Loading...
2. Follow-Up Review of Accounts Payable Audit (Mar. 2021) ABSTRACT Improvements have been made to further ensure City purchases of around $510 million are appropriately supported and approved. Plans to further automate �p accounts payable processes should provide additional �IN �,C 000 ODE assurance that payments are not duplicated. Internal Audit Department City Auditor ` Madison Rorschach, CIA, CGAP Audit Staff AUDIT OF ACCOUNTS Amber Jackson, CFE, MBA PAYABLE Follow-Up Report (I T}, 11 DENTON Project#: 007 The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Table of Contents Follow-Up at a Glance..........................................................................................................................3 Introduction.........................................................................................................................................4 ManagementResponsibility.....................................................................................................................4 Audit Objectives, Scope, and Methodology..............................................................................................4 Recommendation Status Update .........................................................................................................5 Payment Procedures Should be Updated and Expanded.........................................................................5 Critical Purchasing System Access Needs to be Reviewed .......................................................................5 Duplicate Payment Controls Need Improvement.....................................................................................6 Some Exempted Taxes Have Been Paid....................................................................................................7 Receiving Documentation Can be Improved ............................................................................................8 Some Check Requisition and Dispersal Practices are Inappropriate........................................................8 Staples Advantage Features are not Adequately Utilized ......................................................................10 N v The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Follow-Up at a Glance Why we did this Follow-Up: This report is intended to provide information on what changes have been made in response to the Accounts Payable Audit issued in October 2019. The original audit evaluated the effectiveness of controls over accounts payable in order to properly record and safeguard the spending of municipal funds. This follow-up is included on the City's Fiscal Year 2020-21 Audit Plan as approved by the City Council. What we Found: A newly adopted Cash Disbursements Policy has provided additional guidance to Accounts Payable and department staff including formalizing standards for receiving documentation and improving controls overthe processing of checks. In addition,Accounts Payable has begun automating invoice and payment request processing, which should help reduce the risk of duplicate payments. Finally, the City has generally begun requiring supervisor approval for all Staples purchases; however, additional oversight should further minimize the risk of inappropriate purchases. The status of each recommendation is summarized below: Recommendation Mgmt. Response Status 1. Formalize an AP policies & procedures manual. Concur Implemented 2. Ensure AP & Purchasing Staff don't have incompatible Concur In Progress system access. 3. Include standard invoice numbering guideline in policies & procedures manual. Concur In Progress 4. Consider developing a procedure to verify invoices weren't paid via p-card. Concur In Progress 5. Establish process to ensure the City isn't paying Concur Implemented exempt taxes. 6. Require employees to enter adequate receiving documentation for all goods &services. Concur Implemented 7. Consider requiring employees who physically receive Concur Implemented goods &services to enter receiving documentation. 8. Require check requisitions under$5,000 to be Concur Implemented approved. 9. Restrict physical collection of checks. Concur Implemented 10. Encourage use of electronic payments. Concur In Progress 11. Ensure Staples purchases are approved & received. Concur In Progress 12. Annually review Staples users to verify access. Concur In Progress 13. Consider changing Staples billing practices to improve Partially Concur Implemented efficiency in the AP Division. IO CITY DENTON Audit report translations may be requested by emailing InternalAudit@CityofDenton.com. Introduction The Internal Audit Department is responsible for providing: (a) an independent appraisal' of City operations to ensure policies and procedures are in place and complied with, inclusive of purchasing and contracting; (b) information that is accurate and reliable; (c) assurance that assets are properly recorded and safeguarded; (d) assurance that risks are identified and minimized; and (e) assurance that resources are used economically and efficiently and that the City's objectives are being achieved. The Internal Audit Department has completed a follow-up review of the Accounts Payable Audit issued in October 2019. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Management Responsibility City management is responsible for ensuring that resources are managed properly and used in compliance with laws and regulations; programs are achieving their objectives; and services are being provided efficiently, effectively, and economically. Audit Objectives, Scope, and Methodology This report is intended to provide a progress update on recommendations from the Payable Audit(October 2019),which evaluated the effectiveness of controls over accounts payable in order to properly record and safeguard the spending of municipal funds. Audit fieldwork was conducted during February and March 2021. The scope of review varied depending on the procedure being performed.The following list summarizes the major procedures performed: • Reviewed documentation from the issued audit to develop criteria including industry standards, best practices, policies, and procedures; • Evaluated the City of Denton's Cash Disbursements policy approved on January 26, 2021; • Analyzed payments and vouchers issued during calendar year 2020; • Examined supporting documentation for a randomly selected statistical sample of 95 payments issued during calendar year 2020; • Inspected user access reports for the City's Staples Advantage and JD Edwards systems; and • Interviewed City staff from the Accounts Payable Division and the Finance, Procurement & Compliance, and Technology Services Departments. 'The City of Denton Internal Auditor's Office is considered structurally independent as defined by generally accepted government auditing standard 3.56. 2 This sample provides with 95%confidence that the true population is±10%of the sample estimate. The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Recommendation Status Update This report summarizes the Audit of Accounts Payable recommendations, management responses, and the Internal Audit Department's follow-up findings, which describe to what extent City management has implemented Internal Audit's recommendations since the publication of the original report(October 2019). Most simply, it is the function of an accounts payable division to verify an organization's obligation to pay suppliers and other entities that are owed money by an organization. In the City of Denton, this obligation to pay is verified in three ways: 1) automated three-way matching, 2) manual review by the Treasury Division, and 3) manual review by the Accounts Payable Division. Table 1: Obligation to Pay Verification Summary (CY2020) Verification Procedure No.of Payments Est. Payment Amount (Millions) Three-Way Match 6,760 $153.7 Manual Treasury 699 $354.1 Manual AP 3,613 $3.1 Refunds Z331 $0.3 Payment Requests 932 $2.4 Reimbursements 117 $0.0 Other 233 $0.3 All: 11,072 $510.9 Payment Procedures Should be Updated and Expanded 1. Update and formalize an accounts payable policies and procedures manual. Management Response: Concur Finance Comments: The process to update policies and procedures is under way. Staff has received examples from multiple cities utilizing the same financial software. These examples will assist in drafting changes to the policies and procedures manual. We want to ensure comprehensive policies are appropriately formal and cover all aspects of Accounts Payable practices and procedures. Audit Follow-Up Finding: Implemented The City Council adopted a new Cash Disbursements policy on January 26, 2021 via ordinance. This policy includes roles and responsibilities for Accounts Payable, Procurement, and departments making and approving purchases with regards to the payment process. Critical Purchasing System Access Needs to be Reviewed 2. Finance and Procurement need to ensure that Accounts Payable and Procurement staff do not have incompatible system access. Management Response: Concur Finance Comments: Tech Services has now restricted the Accounts Payable Staffs ability to add purchase order requisitions and enter receipts. Purchasing Comments: Tech Services is working to create more restrictive user groups for Lr) Procurement Staff's system access to differentiate between the users who approve requisitions and the users who have access to the supplier master file. The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Audit Follow-Up Finding: In Progress Currently, there are seven security groups in the City's financial system involved in the vendor payment process as shown below:' Table 2: Financial System Payment Process Security Groups Accounts Payable Purchasing Warehouse ACCTPAY PURCHASST WAREHOUSE ACCTPAYSV PURCH WAREHOSUPV PURCHSUPR These security groups restrict access within the City's financial system so that users only have access to the functions needed to perform their duties. Ideally, duties within the purchase process should be segregated to minimize the risk of abuse.These duties include: • Procurement Requisition/Approval • Receipt of Goods • Purchase Order Issuance • Accounts Payable/Payment Disbursement Based on a review of changes made to these security groups, some access has been restricted to ensure users do not have incompatible system access. In particular, Accounts Payable representatives are no longer able to enter procurement requisitions. That being said, the following inappropriate actions still appear possible: • Accounts Payable staff (i.e. ACCTPAY and ACCTPAYSV groups) appear to be able to enter receipts for goods; • Purchasing staff (i.e. PURCHASST and PURCH groups) appear to be able to create procurement requisitions; and • Some Purchasing staff(i.e. PURCH group) appear to be able to enter receipts for goods. In addition,the number of superusers—or those users in more than one security group—appears to have increased for the Warehouse function. This may grant these users even greater access to incompatible duties. If this access is abused, it may not be detected in a timely manner. Duplicate Payment Controls Need Improvement 3. Include a standard invoice numbering guideline within the policies and procedures manual. Management Response: Concur Finance Comments: The standard invoice numbering practice will be incorporated into the updated Policy Manual. Audit Follow-Up Finding: In Progress The new Cash Disbursements policy, implemented in January 2021, does not include a standard invoice numbering guideline; however, the Finance Department plans to address this issue once a fully automated Accounts Payable software is implemented. Q 3 City departments must work with the Technology Services Department in order to make changes to security groups in the City's financial system. The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) That being said, the City has begun using a semi-automated accounts payable processing system. Through this system, department staff submit invoices for payment to a cloud-based application for Accounts Payable representatives to process. This system includes a duplicate invoice verification procedure that automatically determines if the invoice has been entered into the database twice based on vendor name and invoice number. There is a possibility that duplicate invoices are not caught due to data entry errors.Accounts Payable staff believe this issue could be minimized through implementation of a fully automated accounts payable system. Finance is currently preparing a solicitation for this type of system; funding for this implementation was included in the fiscal year 2020-21 budget. 4. Consider developing a procedure to verify that certain invoices have not already been paid on a procurement card. Management Response: Concur Finance Comments: Staff has been exploring ways to compare invoices paid by p-cards to invoices processed thru the Accounts Payable system.The only common data between the two systems is the date of the transaction and the amount. The P-card system does not use the Vendor Master numbering system and the transaction number on the receipt is not in the JDE system. We are currently installing a new travel and p-card software which should enhance shared between the two systems to find data points that we can use to search for duplicate transactions. Ultimately, the payments are from separate systems and staff will implement all procedures policy to mitigate the risk. Audit Follow-Up Finding: In Progress The new Cash Disbursements policy, implemented in January 2021, does not include a process for Accounts Payable representatives to verify that invoices have not been paid via procurement card. According to Finance staff,they plan to begin sending a list of items scheduled to be paid to the City's procurement card monitoring vendor each week. The vendor will then provide a report of possible items to double check before payments are issued. In addition, Procurement sends a list of the City's contracts to the City's procurement card monitoring vendor each month. Using this list, the monitoring vendor identifies purchases that could potentially have been on contract and provides these exceptions to Procurement staff for review. This process could potentially identify payments that may have also gone through the accounts payable process. Some Exempted Taxes Have Been Paid 5. Establish a process to ensure the City is not paying any taxes for which it is exempt. Management Response: Concur Finance Comments: Accounting staff is consistently being reminded to check for sales taxes being billed on vendor invoices while reviewing the Accounts Payable check run. Also, Accounts Payable staff has the responsibility to reduce any sales tax charges and file the proper paper work with the vendor to exempt any future sales tax charges.These practices will be incorporated into the updated Policy and Procedures Manual. Audit Follow-Up Finding: Implemented According to Finance staff, Accounts Payable manually verifies that invoices received do not include exempt taxes as part of their standard review process. If exempted taxes are included, the amount is The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) deducted from the issued check and the vendor is notified of the City's exempt status. Based on a sample review of 95 payments, no exempt taxes were paid. Receiving Documentation Can be Improved 6. Require employees to enter adequate receiving documentation for all goods and services. Management Response: Concur Finance Comments:As part of the update to the Accounts Payable Policy and Procedures manual,we will require the department personnel to upload an image of the receiving or shipping document with the invoice as a reference for City staff when processing payments to the vendor. Audit Follow-Up Finding: Implemented The new Cash Disbursements policy, implemented in January 2021, states "appropriate documentation to support expenditures is the detailed, itemized original 'invoice' or receipt listing the items purchased."This policy clarifies what is considered adequate receiving documentation for goods and services.This standard was not previously set. Based on a sample review of 95 payments issued during calendar year 2020, only one appeared to have receiving documentation that may be inadequate. In addition, based on this review, more purchase orders for goods appeared to use a quantity and price order method instead of a lump sum. The quantity and price methodology for purchase orders provides further assurance that goods are received before payment because staff entering the receiver must enter the quantity of the goods received instead of just the invoiced cost. 7. Consider requiring the employee who physically receives goods or services to enter the receiving document in JD Edwards via policy. Management Response: Concur Finance Comments: Agree. As part of the update to the Accounts Payable Policy and Procedures manual, we will require the department personnel to upload an image of the receiving or shipping document with the invoice as a reference for City staff when processing payments to the vendor. Audit Follow-Up Finding: In Progress The new Cash Disbursements policy, implemented in January 2021, requires employees to "obtain detailed, itemized transaction documentation for all purchases, review and verify the validity of all transactions, reconcile transaction to documentation, indicate proper general ledger account coding for transactions and submit required records to the Approver."This new policy appears to place the responsibility for ensuring all goods and services are appropriately received on the employee making the purchase, while still giving departments the flexibility to centralize receiver input. Some Check Requisition and Dispersal Practices are Inappropriate 8. Require check requisitions under$5,000 to be approved by a supervisor. Management Response: Concur Finance Comments: We will distribute new forms requiring the Supervisor or Manager of the person submitting the check requisition to approve the under $5,000 purchase. Directors already are 00 required to approve any check requisition over$5,0000. The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Audit Follow-Up Finding: Implemented The new Cash Disbursements policy, implemented in January 2021, requires that check requisitions under $5,000 be approved by a supervisor. In addition, based on a review of 95 sample payments issued during calendar year 2020, eight were vouchered by a check requisition. Of these, one was missing a supervisor's signature. This check requisition had adequate supporting documentation to verify the City's obligation to pay but was requested on the old Check Requisition Form. Despite this oversight, the recommendation appears to be generally implemented; however, Accounts Payable staff should ensure that all check requisitions are made with the revised form and have appropriate approvals. 9. Restrict physical collection of checks. Management Response: Concur Finance Comments: All Vendor checks will be mailed in the future. We will inform our vendors and City staff that we will no longer release check payments. We will encourage our vendors to choose ACH payments as an alternative. Exceptions to this policy will be allowed on a case by case basis. Audit Follow-Up Finding: Implemented The new Cash Disbursements policy, implemented in January 2021, states "with very limited exceptions, all checks are to be mailed — there are no vendor pickups. Exceptions, which can be picked up by City employees only, include legal settlements, property purchases, or special requests." Based on review of Accounts Payable's Check Pickup log, about 1% of issued checks were physically picked-up between October and December 2020. Of these, no checks were picked up by a vendor and all pickups appeared to have generally complied with the Cash Disbursements policy. Table 2 below summarizes these picked up checks: Table 2: Check Pickups (Oct. 2020—Dec. 2020) Pickup Dept. Checks Value Pickup Dept. Checks Value Finance 3 $1,894,893.56 Parks 3 $7,463.75 Facilities 1 $179,429.96 Legal 2 $1,065.30 Real Estate 5 $45,449.05 Water 1 $285.96 Electric 1 $12,500.00 All: 16 $2,141,087.58 10. Encourage the use of electronic payments instead of paper checks where possible. Management Response: Concur Finance Comments:Agree.The Procurement Office is responsible for setting up the Vendor Masters, including the method of payment the Vendor chooses. We also follow up with reviews of vendor payment registers to look for and request vendors to setup ACH Payments to eliminate the need for paper checks. Audit Follow-Up Finding: In Progress The new Cash Disbursements policy, implemented in January 2021, does not include a requirement or preference for vendors to receive electronic payments. In addition, Finance and Procurement staff G) stated that they had not initiated any efforts since the issuance of the original audit to proactively encourage vendors to convert to electronic payments. Table 3 below shows that there has been a The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) percent increase in the number of electronic payments processed compared to the original audit; however, this increase does not appear to be significant. Table 3: Electronic Payment Comparison FY 2018 CY 2020 Number of Electronic Payments 4,177 3,744 Percentage of All Payments 30% 34% According to Procurement staff, they are in the process of updating their new vendor packet to include a section on the benefits of electronic payments. In addition, they intend to work with Accounts Payable to inform vendors who are not currently setup for electronic payments about that opportunity. Staples Advantage Features are not Adequately Utilized 11. Develop a process to ensure Staples Advantage purchases are properly approved and received. Management Response: Concur Finance Comments: All Staples invoices should include a PO number so that the purchases are authorized by department management and we can process the payment using the Accounts Payable system to match the PO and receiver against the invoice amount.We are anticipating adding software that will automate the processing of invoices received from our vendors. Using PO number on the Staples purchases will leverage the automation and speed the process of paying all of our vendor invoices including Staples. Audit Follow-Up Finding: In Progress Since the original audit, Procurement has worked with City departments to set up approval workflows in the Staples Advantage system. Through this system, users are either classified as associates who order items or supervisors who can approve item purchases. Based on review of a February 2021 Staples Advantage User Report, all but one of the City's 90 associate users had an approval workflow setup. This exception was communicated to Procurement staff on February 23 and was subsequently corrected. On the other hand, 78 of the 87 supervisor accounts did not have approval workflows setup. While this is true, only four of these accounts have recently ordered items from Staples. Procurement staff is currently working with Staples to block all supervisor accounts from purchasing items. 12. Annually review Staples Advantage users to verify that access is still appropriate. Management Response: Concur Purchasing Comments: The control of access to the Staples Advantage is with the Procurement Office. The Purchasing Office will request a user list from Staples annually or however frequently, as needed. Purchasing will send the list out to the departments to verify the users and ask Staples to make the requested changes. Finance Comments: We agree that an annual review of city staff access to order from Staples should 0 be performed to maintain the proper access of personnel and will be incorporated into the updated Policy and Procedures Manual. The City of Denton Internal Audit Report March 2021 Audit of Follow-Up of Accounts Payable(October 2019) Audit Follow-Up Finding: In Progress Based on a review of a February 2021 Staples Advantage User Report, about 27% of the City's 177 Staples Advantage accounts' do not have recent activity.' About half of these accounts are approvers. According to Procurement staff, the Department is currently in the process of verifying Staples Advantage users for the first time since the original audit. As part of this process, departments are asked to confirm that their users still need access. In addition, Procurement staff have recently implemented several user access review processes, including a quarterly review and verification of the user report, and a weekly review to ensure employees that have recently separated from the City no longer have access to the system. 13. Consider changing current Staples Advantage billing practices to improve efficiency in the Accounts Payable Division. Management Response: Partially Concur Finance Comments: We are anticipating adding software that will automate the processing of invoices received from our vendors. This will speed the process of paying all of our vendor invoices including Staples. Having a PO number on the invoice is key to the automation process. We will change our procedures to effectively leverage the ability of the software to scan and voucher a vendor's invoice to make the payment process more efficient. Purchasing Comments: We do not have the ability to change Staples' billing practices or procedures. We can limit the number of City staff that have access to order from Staples and agree that this should be reviewed annually to ensure the proper employees have access. Audit Follow-Up Finding: Implemented The City has changed its billing method with Staples so that it receives an invoice for each order placed instead of each delivery. This has reduced the number of invoices received from Staples annually by about 50 percent. During calendar year 2020,About 4.4%of the City's vouchers were for Staples, and Staples payments represented about 0.2 percent of the total amount disbursed. v an 'Some City employees have multiple Staples Advantage accounts—one that is for ordering items and another for approving purchases. 5 For this report,recent activity means logining into the system during calendar years 2020 or 2021.