The URL can be used to link to this page

Home My WebLink About2021-6 Munis Purchasing topics Part II-Vendor master report (Final 3-8-21)County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 County accounting system (MUNIS) purchasing topics Part II – Vendor master To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org Deschutes County, Oregon David Givans, CPA, CIA Deschutes County Internal Auditor 1300 NW Wall St Bend, OR 97703 541-330-4674 David.Givans@deschutes.org Audit committee members: Daryl Parrish, Chair - Public member Jodi Burch – Public Member Tom Linhares - Public member Scott Reich - Public member Summer Sears – Public member Stan Turel - Public member Patti Adair, County Commissioner Nancy Blankenship, County Clerk Nick Lelack, Community Development Director Take a survey by clicking HERE County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 TABLE OF CONTENTS: HIGHLIGHTS 1. INTRODUCTION 1.1. Background on the Audit …………..…………….………………………………………. 1 1.2. Objectives and Scope ……………….……..…………….…………….……..………… 1-2 1.3. Methodology ………………………………….………….…………………………..……… 2-3 1.4. Background on vendor master (Tyler Munis) …………………….……..…… 3-5 2. FINDINGS and OBSERVATIONS 2.1. Vendor master observations and findings ……………..………………….… 5-13 3. MANAGEMENT RESPONSE 3.1. Finance …………………………………………..……………..……….…………..... 14-17 County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 HIGHLIGHTS Why this audit was performed: The County transitioned to a new integrated accounting and human resource system. What was recommended: Recommendations include: • documenting expectations for documentation with vendor additions and changes. • considering how to implement electronic signature. • considering vendor self- service. • periodically reviewing and resolving incorrect or duplicated taxpayer identification numbers. • periodically inactivating vendors with no activity. • Setting up vendors to search for duplicate invoices. Part II - Vendor master The focus of this audit work is on purchasing topics for the County accounting system (Tyler Munis). The audit looked at how additions and changes get made to the vendor master file. The vendor master file is an important internal control that ensures purchasing and payment of goods and services is appropriate and that only legitimate County vendors are paid. The County’s vendor master has over six thousand vendor records. What was found During the audit, it was observed that vendor change documentation improved but additional improvements warranted. • Recent use of forms with digital signatures raises the question on the practices of accepting electronic signatures. • Using vendor self-service in Munis could provide vendors with web-based access to information stored in the Munis accounting system and safe means to update their information. • The vendor master had limited duplicates. Some of the other areas noted for improvement included: • Thirty-two percent (32%) of vendors in Munis have never been paid. Many of these are vendors brought over from the old accounting system. • Two percent of active vendors were setup to allow the use of duplicate invoice numbers in Munis preventing identification of potential duplicates and raises the chances of making duplicate payments. • The County has additional opportunity to improve the use of electronic payments as 20% of payments occur electronically. • Tax information reporting information was not present on five percent of active vendors. Some W-9 support was not attached to the vendor record. Deschutes County Internal Audit County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 1 1. Introduction 1.1 BACKGROUND ON THE AUDIT Audit Authority: The Deschutes County Audit Committee authorized the review of purchasing topics for the County Accounting system (Tyler Munis) with the FY 21 internal audit workplan. Purchasing topics will include procurement cards, new procurement workflows, and other adopted technology with the new accounting system. The overall topic was divided up due to the complexity of the topic and to release findings in a timelier manner. The first report issued in this series was on security and approval workflows (report #19/20-9). This included work on vendor approvals. It would be beneficial to review at least the background of the report for background on the Munis accounting system. This report focuses on vendor controls with administration of the vendor master. Additional anticipated report topics to be released from this work based on the audit objectives below will include: 1) Procurement cards and 2) Purchasing analyses 1.2 OBJECTIVES and SCOPE “Audit objectives” define the goals of the audit. Objectives included: (addressed in prior report or carried over to future report) 1) (Report 19/20-9) Assess and evaluate the security roles and approval workflows established for processing purchases through Munis. 2) Assess and evaluate risks to the vendor master file. The vendor master file manages who and how payments are made to vendors. a) Changes and associated support County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 2 b) (Report 19/02-9) Segregation of duties and access 3) (Future report) Assess and evaluate the use of County issued procurement cards. 4) (Future report) Analyze purchases in a number of areas, including a) Effectiveness of approvals b) Duplicates search c) Use of discounts d) Whether transactions have been split to avoid proper approvals or purchasing requirements e) Benford’s analysis – identifies unusual disbursement amounts. 5) Be aware of any issues with compliance with federal and state regulations and requirements, as may be applicable. Scope and timing: The overall audit commenced in March 2020. The work was interrupted by a pressing audit request from the Board of County Commissioners and Budget committee. Work re-commenced in September 2020. Work on vendor master was refreshed through December 2020 and January 2021. Amounts paid (for compositional analyses) were taken from check activity from 2017 through 2020. The scope of the audit did not include all aspects of internal controls employed. The accounting system is only partly represented in Munis as there are numerous other internal control systems in place at the County including administrative, budgetary, and legal. The work occurred during the COVID-19 pandemic. 1.3 METHODOLOGY “Audit procedures are created to address the audit objectives” Audit procedures relevant to the reported topics in this report include: • Interviewing staff related to accounting system questions. • Reviewing associated accounting system documentation • Analyze background information on purchasing and vendors within Munis • Analyses of vendors and associated settings. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 3 • Review for changes and additions of vendors. o Review focused on support and approvals for bank authorizations and remittance addresses. Bank account changes reviewed from April 2020 through December 2020. Remittance address changes reviewed for December 2020. • Review of State rules regarding electronic transactions. Discuss application of rules with County counsel. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) The County Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. 1.4 BACKGROUND ON VENDOR MASTER IN THE COUNTY ACCOUNTING SYSTEM (Tyler MUNIS) The County vendor master has over six thousand vendors. The vendor master file is an important internal control that ensures purchasing and payment of goods and services is appropriate and that only legitimate County vendors are paid. The vendor master file is a database that contains a considerable amount of data on vendors doing business with the County. As such, it is important that best practices are employed when adding, maintaining, and inactivating vendors. The vendor master file is s achieved through coordination with County departments and the Finance department. It is up to everyone to make sure accurate and complete information is provided. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 4 15% of vendors are designated for employee reimbursement. Munis allows supporting information and documentation to be attached to the vendor record. To setup a new vendor in the vendor master file, designated employees within each department collect the required information from the vendors and enter it in Munis for review by Finance. Finance staff currently use an add/change form to research, verify, and document the addition or change. Part of that process is assuring any additions are not duplicating other vendor entries and obtaining tax reporting information before payments can be processed. The vendor master file is composed of vital business information for individuals or businesses that provide goods and services to the County. This important vendor information includes business name, remittance address, tax identification number, and sometimes includes bank routing and account information. This information is stored and maintained in Munis including digital images of supporting documentation. Munis also maintains an audit trail of the changes and approvals. The vendor master file ensures proper tax information reporting occurs if proper information has been collected. The Internal Revenue Service (IRS) requires that certain vendors be issued a form 1099 at year-end summarizing the payments made. The County may incur penalties if the 1099s are not issued properly. In addition to vendors that provide contracted goods and services, the vendor master file also contains vendor records related to employee reimbursements, refunds and rebates for utility customers, refunds, and other one-time payments. As of January 2021, there were 6,395 vendors in the vendor master file. Table I shows the count and composition of vendors by status. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 5 TABLE I Vendor master file status composition and count Status Count % on Count Description of status A (Active) 6,079 95% Vendors actively doing business with the County. Allows payments to be processed. I (Inactive) 192 3% Vendors that are not currently doing business with the County and are not able to be paid. Does allow a requisition or contract to be assigned to them. S (Stop) 105 2% Vendors that are not currently doing business with the County and are not able to be paid. They are not allowed to have a requisition or contract assigned to them. Other status types 19 0% Identified as another status type. Total 6,395 Source: Munis vendors summarized as of 1/11/2021. Of the active vendors, approximately 15% are designated for employee reimbursement. These do not amount to much in spending compared to the other types. 2. Findings and Observations The audit included limited procedures to understand the systems of internal control around the vendor master. No significant deficiencies were found in this audit. A significant deficiency is defined as an internal control deficiency that could adversely affect the entity’s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements. The findings noted were primarily compliance and efficiency matters. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 6 improvement may be needed and does not replace efforts needed to design an effective system of internal control. 2.1 VENDOR MASTER OBSERVATIONS AND FINDINGS Advisory notice! Vendor change documentation has improved but additional improvements warranted. A number of improvements were noted that staff implemented during the course of the audit. These in particular help assure better oversight and control over the changes that occur to the vendor master file for important areas like setting up electronic payments and changes to remittance addresses. These included: • Adding a Finance supervisor’s approval to approval workflow for vendor additions and changes. • Implemented a new ACH form for electronic banking authorizations. • Updated internal Finance form for review of additions and changes to the vendor master. These were in addition to existing procedures and practices for substantiating vendor additions and changes. There are evolving concerns around criminal attempts to modify vendor payment information. The Government Financial Officers Association (GFOA) has issued an advisory notice indicating governments should put safeguards and internal controls in place to mitigate the risk of fraudulent vendor payment activity. They indicate vendor fraud is often associated with submitting fake documentation to change the bank routing and account numbers for electronic vendor payment deposits. GFOA recommends that governments use electronic payments to improve efficiency, security, and tracking. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 7 It was noted that some vendor changes reviewed lacked effective documentation of the change. Some changes made lacked consistent use of Finance forms and procedures. It wasn’t clear if certain digitally provided forms represented valid electronically signed forms. The County’s cyber-security insurance emphasizes the importance of vendor controls. The County should strive to comply with any expectations from the insurance provider and as committed to by the County. In the absence of proper control over vendor information or making changes without the request of a valid vendor, the County might not be able to recover payments made in error. It is recommended for Finance to consider and clearly document expectations for documentation with vendor additions and changes. • This might include establishing with vendors expectations and contacts for a confirmation process. • This might also include direct calls to the payment receiving bank. • This recommendation might be influenced by implementation of a vendor self-service portal as described below. {The prior recommendation in report 1920-9 to complete written policies and procedures for purchasing practices should include the vendor master file and incorporate associated responses to the recommendations in this report.} 1. Additional discussion of electronically presented signatures. Finance has recently started accepting forms with electronic signatures. However, it does not appear those signatures provide any confirmation of the identity of the signer. This poses a potential risk in making changes to the vendor records with such documents. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 8 Oregon has provided guidance with ORS 84 for Electronic transactions. The County “shall determine whether, and the extent to which, it will send and accept electronic records and electronic signatures to and from other persons and otherwise create, generate, communicate, store, process, use and rely upon electronic records and electronic signatures”. The Covid pandemic has resulted in a number of processes that have pushed the County towards accepting digitally signed documents. However, without properly implementing electronic signatures; understanding the technology; and addressing any inherent integrity or validity issues, the completed forms may not be legally sufficient. Potential for changes in remittance and payment without sufficient authority can result in monies being sent to a fictitious person/entity. It is recommended for the County to consider how to implement electronic signatures across County departments and functions based on the associated risks and requirements. 2. Additional discussion of vendor self-service in Munis. Vendor self-service provides vendors with web-based access to information stored in the Munis accounting system. The information is drawn from multiple Munis products, including accounts payable, purchasing, and bid management. Vendors can enter and maintain their contact and remittance information, discount and payment terms, designated contact persons, and a list of commodity codes that represent the goods and services the vendor can provide. It also provides information on the vendor’s current and prior 1099 data, purchase orders, invoices, contracts, bids, and checks. The vendor self-service system can provide vendors with timely information and the ability to update and change their own information. This assumes the representatives of the vendor County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 9 apply appropriate changes. The County would still have the ability to approve any changes submitted. The County has not yet adopted vendor self-service. This system has a lot of similarity to employee self-service which is currently in use for County employee information, benefit and compensation elections, and wage information. Deschutes uses two self-service portals with Munis and staff indicate mixed results with the product and the support. Staff have heard there may be some new software coming that could also be used. In the absence of vendor self-service, County staff (and Finance staff) will have to continue making and approving changes for vendors and assuring the validity of those changes. This is at a higher risk than letting the vendors make the changes directly. It is recommended for Finance to consider establishing vendor self-service to collect vendor information directly from vendors. The self-service modules provided by Munis have varying degrees of success and choosing to use vendor self-service will require additional research to see if adoption is worthwhile at this time. Few duplicates found in analysis of vendor master file. The audit used data analyses software to identify likely duplicates. Some duplicate vendors were identified through review of same taxpayer identification numbers, bank accounts, and same or similar addresses. • Three (3) duplicate vendors identified by taxpayer identification number; • Nine (9) vendor records had fictitious taxpayer identification numbers that should be resolved, if appropriate. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 10 • Identified a number of vendors for employee reimbursement with the same bank account. On review, these appeared to be between employee spouse/partners and were appropriate. • Noted no active vendor duplicates on bank account numbers. Currently, there are not many vendors setup for electronic payment. Duplicate vendor entries raises the potential for using an improperly updated vendor and can result in duplicated payments. It isn’t always clear if a vendor is tied to an employee for employee reimbursement, for which no tax information reporting is required. It is recommended for Finance to periodically review and resolve incorrect or duplicated taxpayer identification numbers in the vendor master file. GRAPH I Composition of vendors that have received payments. July 2016 through December 2020 Results from additional vendor master analyses and areas for improvement. • Thirty-two percent (32%) of vendors in Munis have never been paid. Many of these are vendors brought over from the old accounting system. Inactive vendors use resources and have the potential of being selected inadvertently for payment. Periodically cleaning vendor files of inactive vendors decreases the opportunity for payment errors and fraudulent vendor practices and increases system efficiency. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 11 • A number of vendors were setup to allow the use of duplicate invoice numbers in Munis. 147 vendors (roughly 2% of active vendors) were characterized as being able to have duplicate invoice numbers. This prevents the software from effectively flagging invoices that may be duplicates and raises the chances of making duplicate payments. • Identified a number of vendors for employee reimbursements that were not properly identified as an employee type vendor (“EMP”) and without the associated employee number. • Tax information reporting information was not present on five percent (5%) of active vendors. Some W-9 support was not attached to the vendor record. Some of the tax information entries (or lack of entries) were vendors brought over from the old accounting system and it is not clear why these didn’t get resolved prior to bringing in to the new accounting system. W-9’s providing relevant tax reporting information should be collected for all vendors. {These vendors were provided to Finance for additional follow-up} • It is not clear the County is pursuing all of the discounts available to it with vendors. Only one vendor was setup with a discount. That vendor had provided a discount which reduced the payment recorded in the system. The County has not further encouraged departments to record discounts. Prior to Munis, the County could not always process payments quickly enough to receive quick payment discounts. However, since moving to Munis, the County is making weekly payments to vendors. • Only a limited number of vendors are being paid electronically. Electronic payments are more efficient than printed checks. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 12 GRAPH II Composition of vendors by form of payment GRAPH III Composition of vendor types “Other” is the most prominent vendor type. The County has additional opportunity to improve the use of electronic payments. • Only a limited number of vendor types are being used in Munis. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 13 Most vendors are indicated as "Other" even though there are a myriad of vendor types available. By not using appropriate vender types, useful information for future analyses of vendors providing certain services cannot be made effectively. This might help with RFP's and requests for bids for future services. It is recommended the County periodically inactivate vendors with no activity. It is recommended all vendors be setup to search for duplicate invoices. {The next audit will perform invoice analyses to identify potential duplicate payments.} It is recommended for all vendors established for employee reimbursement be associated to the employee. (Vendor type should be “EMP” and should be associated with employee number} It is recommended for the Finance Department to periodically review their vendor master lists for missing W-9 and tax information. It is recommended all vendors have their completed W-9 attached to their record and their taxpayer information number entered. It is recommended that Finance and County departments investigate if they are receiving all of the discounts they can get by paying in a timely manner. It is recommended for Finance to work with departments to utilize the discounts field when discounts are available. It is suggested that vendors be evaluated as to whether a better type could be assigned that better reflects the service or product they provide. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 14 3. Management response Finance Department Greg Munn, Chief Financial Officer and Treasurer DATE: March 2, 2021 TO: David Givans, County Internal Auditor FROM: Greg Munn, Treasurer and Chief Financial Officer CC: Tom Anderson, County Administrator SUBJECT: Response to Munis System Audit, Part II – Vendor Master Report #2021-6 _____________________________________________________________________________________________________________________________ 1. It is recommended for Finance to consider and clearly document expectations for documentation with vendor additions and changes. Agreed. • This might include establishing with vendors expectations and contacts for a confirmation process. Vendor expectations and contact requirements are listed on the Current Vendor Application Form (updated Jan. 2021). • This might also include direct calls to the payment receiving bank. We don’t believe this is consistent with bank policies but will confirm. • This might be influenced by vendor self-service portal as described below. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 15 Finance Department (continued) 2. It is recommended for the County to consider how to implement electronic signatures across County departments and functions based on the associated risks and requirements. Agreed. This would be a worthwhile discussion at the county-wide level. Until then the Finance department will continue to authenticate vendor applications and W-9 submissions, regardless of the signature method. 3. It is recommended for Finance to consider establishing vendor self-service to collect vendor information directly from vendors. The self-service modules provided by Munis have varying degrees of success and choosing to use vendor self-service will require additional research to see if adoption is worthwhile at this time. Agreed. This is a worthwhile discussion for a future improvement. We have several concerns including the amount of staff time required (does it save time or cost time?); additional training requirements; change management timing; and, liability for changes made that are inconsistent with IRS 1099 requirements, for example. 4. It is recommended for Finance to periodically review and resolve incorrect or duplicated taxpayer identification numbers in the vendor master file. Agreed. Finance has added this as a semi-annual review to our processes; once at the beginning of the fiscal year and once during the preparation of 1099s. 5. It is recommend the County periodically inactivate vendors with no activity. Agreed. A vendor clean up initiative will be started this spring and will be added to our annual procedures. 6. It is recommended all vendors be setup to search for duplicate invoices. {The next audit will perform invoice analyses to identify potential duplicate payments.} Agree. We will implement a naming/numbering convention for non-invoice payments (mostly employee expense County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 16 Finance Department (continued) and mileage reimbursements) similar to how we identify utility payments which are traditionally paid based on a monthly statement (invoices aren’t used). 7. It is recommended for all vendors established for employee reimbursement be associated to the employee. (Vendor type should be “EMP” and record should be associated with employee number} Agree. This will be part of the vendor clean up initiative mentioned above in #5. 8. It is recommended all vendors have their completed W-9 attached to their record and their taxpayer information number entered. Agree. This will be part of the vendor clean up initiative mentioned above in #5. 9. It is recommended that all vendors have their completed W-9 attached to their record and their taxpayer information number completed. Agree. This will be part of the vendor clean up initiative mentioned above in #5. 10. It is recommended that Finance and County departments investigate if they are receiving all of the discounts they can get by paying in a timely manner. Agree. We will explore this further. These discounts are often taken at the invoice level. We intend to add this to our Vendor Application, so we can be alerted to these discounts. Also, we will seek guidance/training about how to set these up at the vendor level. 11. It is recommended for Finance to work with departments to utilize the discounts field when discounts are available. Agree. See response to #10. This will be a good training opportunity for the new business systems administrator. County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021 Page 17 Finance Department (continued) 12. It is suggested that vendors be evaluated as to whether a better type could be assigned that better reflects the service or product they provide. Agree. This will require further evaluation to determine whether this would provide a value add and will be reviewed by our new business systems administrator. {End of Report} Please take a survey on this report by clicking on the attached link: https://www.surveymonkey.com/r/Vendor_Master_2021-6 If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.