Loading...
HomeMy WebLinkAbout1920-9 Munis Purchasing topics PART I report (Final 1-19-21)County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 County accounting system (MUNIS) purchasing topics Part I - Security and workflows To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org Deschutes County, Oregon David Givans, CPA, CIA Deschutes County Internal Auditor 1300 NW Wall St Bend, OR 97703 541-330-4674 David.Givans@deschutes.org Audit committee members: Daryl Parrish, Chair - Public member Jodi Burch – Public Member Tom Linhares - Public member Scott Reich - Public member Summer Sears – Public member Stan Turel - Public member Patti Adair, County Commissioner Nancy Blankenship, County Clerk Nick Lelack, Community Development Director Take a survey by clicking HERE County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 TABLE OF CONTENTS: HIGHLIGHTS 1. INTRODUCTION 1.1. Background on Audit …………..……………..……………………………………………. 1 1.2. Objectives and Scope ……………….……..…………….…………….……..………… 1-2 1.3. Methodology ………………………………….………….…………………………..……… 2-3 1.4. Background on County accounting system (Tyler Munis) …..……..…… 3-5 1.5. Background information on security and approval workflows ….….. 5-9 2. FINDINGS and OBSERVATIONS 2.1. Security findings and observations …….…………………………………...… 10-13 2.2. Approval workflow findings and observations …………………..………. 14-22 2.3. Internal controls findings and observations …………..…………....……. 22-23 3. MANAGEMENT RESPONSE 3.1. Finance …………………………………………..……………..……….…………..... 23-26 County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 HIGHLIGHTS Why this audit was performed: The County transitioned to a new integrated accounting and human resource system. What was recommended: Recommendations include: • including the County Administrator in workflow for all disbursements in excess of department limits; • Including the Board of County Commissioners (or designee) in workflow for disbursements over $150 thousand; • working with departments on rollout of purchase card rebate program; • segregating duties in the overall design of roles given to users; and • reviewing the history “Munis” roles. Part I - Security and workflows The focus of this audit work is on purchasing topics for the County accounting system (Tyler Munis). Purchasing topics will include procurement cards, new procurement workflows, and other adopted technology with the new accounting system. This first report focuses on security and approval workflows established in Munis. What was found Workflows There is a lack of workflow approvals that mirror authority at the highest levels. The County Administrator and the Board of County Commissioners do not have enforced disbursement approvals in the accounting software system. There are significant purchasing card transactions performed by Finance. They are making vendor payments sometimes exceeding $100 thousand with a purchasing card with the idea that rebates (of 1.5%) they receive on the card purchases will offset Finance department costs. Approval workflows in Finance allow vendor setup, edits, and approval by the same person. There are some additional workflows to be considered. Security Plan and design of Finance roles does not adequately consider segregation of duties. Analysis highlighted some potential conflicts that might exist with the assigned permissions. Usage of “Munis” administrative role could be better controlled. Internal controls The documentation of the current state of the County’s Munis accounting system could be improved (such as including the role structure). Deschutes County Internal Audit County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 1 1. Introduction 1.1 BACKGROUND ON AUDIT Audit Authority: The Deschutes County Audit Committee authorized the review of purchasing topics for the County Accounting system (Tyler Munis) with the FY 21 internal audit workplan. Purchasing topics will include procurement cards, new procurement workflows, and other adopted technology with the new accounting system. This first report of a series of reports will focus on the review of security and approval workflows established in Munis. The overall topic was divided up due to the complexity of the topic and to release findings in a timelier manner. Additional anticipated report topics to be released from this work based on the audit objectives below will include: 1) Vendor controls 2) Procurement cards 3) Purchasing analyses 1.2 OBJECTIVES and SCOPE “Audit objectives” define the goals of the audit. Objectives included: (carried over to future reports) 1) Assess and evaluate the security roles and approval workflows established for processing purchases through Munis. a) Consider whether there are opportunities to improve efficiency and effectiveness with the purchasing workflow. b) To what extent are County departments using the requisition/purchase order process for purchasing. 2) Assess and evaluate risks to the vendor master file. The vendor master file manages who and how payments are made to vendors. a) Segregation of duties and access County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 2 b) Changes and associated support 3) Assess and evaluate the use of County issued procurement cards. 4) Analyze purchases in a number of areas, including a) Effectiveness of approvals b) Duplicates search c) Use of discounts d) Whether transactions have been split to avoid proper approvals or purchasing requirements e) Benford’s analysis – identifies unusual disbursement amounts. 5) Be aware of any issues with compliance with federal and state regulations and requirements, as may be applicable. Scope and timing: The audit commenced in March 2020. The work was interrupted by a pressing audit request from the Board of County Commissioners and Budget committee. Work re-commenced in September 2020. Work was focused on purchasing topics within the accounting system in place as of September 2020. The scope of the audit did not include all aspects of internal controls employed. The accounting system is only partly represented in Munis as there are numerous other internal control systems in place at the County including administrative, budgetary, and legal. The work occurred during the COVID-19 pandemic. 1.3 METHODOLOGY “Audit procedures are created to address the audit objectives” Audit procedures relevant to the reported topics in this report include: • Interviewing staff related to accounting system questions. • Reviewing associated accounting system documentation • Analyze background information on purchasing and purchasing within Munis • Analyses of users and established security settings. • Review for appropriate segregation of duties. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 3 o Utilizing a method of assigning approval, entry, and custody type labels to Munis in tasks, we were able to highlight areas where there might be conflicts with assigned permissions. • Analyses of approval workflow for the County, departments, and users around purchasing. • Review of State and County purchasing rules. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) The County Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. 1.4 BACKGROUND ON COUNTY ACCOUNTING SYSTEM (Tyler MUNIS) The County recently upgraded to version 2019 of Munis. Deschutes County recognized a need to transition to a new integrated accounting and human resource system in early 2014. The County selected through a competitive bid process Tyler’s Munis accounting and human resource software. Some three years later in July 2017, the accounting system was started after countless hours of work by the Finance department, Information Technology Department and nearly every County department. The County utilized Tyler consulting services to implement and setup the system through discussions with County staff. Countless other milestones have continued after then, including setting up payroll and human resources. The County is continuing to upgrade as there are new releases of the software. The County performed a thorough RFP process for the integrated Financial and HR software in May County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 4 GRAPH I Composition of purchasing by type and period (by counts) 2015. The County negotiated with Tyler representatives and brought forth a contract in March 2016. $1.8 million of this project was funded with transfers from the County general fund and to be repaid over a seven year period through internal charges to departments. Charges to departments began in FY 2016 and will continue through FY 2023. The significant goals of the new accounting/human resource software system included: • system management of all electronic documentation; • electronic data entry; • electronic approvals; • County and department specific electronic approvals Integration with other systems; • enhanced internal controls; • compliance with state and federal regulations; • access to data; and • self-service options. One aspect of the new accounting system that was being encouraged was the move to requisitions, purchase orders, and contracts over direct pay invoices. These purchasing types in the system allow an approval of the initial requisition or contract and then a streamlined approval of the forthcoming invoices under those. This was anticipated to be a big boost in efficiency as well as improved internal control (i.e. three-way match on requisitions). In addition, entering purchases through requisitions, purchase orders, or contracts results in encumbrances in the accounting system that help identify costs incurred against available budget. This is a particularly important tool for staying within budget. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 5 The trends show some increase in utilization of contracts, requisitions/purchase orders, and the newest purchasing category of purchasing cards (p-cards) over invoices. The trend for amounts is somewhat similar to this. There is still room for improvement. The Finance Department has instituted a number of reports and processes to bring greater awareness of how the software is operating in terms of workflows and control functions. 1.5 BACKGROUND INFORMATION ON SECURITY AND APPROVAL WORKFLOWS Only a third of County employees have access to Munis. 1) SECURITY Security (and intertwined with that privacy) is of significant importance to the makeup of any system of internal controls around the accounting/human resource software. Security by user is established first over access to the County network where the software resides. The County’s Information Technology Department is the gate keeper for adding users to the network and to Munis. Not all county employees have a need to access the County accounting system (nor do all employees have access to the network). There are approximately 340 users in the accounting system (approximately a third of the number of County employees) and of those only a third or so have approval rights in the system. The County has significant control over what a user can see and do in Munis. The County limits access to social security numbers as well as dates of birth, to name a few restrictions. The County utilizes role based access control (RBAC) which is a best practice. RBAC tailors a user’s roles to the access needed to do their job. Roles are established to control functional access, data access, and menu access. Utilizing job and functional roles is more efficient than setting up unique roles by user. • Functional access roles define the permission of what a user can do. • Data roles limit the records a user can see, generally, to a specific fund, department, County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 6 DIAGRAM I Architecture for security over accounting system and/or division. • Menu access is usually kept within the functional role as it can limit what a user can see of the software menus and options in order to use the system. RBAC does not inherently provide segregation of duties. This is implied with the setup of roles assigned that there should be an effort to separate authorization, record keeping (data entry), custody, and reconciliation. That is one of the questions that is being asked in this audit. These major areas provide varying controls over access and approval of accounting transactions and settings. • Network security • Munis user directory • Munis Security – established user roles and attributes for carrying out transactions and for what they can see and do. • Munis approval workflows establish how any transaction is approved before it can happen. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 7 DIAGRAM II Direct invoice approval workflows 2) APPROVAL WORKFLOWS Workflows help to mirror prior paper approvals that occurred prior to this system and that are established by the County for purchasing levels. There are a number of actions (steps) that when setup will trigger one or more approval workflows. These can be tailored to departments (by accounts) and or amounts. These workflows can trigger notifications as well as approvals. These workflows are available for some of the most controlled areas of the system. These include disbursements and vendor administration. Departments benefit from greater transparency in the system of approvals and improved access to information on their accounting. “Direct Invoices” represent bills for services or goods that do not have an associated requisition, purchase order, or contract. These are generally a direct payment and generally are not subject to competitive bidding. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 8 DIAGRAM III Requisition approval workflows Having structured approval workflows helps in mitigating some segregation of duties issues. The three most significant workflows are described below for direct invoices, requisitions, and contracts. You will note that the two workflows for invoices and requisitions are very similar. Requisitions generally are converted into purchase orders and then any invoices associated with the purchase order are processed and paid without much additional review. Contracts are similar in many ways to requisitions, except they have attached an associated contract and these, also, can have multiple invoices associated to them. The workflow for contracts “Requisitions” are a request for services or goods and generally are converted into purchase orders. Many invoices can be presented against a purchase order. These might require bids or other competitive process. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 9 DIAGRAM IV Contract approval workflows is as follows. Contracts tend to be for greater amounts and may have competitive bids associated with the procurement. Contracts go through an additional workflow through Legal Counsel and Administration. In addition to procurement workflows there are a number of other workflows that were reviewed. Probably, the most significant is the control over additions and changes to vendor records. “Contracts” can be a request for services or goods. Many invoices can be presented against a contract. These might require bids or other competitive process. Some are intergovern- mental agreements. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 10 2. Findings and Observations The audit included limited procedures to understand the systems of internal control around revenues. No significant deficiencies were found in this audit. A significant deficiency is defined as an internal control deficiency that could adversely affect the entity’s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements. The findings noted were primarily compliance and efficiency matters. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. 2.1 SECURITY FINDINGS and OBSERVATIONS Plan and design of Finance roles does not adequately consider segregation of duties. The documentation of roles has not been completed and the assignment of roles (functional and job) imparts a significant amount of authority within the Finance department. The audit developed an analyses tool for segregation of duties, by assigning approval, entry, and custodial type responsibilities to significant Munis permissions. This analysis highlighted some of the potential conflicts that might exist with the assigned permissions. For instance, the Accounting Manager position has super-user rights to the system and can do most anything in the system without oversight. This position has three job roles and three functional roles that span most of the available permissions available. In addition, the Chief Financial Officer also has significant user rights from County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 11 one functional role and two job roles. In some cases it was noted that Finance staff can approve their own entries. This parallels prior Finance control over the prior accounting system, in order to get the financial work done. With the new system there are added responsibilities to assure that workflows are working and that delays or issues are resolved in a timely manner. Segregation of duties is particularly important within the Finance Department. It is probably most significant because they have significant oversight responsibilities as well as record keeping responsibilities. No single user should be able two or more duties such as initiate a transaction, authorize the transaction, provide custody for the transaction when they are goods, and reconcile underlying records. Deschutes County has relied to a greater extent on Finance since they lead the project management and purchasing decisions around the new accounting system implementation. Finance is responsible for a lot of the troubleshooting and upkeep of the system and therefore has been given significant rights. Information technology (though it has significant access as well) is not affecting change to accounting records and is mostly establishing users by re-using existing roles. During the implementation, Finance had additional project management/oversight resources for handling the additional system duties. Post implementation, these extra resources were not continued and Finance Department has not been able to continue documentation and proactive management of the accounting system after implementation. Given the size of the County and the associated internal service funds, Finance is the most pragmatic department to provide many of these services. Some of the role permissions are further mitigated by workflow approvals that are required from someone else as well as reports available from the system or as developed. To mitigate the risk of assigning conflicting permissions, a review of the role based accesses for both individual roles and individual users’ combination of assigned permissions should be periodically performed. A review of approvals indicated the Accounting Manager did not have any significant invoice transactions they approved that hadn’t been forwarded to them for approval. The CFO has not initiated any County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 12 invoices. It is recommended for segregation of duties to be considered in the overall design of roles given to users. It is recommended Finance segregate significant duties within the system and provide greater guidance on approvals. This might include additional policy and procedural requirements to discourage self-approvals and further describe proper forwarding of approvals. It is recommended that periodically IT and Finance join forces to perform a segregation of duties review by user of their assigned permissions. Internal audit can provide guidance on how to carry out this review. It is recommended for the County to consider how it might address the additional resources (staffing time) necessary to help Finance and IT maintain ongoing support; document systems controls (such as roles and workflows); and reinforce segregation of duties. “Munis” administrative user is strictly guarded. Usage of “Munis” administrative role could be better controlled. The Munis software has a user and a role called "Munis". This role has super-users rights and is limited to those individuals with system administration type duties. It was noted in the user history that two users were given “Munis” rights and then the rights were removed. • In one case a non-IT administrative user was able to give themselves this right. This Finance user was given rights to help others with permissions, but it was not intended to be used for them to give themselves an additional right. • In the other situation IT was testing something and quickly removed the right. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 13 The system has the Munis user for certain administrative tasks that cannot be achieved elsewhere. Therefore the usage of this by any other users is strictly guarded. In both the situations, the permission appeared to be removed shortly after it was given and no unusual transactions were performed with those rights. It is recommended periodically IT and Finance review the history for the “Munis” roles and make sure that it is not being assigned without reason and that it is not being used to approve any transactions. Some active Munis users do not have employee credentials. Some County Munis users do not have their employee number associated with their account. This appears to be a problem with the timing of establishing the user versus the entry of the employee by Human Resources. Though it may matter for some p-card functionality, it also establishes a way to locate the user in the personnel records. Without the employee number, it is not clear why the user was established. It is also not likely there will be a trigger to remove these users from access when their reason for access has ended. In limited circumstances, some users who are not employees are provided access to Munis. This is generally to input budgets for some of the funds. It is recommended for the procedures for establishing new Munis users be updated to include a provision to include the association with their employee number, if applicable. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 14 2.2 APPROVAL WORKFLOW FINDINGS and OBSERVATIONS County Administrator relies on forwarded approval requests. Lack of workflow approvals that mirror authority. As noted in the above workflow diagrams (Diagrams II-IV), the County Administrator and the Board of County Commissioners are not included in the workflows for approving disbursements in the accounting software system. Included under disbursement approvals are workflows for requisitions, purchase orders, contracts, procurement cards, and invoices. The systems is setup so the Treasurer/Chief Financial Officer forwards select approvals to the County Administrator and documents decisions of the Board of County Commissioners. Whether or not this occurs is dependent on the CFO choosing to forward these to the County Administrator or assuring Board approvals prior to disbursement. Approval workflows established in the system provide a proactive control that pushes certain transactions to certain roles/users for approval. Without approval these transactions/entries cannot be completed. This is particularly important check for internal control. Under Oregon statute (ORS 208.010) County Treasurers are to disburse on the proper orders, issued and attested by the Board of County Commissioners. On exception to this appears to be the distribution of monies collected on behalf of taxing districts. Oregon statute (ORS 311.395) expressly makes that the authority of tax collectors and County Treasurers. The county treasurer shall distribute the amount of money set out in the tax turnover statement. The most significant purchasing approval workflows are banded by purchasing limits with departments and senior county officials and outlined in County policy F-15 - Payments to Suppliers. Most County Department heads have a purchasing authority up to $25 thousand (Health Services’ is $50 thousand). The County Administrator has authority from the Department head’s authority up to $150 thousand. In excess of those amounts the Board of County Commissioners has approval. It County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 15 is not clear the County Administrator is being asked to approve payments over $150 thousands as a means to assuring these are ready for Board approval. The policy guidance does not go so far as other disbursements that are not under purchasing, such as, turnover of taxes, refunding payments, payments of funds held in trust, and benefit payments, to name a few. Some examination of approvals indicated that sometimes the County Administrator or Board approvals are not requested or documented. For example, analyses of approval workflow history for FY20 through September 2020, indicates that not all disbursements from the API workflow (direct invoices) were approved by the County Administrator. • For disbursements greater than $25 thousand and less than $150 thousand (those that the County Administrator are responsible for), seven percent (7%) were not forwarded to the County Administrator ($590 thousand over sixteen transactions). This excludes tax turnover payments. • For disbursements greater than $150 thousand (those that are the responsibility of the Board of County Commissioners), eleven percent (11%) were not forwarded through the County Administrator ($4.2 million over about eighty transactions). Some of these that were reviewed did not have explicit Board approval. This excludes tax turnover payments. This limiting of workflows to the County Administrator seems to have been part of growing into the new software system. Same as with the Board of County Commissioners (who do not have access to the system). There are certain workflow reports developed by Finance that highlight approvals by threshold dollar level. This is a possible mitigating control in that these can identify unusual approval transactions but it isn’t clear they are being used by the County Administrator. These reports are being used inside Finance to monitor the approval workflows across the County. The County Administrator is also forwarded by the CFO expenditure authorization listing (EAL) reports that identify payments being made. These are in turn shared with the Board of County Commissioners. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 16 However, it is important the County Administrator have direct and complete access to all financial activities in case the CFO chooses not to forward such a report. In addition, many of these reports are all after the payments have been authorized. With approvals as they currently are, it is possible the CFO could approve large dollar value transactions without other management involvement. It is important for all larger disbursements be approved by the County Administrator before disbursed. {County comparisons: A brief survey of some of our larger peer counties was used to see how they authorized payments. Many reiterated the county purchasing requirements that Deschutes also follows. Some indicated the practice of the Board of County Commissioners doing weekly approvals of the checks being processed (as was done previously by Deschutes). Some indicated that some approvals were based on budgets being approved. } It is recommended for the County Administrator be included in workflow for all disbursements in excess of department limits. It is recommended the Board of County Commissioners have the County Administrator (or designee) review all payments over $150 thousand before they go to them. It is recommended the County Administrator (or designee) receive the Finance designed disbursement control reports on at least a monthly basis and review for any anomalies (approvals made without the County Administrator or Board designee). The Information Technology department should assure the monitoring reports are working as designed. It is recommended for the Board of County Commissioners (or designee) assure that disbursements over $150 thousand have their approval. They might consider staffing this review through Administration/BOCC to lend additional segregation of duties over Finance. It is recommended the Board of County Commissioners clarify by policy (perhaps in Policy F-15 – County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 17 Department purchasing thresholds) that the purchasing approval thresholds also apply to all payments being made and excluding certain payments that by statute can be made by the County Treasurer. It would also be a place where they direct whether the County Administrator should review and approve any payments coming to them for approval. Significant purchasing card transactions performed by Finance. A number of Solid Waste vendor payments of around a $100 thousand dollars were made by Finance on their purchasing card (the only one that is outside of limits for a department head and can be up to $300 thousand). Finance has this special card for paying large approved expenses that are payable by a purchase card as an alternative to writing a check. It appears this was done to take advantage of a purchase card rebate with the County’s bank. These invoices were originally submitted to be paid by check and approved through normal invoice approvals. Finance was able to negotiate with the County’s banking institution to obtain a rebate of 1.5% on purchase card purchases. Finance anticipates using these purchase card rebates (on other department purchases) as income in Finance to reduce Finance internal service charges to all departments. It does appear the invoices went through the same procurement workflow for invoices, but were also put through purchase card workflow. The workflow as a purchase card lacked sufficient detail on its own. The Solid Waste Department was not consulted in advance of the change in payment method. It appears the transaction could have been setup by the department for purchase card payment. It is thought this will be more efficient and create a better trail for the transaction. In addition, the department in negotiation with the vendor might be able to obtain better discount terms if they are paid promptly. Vendors may provide for discounts on timely payment and may take check payment and give an equal or greater discount than having to take a purchase card. This might be of benefit County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 18 to the department and the vendor. Finance indicates they have discussed the rebate arrangement with departments. It is not clear County departments are supportive of Finance benefiting from the terms of payment on a department purchases. Finance over four invoices from Solid Waste should receive close to $6 thousand for the rebates. As of September, Finance has not received these rebates as they have not requested them from the bank. Finance is targeting larger invoices from departments and has not introduced procedures to maximize the use of the potential rebate across County departments. It is recommended for Finance to work with departments on the rollout of using the purchase card rebate program and who should benefit from the purchase card rebate. It is recommended for the department considering use of a purchase card to see what payment arrangements can be made with their vendor that maximizes the potential discount on timely payment. It is recommended for vendors who are to be setup for payment through purchase card be setup from the beginning by the department. It is recommended for Finance to regularly collect on purchase card rebates and post them to the County accounting records. Approval workflows allows vendor setup/edits and approval by same person. Noted that a vendor was updated in Finance with new information and then approved by the same person. Approval Workflows established for some Finance staff with responsibilities for vendor changes allow them to edit and approve their own changes. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 19 Appropriate segregation of duties over important vendor information should require a separation of the approval from the entry. Finance staff are responsible for attaching relevant documentation for any changes. However, without another set of eyes on the material it is not clear that there is appropriate approval of the change. The County (like many businesses) is receiving fictitious requests to change vendor information that could allow the payments to go to the wrong place. In addition to risks for establishing fictitious vendors, these heighten the need to have segregation of duties on the vendor master file. The vendor master file contains important banking information, addresses, and taxpayer identification that are critical for proper payment and reporting. In subsequent audit work, there will be additional review of changes and support. It is recommended for Finance to improve segregation of duties over vendor additions and changes by requiring a separate person approve any additions or changes. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 20 TABLE I – Current Munis workflows being utilized (descending order of activity) Workflows in Munis trigger additional review and approvals. Additional workflows to be considered. The current version of Munis (ver. 2019) has a number of approval workflows over purchasing that are being utilized. Those purchasing workflows currently in use are as follows: Workflow code Workflow Description API Accounts Payable Invoice Approvals REQ Requisition Approvals RQC Requisition Conversions PEA Payment Entry Batch Approval VIU Vendor Internal Update RCP Requisition Conversion to Purchase Order Notify VIA Vendor Internal Addition COE Contract Approvals POM Purchase Order Change Order Approvals COM Change Order Approvals APC Accounts Payable Purchasing Cards APN Procurement Card Import Notification RCR Requisition Conversion Reject Notify APH Accounts Payable Check Approvals APP Accounts Payable Payment Approvals RVA Payment Reversals Approval EEA Employee Expense Actual Claim County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 21 TABLE II – Additional Munis workflows available There are some additional workflows available in the system that could be further explored. These include: Workflow code Workflow Description APD Accounts Payable Invoice Discrepancies Settings need to be activated for one or more discrepancies: • Invoice entered without a Purchase order • Invoice entered for a purchase order without sufficient receiving • Invoice entered for a purchase order where the unit price is outside of allowed variance • • Invoice entered for purchase order where the quantity is greater that the ordered quantity • Invoice entered for an expired purchase order • Direct pay invoice entered without a commodity code. This also requires that three-way match be activated. None of these discrepancies is currently set for the County settings. APP Check Payment Approvals This additional check and balance of payment workflow requires that a posted Accounts Payable Invoice be approved before it can transition to the next step and be paid by check. Check approval workflow can be setup by amount or account segment and/or purchasing department. We currently use APH workflow (which may be sufficient) RFC Check Request Approval Useful for employee related reimbursement expenses, travel expenses, or direct invoices and seek easier routing of workflow beyond API workflow. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 22 Maximizing the capabilities of the accounting software can assure the County is using efficient and effective controls. Though all of these may not be as important as some of the workflows, the invoice discrepancy workflow (APD) seems to be one that should be considered for use in combination with three-way match which is an important control. It is recommended for the County to consider some of the workflows they have not been using. 2.3 INTERNAL CONTROLS FINDINGS and OBSERVATIONS Overall, the documentation of the current state of the County’s Munis accounting system could be improved. With this audit and the review of security and workflows, it would have been great if the documentation included the planned role structure and how the system was established. There used to be a significant amount of documentation during the implementation. That is, however, not available since moving to live. The system has now been in place since July 2017. Software security, settings, and approaches to roles, modules, and workflows have a big impact on how the software will operate. The software provides a significant level of controls over the accounting for the County. In the absence of deliberate control permissions the system may not be adequately controlled. This could allow some staff with too much authority over the system. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 23 It is recommended for the County to consider and document how they are controlling roles, permissions, and workflows for Munis. 3. Management response Finance Department Greg Munn, Chief Financial Officer and Treasurer DATE: January 15, 2021 TO: David Givans, County Internal Auditor FROM: Greg Munn, Chief Financial Officer and Treasurer CC: Tom Anderson, County Administrator SUBJECT: Response to Munis System Audit 2.1(A) Plan and design of Finance roles does not adequately consider segregation of duties. • It is recommended for segregation of duties to be considered in the overall design of roles given to users. • It is recommended Finance segregate significant duties within the system and provide greater guidance on approvals. This might include additional policy and procedural requirements to discourage self- approvals and further describe proper forwarding of approvals. • It is recommended that periodically IT and Finance join forces to perform a segregation of duties review by user of their assigned permissions. Internal audit can provide guidance on how to carry out this review. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 24 Finance Department (continued) • It is recommended for the County to consider how it might address the additional resources (staffing time) necessary to help Finance and IT maintain ongoing support; document systems controls (such as roles and workflows); and reinforce segregation of duties. Agreed. Once the system was up and running there were staffing changes prevented a normal transfer resources from implementation to support. Most of that support demand fell on Finance staff which does not have adequate bandwidth to continue to move the system beyond the initial implementation to maturity. Next steps are to secure additional permanent support to work closely with county staff, including Finance, Internal Audit and department business manager representation to address these recommendations. 2.1(B) Usage of “Munis” administrative role could be better controlled. • It is recommended periodically IT and Finance review the history for the “Munis” roles and make sure that it is not being assigned without reason and that it is not being used to approve any transactions. Agreed. This will be incorporated with addressing recommendation 2.1(A). 2.1(C) Some active Munis users do not have employee credentials. • It is recommended for the procedures for establishing new Munis users be updated to include a provision to include the association with their employee number, if applicable. Agreed. This will be incorporated with addressing recommendation 2.1(A). 2.2(A) Lack of workflow approvals that mirror authority. • It is recommended for the County Administrator be included in workflow for all disbursements in excess of department limits. • It is recommended the Board of County Commissioners have the County Administrator (or designee) review all payments over $150 thousand before they go to them. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 25 Finance Department (continued) • It is recommended the County Administrator (or designee) receive the Finance designed disbursement control reports on at least a monthly basis and review for any anomalies (approvals made without the County Administrator or Board designee). The Information Technology department should assure the monitoring reports are working as designed. • It is recommended for the Board of County Commissioners (or designee) assure that disbursements over $150 thousand have their approval. They might consider staffing this review through Administration/BOCC to lend additional segregation of duties over Finance. • It is recommended the Board of County Commissioners clarify by policy (perhaps in Policy F-15 - Department purchasing thresholds) that the purchasing approval thresholds also apply to all payments being made and excluding certain payments that by statute can be made by the County Treasurer. It would also be a place where they direct whether the County Administrator should review and approve any payments coming to them for approval. Agreed. This will be incorporated with addressing recommendation 2.1(A). 2.2(A) Significant purchasing card transactions performed by Finance. • It is recommended for Finance to work with departments on the rollout of using the purchase card rebate program and who should benefit from the purchase card rebate. To date we have communicated that the rebate will be collected as a revenue source in the Finance internal service fund which results in reducing the amount of next Finance expenses that need to be collected through internal service charges, thus “passing through” the rebate indirectly to direct service department budgets. • It is recommended for the department considering use of a purchase card to see what payment arrangements can be made with their vendor that maximizes the potential discount on timely payment. Finance has worked with some departments that have large purchase card eligible transactions but need to prioritize this activity for existing spend to maximize the rebate. County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 26 Finance Department (continued) • It is recommended for vendors who are to be setup for payment through purchase card be setup from the beginning by the department. • It is recommended for Finance to regularly collect on purchase card rebates and post them to the County accounting records. Agreed. The County is relatively new at utilizing purchase cards as a spending tool for county business. Finance will prioritize this work with department partners. 2.2(B) Approval workflows allows vendor setup/edits and approval by same person. • It is recommended for Finance to improve segregation of duties over vendor additions and changes by requiring a separate person approve any additions or changes. Complete. Since this recommendation, Finance has separated these duties so that vendor additions and changes are requested and approved by different staff members. 2.2(C) Additional workflows to be considered. • It is recommended for the County to consider some of the workflows they have not been using. Agreed. This will be incorporated with addressing recommendation 2.1(A). 2.3 Overall, the documentation of the current state of the County’s Munis accounting system could be improved. • It is recommended for the County to consider and document how they are controlling roles, permissions, and workflows for Munis. Agreed. This will be incorporated with addressing recommendation 2.1(A). County accounting system (MUNIS) purchasing topics: Part I – Security and workflows report #1920-9 January 2021 Page 27 {End of Report} Please take a survey on this report by clicking on the attached link: https://www.surveymonkey.com/r/Security_and_workflows_1920-9 If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.