restrict physical collection of checks.
Management Response: Concur
Finance Comments: All Vendor checks will be mailed in the future. We will inform our vendors and
City staff that we will no longer release check payments. We will encourage our vendors to choose
ACH payments as an alternative. Exceptions to this policy will be allowed on a case by case basis.
Audit Follow-Up Finding: Implemented
The new Cash Disbursements policy, implemented in January 2021, states "with very limited
exceptions, all checks are to be mailed — there are no vendor pickups. Exceptions, which can be
picked up by City employees only, include legal settlements, property purchases, or special
requests."
Based on review of Accounts Payable's Check Pickup log, about 1% of issued checks were physically
picked-up between October and December 2020. Of these, no checks were picked up by a vendor
and all pickups appeared to have generally complied with the Cash Disbursements policy. Table 2
below summarizes these picked up checks:
Table 2: Check Pickups (Oct. 2020—Dec. 2020)
Pickup Dept. Checks Value Pickup Dept. Checks Value
Finance 3 $1,894,893.56 Parks 3 $7,463.75
Facilities 1 $179,429.96 Legal 2 $1,065.30
Real Estate 5 $45,449.05 Water 1 $285.96
Electric 1 $12,500.00 All: 16 $2,141,087.58
10. Encourage the use of electronic payments instead of paper checks where possible.
Management Response: Concur
Finance Comments:Agree.The Procurement Office is responsible for setting up the Vendor Masters,
including the method of payment the Vendor chooses. We also follow up with reviews of vendor
payment registers to look for and request vendors to setup ACH Payments to eliminate the need for
paper checks.
Audit Follow-Up Finding: In Progress
The new Cash Disbursements policy, implemented in January 2021, does not include a requirement
or preference for vendors to receive electronic payments. In addition, Finance and Procurement staff G)
stated that they had not initiated any efforts since the issuance of the original audit to proactively
encourage vendors to convert to electronic payments. Table 3 below shows that there has been a
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
percent increase in the number of electronic payments processed compared to the original audit;
however, this increase does not appear to be significant.
Table 3: Electronic Payment Comparison
FY 2018 CY 2020
Number of Electronic Payments 4,177 3,744
Percentage of All Payments 30% 34%
According to Procurement staff, they are in the process of updating their new vendor packet to
include a section on the benefits of electronic payments. In addition, they intend to work with
Accounts Payable to inform vendors who are not currently setup for electronic payments about that
opportunity.
Staples Advantage Features are not Adequately Utilized
11. Develop a process to ensure Staples Advantage purchases are properly approved and
received.
Management Response: Concur
Finance Comments: All Staples invoices should include a PO number so that the purchases are
authorized by department management and we can process the payment using the Accounts
Payable system to match the PO and receiver against the invoice amount.We are anticipating adding
software that will automate the processing of invoices received from our vendors. Using PO number
on the Staples purchases will leverage the automation and speed the process of paying all of our
vendor invoices including Staples.
Audit Follow-Up Finding: In Progress
Since the original audit, Procurement has worked with City departments to set up approval
workflows in the Staples Advantage system. Through this system, users are either classified as
associates who order items or supervisors who can approve item purchases. Based on review of a
February 2021 Staples Advantage User Report, all but one of the City's 90 associate users had an
approval workflow setup. This exception was communicated to Procurement staff on February 23
and was subsequently corrected.
On the other hand, 78 of the 87 supervisor accounts did not have approval workflows setup. While
this is true, only four of these accounts have recently ordered items from Staples. Procurement staff
is currently working with Staples to block all supervisor accounts from purchasing items.
12. Annually review Staples Advantage users to verify that access is still appropriate.
Management Response: Concur
Purchasing Comments: The control of access to the Staples Advantage is with the Procurement
Office. The Purchasing Office will request a user list from Staples annually or however frequently, as
needed. Purchasing will send the list out to the departments to verify the users and ask Staples to
make the requested changes.
Finance Comments: We agree that an annual review of city staff access to order from Staples should 0
be performed to maintain the proper access of personnel and will be incorporated into the updated
Policy and Procedures Manual.
The City of Denton Internal Audit Report March 2021
Audit of Follow-Up of Accounts Payable(October 2019)
Audit Follow-Up Finding: In Progress
Based on a review of a February 2021 Staples Advantage User Report, about 27% of the City's 177
Staples Advantage accounts' do not have recent activity.' About half of these accounts are
approvers.
According to Procurement staff, the Department is currently in the process of verifying Staples
Advantage users for the first time since the original audit. As part of this process, departments are
asked to confirm that their users still need access. In addition, Procurement staff have recently
implemented several user access review processes, including a quarterly review and verification of
the user report, and a weekly review to ensure employees that have recently separated from the
City no longer have access to the system.
13. Consider changing current Staples Advantage billing practices to improve efficiency in the
Accounts Payable Division.
Management Response: Partially Concur
Finance Comments: We are anticipating adding software that will automate the processing of
invoices received from our vendors. This will speed the process of paying all of our vendor invoices
including Staples. Having a PO number on the invoice is key to the automation process. We will
change our procedures to effectively leverage the ability of the software to scan and voucher a
vendor's invoice to make the payment process more efficient.
Purchasing Comments: We do not have the ability to change Staples' billing practices or procedures.
We can limit the number of City staff that have access to order from Staples and agree that this
should be reviewed annually to ensure the proper employees have access.
Audit Follow-Up Finding: Implemented
The City has changed its billing method with Staples so that it receives an invoice for each order
placed instead of each delivery. This has reduced the number of invoices received from Staples
annually by about 50 percent. During calendar year 2020,About 4.4%of the City's vouchers were for
Staples, and Staples payments represented about 0.2 percent of the total amount disbursed.
v
an
'Some City employees have multiple Staples Advantage accounts—one that is for ordering items and another for approving purchases.
5 For this report,recent activity means logining into the system during calendar years 2020 or 2021.