Loading...
HomeMy WebLinkAbout2324-14 Clerk's Office Integrated Audit (Final 6-3-24)Clerk’s Office—Integrated Audit—23/24-14 June 2024 Clerk’s Office Integrated Audit The Office of County Internal Audit: Elizabeth Pape, CIA, CFE – County Internal Auditor Aaron Kay – Performance Auditor Audit committee: Daryl Parrish, Chair - Public member Jodi Burch – Public member Joe Healy - Public member Kristin Toney - Public member Summer Sears – Public member Stan Turel - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Take survey by clicking here Recommendations 13 Clerk’s Office—Integrated Audit—23/24-14 June 2024 Table of Contents: 1. Introduction ....................................................................................... 1 Background on the Clerk’s Office ................................................................................... 1 2. Findings and Observations .............................................................. 2 Findings ............................................................................................................................. 3 No fraud was uncovered, but the Clerk’s Office had incomplete documentation for mitigating cash handling risks. ............................................................................. 3 The Clerk’s Office inconsistently complied with County rules for procurement. . 5 There were role conflicts within the Clerk’s office information system recording workflow. ....................................................................................................................... 7 Clerk’s Office staff could void their own receipts. .................................................... 8 The Clerk’s Office staff used a generic account with a shared password. .......... 10 There were no inappropriate purchasing card transactions, but the card was not secured. ................................................................................................................ 10 The Clerk’s Office had performance measures, but they didn’t provide clear information about how well the Office functioned. ............................................... 11 The Clerk’s Office still had not requested a change to County Code to move responsibility for the Weed Control program requirements to the Road Department ................................................................................................................. 14 Observations ................................................................................................................... 15 The door to the Clerk’s Office reception was repaired, making the space more welcoming. .................................................................................................................. 15 The Clerk’s Office has resolved all outstanding Homeland Security recommendations. ..................................................................................................... 15 3. Management Response .................................................................. 16 4. Auditor Comments .......................................................................... 23 5. Appendix A: Objective, Scope, and Methodology ........................ 25 Clerk’s Office—Integrated Audit—23/24-14 June 2024 Objectives and Scope ..................................................................................................... 26 Methodology ................................................................................................................... 27 Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor DATE Highlights: Why this audit was performed: A periodic review of administrative practices. What was recommended: We recommended that the Clerk’s Office: • Conduct a fraud risk assessment and implement procedures to address financial risks. • Comply with County purchasing code. • Remedy role conflicts in the information system. • Secure the Office purchasing card. • Improve performance reporting. • Request a Code change to move Weed Control responsibilities. Clerk’s Office Integrated Audit Our overall objective was to conduct a survey-level risk assessment of administrative practices in the Clerk’s Office. We did not review specific functions such as conducting elections, overseeing voter registration, maintaining County records, recording property transactions, or any other Office business functions. What was found: We found areas for improvement related to cash handling, purchasing, information systems, purchasing cards, and performance measurement. • No fraud was uncovered but cash collection procedures were incomplete and did not address some risky practices. • The Clerk’s Office inconsistently complied with County rules for purchases. • There were information system role conflicts in the Clerk’s Office recording workflow and staff could void their own receipts. • The Clerk’s Office staff used a generic account with a shared password. • There were no unauthorized purchasing card transactions, but the card was not secured. • The Clerk’s Office had performance measures, but they didn’t provide information about how well the Office functioned. • The Clerk’s Office still had not requested a change to County Code to move responsibility for the Weed Control program requirements to the Road Department. The Clerk’s Office resolved an outstanding audit recommendation related to security improvements and repaired a malfunctioning door during the audit. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 1 of 28 1. Introduction The Deschutes County Audit Committee authorized the review of the Clerk’s Office in the Internal Audit Program Work Plan for 2024-2025. Internal audits of administrative controls are routinely performed for identified County departments, elected offices, and functions. The last cash handling audit at the Office was performed in 2008 and there was a transition audit performed in 2021. This is part of an effort to have regular audits done on a recurring cycle. Audit objectives, scope, and methodology can be found in Appendix A. The Office of Internal Audit is expanding the scope of its traditional cash handling audits to include a high-level risk survey of administrative functions in each department or office. We are making this transition because the move towards electronic transactions has shifted risk away from cash handling to information security. We are also including other administrative risks such as human resources, procurement, and health and safety in addition to following up on outstanding audit recommendations. Background on the Clerk’s Office The Deschutes County Clerk’s Office mission includes overseeing elections and voter registration, maintaining County records, recording real property and marriage licenses, coordinating the Property Value Appeals Board, and acting as the custodian of County historical records dating back to 1871. The Clerk’s Office has the distinction of being the first Oregon county to place its land records as well as accept marriage applications online. They also act as a federal passport acceptance agent and are inspected every other year by the Passport Services’ Office of the US Department of State. The Office is overseen by Steve Dennison, the elected Deschutes County Clerk, who assumed office following his appointment by the Board of County Commissioners in August 2021. He was Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 2 of 28 subsequently elected in 2022. Office functions are divided between two divisions one focused on elections and one focused on recording and archives. In Fiscal Year 2023, there were 11 full time equivalent employees in the Clerk’s Office and expenses were $2.18 million. Staff and expenses have trended up over the past five years. In Fiscal Year 2023, the Office generated $1.45 million in revenue. Real estate recordings constituted the majority of revenue, therefore revenue tracked with the frequency of property sales and refinancing. Revenue peaked in 2021 when mortgage interest rates were lower. When Office revenue is higher than expenses the Clerk’s Office subsidizes the County General Fund. Revenue was higher than expenses in Fiscal Year 2021: $3.2 million in revenue and $1.8 million in expenses with $1.4 million contributing to the General Fund. However, in Fiscal Year 2023, The Office required a General Fund transfer of $620,000. 2. Findings and Observations Our overall objective was to conduct a survey-level risk assessment of administrative practices. The audit objectives were Figure I: Staff and expenses have trended up over the past five years. Revenue peaked in 2021. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 3 of 28 focused on general areas of administrative risk and not on the specific functions of conducting elections, overseeing voter registration, maintaining County records, recording property transactions, or any of the other Clerk’s Office business functions. We also followed up on outstanding recommendations from the 2021 Clerk’s Office transition audit. For a detailed list of audit objectives, see Appendix A. As highlighted in past audit reports, the Clerk’s Office continues its reputation as a model for business continuity, with well- established manual backup processes for both elections and recording. These processes provide a reliable safety net in cases of system failures or technical glitches, ensuring continuity of operations without significant disruptions. We found areas for improvement related to cash handling, purchasing, information security, purchasing cards, and performance measurement. The Clerk’s Office resolved an outstanding audit recommendation related to security improvements and had a malfunctioning entry door repaired during the audit. Findings No fraud was uncovered, but the Clerk’s Office had incomplete documentation for mitigating cash handling risks. Most Clerk’s Office revenue came in through electronic transactions, but staff received some payments in cash, checks, and credit card. The Office noted that these transactions only made-up 26 percent of revenue collected, which may inform management’s perception of risk. When any organization collects revenue there is always the potential for fraud. Section 6 of the County’s Financial Policy F-7, Bank Accounts and Cash Handling, tasks managers with designing Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 4 of 28 and documenting procedures to prevent fraud to ensure that money ends up where it is supposed to go. No fraud was uncovered, but financial procedures at the Clerk’s Office were incomplete and did not address some risky practices. Procedures did not address: • Who had custody and was responsible for cash. Clerks shared cash drawers and kept drawers unlocked. Staff balanced tills at the end of each day and variance reports were sent the Finance Department. However, without one person responsible for cash, if some were to go missing, it would be difficult to know who was responsible. • How mail should be opened. When payments were received in the mail, a staffer opened mail without recording it and then gave it to various clerks to process transactions. Best practices would document custody of payments received by mail and any transfers of payments between staff. • How supervisors should conduct reviews of cash transactions. Procedures included instructions for how to use software to create supervisor reports, but not instructions about what they should be checking for. Items to check for might include starting drawer balances and voids. • How to reconcile deposits with the County Financial System. At the start of the audit the Office was not reconciling deposits to ensure that expected amounts were deposited in the correct accounts. Since then, the Office created and documented a reconciliation procedure. Procedures may have been incomplete because the Office had not conducted and documented a fraud risk assessment. Fraud risk assessments offer an opportunity for managers and staff to brainstorm ideas about how someone might defraud the County and then come up with processes to prevent it from happening. Staff participation in an assessment increase buy-in by helping staff understand why procedures are in place even though they may seem redundant or inefficient. Fraud prevention processes Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 5 of 28 might include limiting access to money, requiring secondary approval for transactions, or reconciling funds. In some cases, management may decide to accept a fraud risk because the likelihood of it happening is low or because there are not enough staff or resources to implement a mitigating procedure. In these cases, the acceptance of risk should be documented. Management acknowledged the need for procedure updates, especially after the recent retirement of several long-term employees. 1. The Clerk’s Office should conduct a fraud risk assessment, and document outcomes. 2. The Clerk’s Office should document and implement procedures to address fraud risks identified in the risk assessment. The Clerk’s Office inconsistently complied with County rules for procurement. Deschutes County Public Contracting Code 2.37 outlines requirements when contracting with vendors for goods and services including competitive procurement above thresholds and required contract provisions. It also may require a signature by the Board of County Commissioners or the County Administrator depending on the size of the payments. A provision in the Code exempts Clerk’s Office purchases of paper products used in election tabulation from competitive procurement. Purchasing code provisions are in place to prevent bias and ensure that all vendors have an equal opportunity to sell goods and services to the County. Competitive procurement ensures that the County receives the best value for goods and services and also promotes free enterprise by removing barriers to entry. Contract provisions protect the County from risk by requiring insurance and mandating compliance with state and federal laws. Approval authority limits provide oversight that management is Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 6 of 28 complying with the Code. The Clerk’s Office paid more than $300,000 to its five largest vendors in Fiscal Year 2023: • $171,468 for ballot printing. • $49,715 for mailing. • $40,734 for ballot counting software. • $40,244 for envelope printing. • $36,398 for service for the ballot sorter. The Clerk’s Office inconsistently complied with the Code regarding payments to vendors. In some cases, either there was no contract, there was no signature when the amount was above the threshold of $50,000, there was no competitive procurement process, or a combination of the factors applied. Service Contract Competitive Procurement Signature Ballot Printing X No  Exempt X Above Mailing X No X No  Below (close to threshold) Ballot Counting Software  Yes  Yes  Yes Envelope Printing X No X No  Below Service for the Ballot Sorter  Yes  Yes  Below Purchases without contracts is a long-standing issue and the 2021 transition audit made recommendations to implement contracts. In the years after the audit, the Clerk’s Office contracted with the vendor who services the ballot sorter, but not ballot printing, mailing, or envelope printing. (The ballot counting software Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 7 of 28 contract was signed prior to both audits.) During this audit, the Office said they would begin creating and executing contracts. Clerk’s Office management said that they were following long established practices regarding vendors. Compliance with the County’s vendor payment code may have been overlooked because the County had a decentralized procurement program with no one assigned to oversee procurement countywide. The County was in the process of creating and hiring for a position dedicated to Procurement. 3. The Clerk’s Office should consult with the new procurement staffer about procurement requirements. 4. The Clerk’s Office should conduct competitive procurements, put contracts in place, and get Administrator sign-off related to services identified in the audit. There were role conflicts within the Clerk’s office information system recording workflow. Assigning tasks to different staffers in a workflow allows staff to check each other’s work and prevents mistakes. The Federal Information Systems Controls Audit Manual section 3.4 SD-1 says that incompatible duties should be segregated. The Clerk’s Office software included roles and signoffs for documents to be recorded and reviewed by separate staff to check for mistakes. However, management disabled segregation functions so one clerk could enter and check the same document. In a review of transactions on three days (two fully staffed and one partially staffed) the same clerk recorded and reviewed a document in about 33 percent of cases. This analysis was for estimating purposes and should not be projected to the entire population. The Office allowed the same staff to record and review the same document to expedite transactions on days when there were Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 8 of 28 fewer staff available. The Office estimated that duties were not segregated about 25 percent of the time, which was a bit lower than auditor estimates. However, management had not performed an analysis to confirm how often low staffing made it necessary to combine duties or documented situations when it was appropriate to skip secondary checks. 5. The Clerk’s Office should analyze how often and when staff need to review a document they record and then decide whether recording and reviewing duties should be segregated. 6. If the Clerk’s Office decides record and review duties should be segregated, it should re-enable controls in the information system to enforce segregation. If the Office decides that duties should not be segregated, it should formally accept the risk by allowing role conflicts in a procedure. The Office said that they segregated recording and reviewing duties during the audit. Auditors will follow up to confirm whether recommendations were implemented in nine months. Clerk’s Office staff could void their own receipts. One way staff could steal cash would be to collect cash from a customer and then void the receipt so that it would not be recorded as receivable in the software. The Federal Information Systems Controls Audit Manual section 3.4 SD-1 says that incompatible duties, such as creating and voiding a receipt, should be segregated. The Office information system has a setting that would require a supervisor to void receipts, but management disabled the setting, and staff could void their own receipts. The Clerk’s Office management said that because staffing was limited, staff needed to be able to void their own receipts to expedite transactions. However, voids were rare. From July 2023 Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 9 of 28 to January 2024 there were no voided receipts on 70 percent of days. Office management staff said there were other compensating controls in place to reduce risks associated with staff voiding their own receipts. For example: • Customers would complain if they did not receive a document index number. The system did not allow documents to be recorded without an index number and payment. • Staff would notice a missing index number because they were serialized. • Cameras recorded who conducted transactions and when. Management could also run a report that listed voided transactions (with transaction numbers) and the staff responsible. Though compensating controls were in place, management had not documented them. 7. The Clerk’s Office should document workflow impacts of requiring supervisor approval of voided receipts including how often they happen and how long the process takes. After collecting this information, the Office should decide whether voids should require supervisor authorization. 8. If the Office decides that voids should require supervisor authorization, it should use controls in the information system to enforce authorization. If the Office decides that it will not require authorization, it should document compensating controls and formally accept the risks. The Office said that they began requiring supervisors to void receipts. Auditors will follow up to confirm whether recommendations were implemented in nine months. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 10 of 28 The Clerk’s Office staff used a generic account with a shared password. Staff could use the generic account to conduct transactions in the information system for recording documents without identification. County Information Technology Policy IT-1 requires staff to keep passwords confidential. The Federal Information Systems Controls Audit Manual section AC 2-1 says that system users should be appropriately identified and authenticated, and that generic user identification and passwords should not be used. The Clerk’s Office staff said they needed a shared account and password for times when another staffer needed to use a workstation that was already in use. They said that it took too long to log in a separate account. They also said that if there were inappropriate transactions, they could be tied to a specific person using the workstation and login information tied to other information systems used to conduct transactions such as the credit card processor. However, management had not documented risk tolerance for this activity or these compensating controls. 9. The Clerk's Office should review how staff use the generic account including how often it is used. 10. If the Office continues to use the generic account, it should formally accept and document the risks associated with its use. The Office said that they discontinued the use of the generic account during the audit. Auditors will follow up to confirm whether recommendations were implemented in nine months. There were no inappropriate purchasing card transactions, but the card was not secured. Purchasing cards are convenient for making purchases for small Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 11 of 28 items or training registrations where invoicing is not possible. However, they also create risk because of the potential for inappropriate use. Staff could use the purchasing card to make disallowed or personal purchases without identification. The County Purchasing Card Policy F-3 requires card holders to only use cards for appropriate transactions and to keep cards secure. Disallowed purchases include cash, alcohol, tobacco, firearms, casinos, and meals while on travel status. The Clerk’s Office had three purchasing cards. Two mail cards were used exclusively for mail: one for mail associated with elections and the other for mail associated with recording. These mail cards were secured. The third card was used for other office purchases. In Fiscal Year 2023, there was $6,500 charged to the card used for office purchases. There were no inappropriate transactions on the card, but the card was not secured during working hours. (It was secured overnight.) The 2021 transition audit noted that the card was secure but recommending adding a log. Now the card is unsecured and there is a log. The log includes the date the card was signed out, who signed out the card, a description of the purchase, the dollar amount, and received date. The log does not replace keeping the card secure. 11. The Clerks' Office should assign someone to keep the payment card secured while continuing to use the log. The Office said that they secured the payment card during the audit. Auditors will follow up to confirm whether recommendations were implemented in nine months. The Clerk’s Office had performance measures, but they didn’t provide clear information about how well the Office functioned. Good performance measures tell a story of what an organization Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 12 of 28 does and how well it’s doing. Performance measures inform decisions, facilitate improvement, and increase understanding of programs. In government, they increase accountability by informing voters about whether programs are meeting expectations. When measures show subpar performance, they can lead to evaluations that identify root causes and fixes. Less than ideal performance measures impede these processes. The Government Finance Officer Association recommends that all governments identify, track, and communicate performance measures as a best practice. The Clerk’s Office reported performance measures on the County’s performance dashboard. Fiscal Year 2023 reporting was within range of benchmark counties considering the number of measures and content. The Office’s measures were good in that they included all activities the Office performs (record keeping and elections) and included both efficiency and outcome measures. But there was room for improvement. The efficiency measures were incomplete and lacked context given how they were reported. • Staff had not entered data for the measure associated with staffing compared to the number of pages recorded and left Figure II: Clerk’s Office Performance Measures. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 13 of 28 the report blank. Staff said that this was because the measure was only reported annually and not each quarter. • Staff to voter registration ratio was reported as “In Progress,” meaning it was reported as not achieved, even though the measure was within stated goals. • Cost per ballot tallied was reported but without any historical context for comparison. The outcome measures (percent of Record Center requests returned within 24 hours and percentage of high customer service ratings) were not aspirational. They were easier to read because they were reported as bar chats over the four quarters of the year. However, they also both showed 100 percent performance across the board, which may indicate a need for more ambitious goals. The Office said that the reporting software the County used for performance reporting was less convenient than what was used in the past. Reporting options were limited. For example, the staff to voter registration measure could only be reported as “in progress,” “true,” and “false.” The Office said that using “in progress” seemed just as applicable as using “true” or “false.” However, “true” may be more accurate given that they had met the goal. The Office said that they tracked some measures internally on spreadsheets with more detail. One option might be to report these results on their website as the Office of the District Attorney does. 12. The Clerk's Office should improve performance reporting by including data about staff to number of pages recorded, clarifying why staff to voter registration is “In-Progress” or changing status to “True”, and including historical context/goals in the narrative section to cost per ballot tallied. The Office said that they would replace the measure about staff Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 14 of 28 to number of pages recorded. Auditors will follow up to confirm whether recommendations were implemented in nine months. The Clerk’s Office still had not requested a change to County Code to move responsibility for the Weed Control program requirements to the Road Department Deschutes County Code 8.35.070 requires the Clerk to print and distribute copies of the Weed Control Program code to machine operators. It is confusing that aspects of the Weed Control Program are assigned to the Clerk’s Office. The 2021 transition audit recommended moving this responsibility to the Road Department which operates the Weed Control program. The process for a code change like this one is straightforward. The Legal department would draft an ordinance to propose the change with input from the Clerk’s Office. The ordinance would get a first hearing at a Board of County Commissioners meeting. Two weeks later, there would be a second hearing. Then if it was approved, the Legal department would implement the change. Over three years after the 2021 audit recommendation, the Office still has not implemented it. During this audit, the Office said they would request the change by June 2024. 13. The Clerk's Office should request that the Board of County Commissioners amend County Code to give responsibility to distribute copies of the code chapter about weed control to the Road Department. The Office said that the proposed ordinance change was scheduled for an upcoming Board of County Commissioners meeting. Auditors will follow up to confirm whether recommendations were implemented in nine months. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 15 of 28 Observations The door to the Clerk’s Office reception was repaired, making the space more welcoming. We included a review of office space in our overall review of risk. The Clerk’s Office had not received any Americans with Disabilities Act complaints in the past five years. Normally, the Clerk’s Office front entry doors are kept open with a magnetic mechanism. Americans with Disabilities Act standards require doors to be easy to open, requiring less than five pounds of force. Though the door was easy to open and in compliance with the law, the Clerk’s Office front entry door was kept closed at the time of the audit. Open doors are more welcoming. The door had been closed since the summer of 2023 because the emergency automatic closing switch was broken. The Clerk’s Office staff made a request to the Facilities Department to fix the door and followed up one time, but the door remained unrepaired for seven months. The issue came to light during the audit and the switch was repaired. Fixing the switch and keeping the door open made the Office more accessible. The Clerk’s Office has resolved all outstanding Homeland Security recommendations. The US Department of Homeland Security made confidential recommendations to the Clerk’s Office for security improvements. The 2021 transition audit noted that some of these recommendations had not been fully addressed. Since that time all recommendations have been closed or completed. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 16 of 28 3. Management Response County Clerk Date: May 29, 2024 To: Elizabeth Pape – County Internal Auditor, Aaron Kay – Performance Auditor From: Steve Dennison – County Clerk, Jeff Sageser – Recording Supervisor, Michael Lui – Elections Supervisor Re: Response to Clerk’s Office—Integrated Audit—23/24-14 No fraud was uncovered, but the Clerk’s Office had incomplete documentation for mitigating cash handling risks. 1. The Clerk’s Office should conduct a fraud risk assessment, and document outcomes. [Response] We agree with the auditors’ comments and will explore conducting a fraud risk assessment. 2. The Clerk’s Office should document and implement procedures to address fraud risks identified in the risk assessment. [Response] We agree with the auditors’ comments. Our Recording Procedure Manual will be updated to assign custody of all cash and the distribution of it. Due to frequency of transactions throughout the day, individualized cash drawers with lock and key are not feasible at this time. Each transaction is tied to a username and receipt, allowing for traceability of all activity throughout each day. Mail is opened in a quarantined area due to the possibility of suspicious or dangerous mail. No contents are extracted prior to distribution to various staff. Upon receipt, staff process mail according to department procedures; payments are immediately receipted and documented. Recording procedures will be supplemented and updated to focus on starting drawer balances and voiding transactions. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 17 of 28 The Clerk’s Office inconsistently complied with County rules for procurement. 3. The Clerk’s Office should consult with the new procurement staffer about procurement requirements. [Response] We agree with the auditors’ comments and will work with the county’s new procurement manager to ensure compliance to Contracting Code 2.37. It is also worth noting that the Board of County Commissioners allows the Clerk’s Office, through DCC 2.37.070 (B) (20), to award in any manner, including direct appointment or purchase, contracts for paper products which are specified to be used in conjunction with the County Clerk’s election ballot tabulation equipment. 4. The Clerk’s Office should conduct competitive procurements, put contracts in place, and get Administrator sign-off related to services identified in the audit. [Response] We agree with the auditors’ comments and will work with the county’s new procurement manager to put contracts in place. County Administrator sign-off is currently in place on purchases that exceed the approval threshold of $50,000. All invoices are paid through Munis with Finance and Administrator approval part of the automatic workflow before payment is issued. There were role conflicts within the Clerk’s office information system recording workflow. 5. The Clerk’s Office should analyze how often and when staff need to review a document they record and then decide whether recording and reviewing duties should be segregated. [Response] We agree with the auditors’ comments. The County Clerk’s Office projected that around 25% of the duties were not segregated at the time of the audit. From reports produced for the audit it was revealed about 30% of all recorded documents were recorded and verified by the same person. The Recording Department is mandated by Oregon law to daily receipt real property instruments between certain business hours (ORS 205.242). At times, there are limited staff due to vacations, family matters and medical appointments. With the duties of the Recording Department primarily divided between staff assisting walk-in customers and the other half answering phones, responding to emails and eRecording documents, segregated duties may affect the Department’s ability to Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 18 of 28 adhere to the County’s several “Everytime Standards”. In other words, the auditors’ recommendation for segregated duties may require the Clerk’s Office to lower its level of customer service: cancel passport appointments, delay walk-in customers needing marriage licenses, pause answering phones and emails in real-time and/or timely eRecording of documents. That being said, the Department sets honest and realistic expectations to achieve optimum results and will continue to do so. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. 6. If the Clerk’s Office decides record and review duties should be segregated, it should re-enable controls in the information system to enforce segregation. If the Office decides that duties should not be segregated, it should formally accept the risk by allowing role conflicts in a procedure. [Response] We agree with the auditors’ comments and the Clerk’s Office has adopted the recommendation to enable software controls to segregate recording and reviewing (verification), while maintaining the department’s current level of customer service. New software controls ensure no single person can record and verify their own work. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. Clerk’s Office staff could void their own receipts. 7. The Clerk’s Office should document workflow impacts of requiring supervisor approval of voided receipts including how often they happen and how long the process takes. After collecting this information, the Office should decide whether voids should require supervisor authorization. [Response] We agree with the auditors’ comments. As identified in the audit report, voided transactions are rare. Software controls were re-enabled to require supervisor approval of voided receipts. Prior to the supervisor approval feature being re-enabled, there had been compensating controls in place to reduce risks associated with staff voiding their own receipts. For example, customers would complain if they did not receive a document index number. The system did not allow documents to be recorded without an index number and payment. Staff would notice a missing index number because they were serialized. And lastly, security cameras are in place to capture all transactions and Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 19 of 28 when they take place. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. 8. If the Office decides that voids should require supervisor authorization, it should use controls in the information system to enforce authorization. If the Office decides that it will not require authorization, it should document compensating controls and formally accept the risks. [Response] We agree with the auditors’ comments. As identified in the audit report, voided transactions are rare. Software controls were re-enabled to require supervisor approval of voided receipts. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. The Clerk’s Office staff used a generic account with a shared password. 9. The Clerk's Office should review how staff use the generic account including how often it is used. [Response] We agree with the auditors’ comments and a review of the generic usernames and passwords was completed. PC login and recording information system generic passwords have been removed. Users now use their own credentials when logging into shared computers. The PC login generic username and password only allowed a user to log on to a computer. No access to public or personal drives were available. There was no access to email or Microsoft Teams or other areas of the county network. The audit should take into consideration how transactions are finalized and completed using additional applications such as ConvergePay (credit card provider) identifying customer names and users completing the transactions. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. 10. If the Office continues to use the generic account, it should formally accept and document the risks associated with its use. [Response] We agree with the auditors’ comments and have discontinued the use of a generic username and password for access to computers in the Clerk’s Office. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 20 of 28 The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. There were no inappropriate purchasing card transactions, but the card was not secured. 11. The Clerks' Office should assign someone to keep the payment card secured while continuing to use the log. [Response] We agree with the auditors’ comments and the Purchase Card is now secured under lock and key with the exception of when it is in use. The Clerk’s Office was quick to implement this recommendation and plans to keep in place going forward. The Clerk’s Office had performance measures, but they didn’t provide clear information about how well the Office functioned. 12. The Clerk's Office should improve performance reporting by including data about staff to number of pages recorded, clarifying why staff to voter registration is “In-Progress” or changing status to “True”, and including historical context/goals in the narrative section to cost per ballot tallied. [Response] We agree with part and disagree with another part of the auditors’ comments. We agree that listing “In-Progress” could be confusing to someone reviewing our performance measures. We disagree with the mention of how the measures are presented, such as historical context. The current format of an online reporting tool that only accepts text does not allow for the use of charts and graphs that would show year-over-year comparisons. Allowing for graphics in the reporting tool would enhance the value of the measures in place, but that is outside the scope of what the Clerk’s Office can change. The Clerk’s Office still had not requested a change to County Code to move responsibility for the Weed Control program requirements to the Road Department 13. The Clerk's Office should request that the Board of County Commissioners Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 21 of 28 amend County Code to give responsibility to distribute copies of the code chapter about weed control to the Road Department. [Response] We agree with the auditors’ comments. The proposed change was on the agenda for the Board of County Commissioners’ May 29 meeting and a public meeting was conducted. The commissioners closed the public meeting, deliberated and unanimously agreed with this change to the County Code. The proposed change is set for a second reading at a future BOCC meeting. Management Response [Response] The Clerk’s Office appreciates audits and values the feedback they provide. As a transparent office, we are open to continual input that allows us to make improvements. The Clerk’s Office’s management team worked collaboratively and extensively with the auditors to provide full access to information that contributed to this audit. It is important to note that many items highlighted in the audit for improvement were immediately addressed and resolved before the audit was finalized. From a historical perspective, the Clerk’s Office has maintained an excellent reputation among other county departments, cities, special districts, the community as a whole, and throughout the state. While this audit focuses on current survey-level risk assessment of administrative practices of our office, the history and positive reputation should be recognized. In the “Background” section of this audit, there is a focus on a very narrow timeframe in reporting staffing level and revenue trends. If this scope were expanded to show a broader time period, such as the last 20 years, the report would show that the Clerk’s Office has been a net contributor to the general fund with over 12 million dollars. During that same time period, staffing levels have remained consistent and not at all in alignment with the county growth. For instance, in 2003, the Clerk’s Office had 10.5 full time employees. In 2024, there are 11 FTE. The small increase in FTE can be contributed to skilled and trained staff as well as the utilization of technology. Throughout the audit, a focus was made on its cash handling practices. For context, a review of all financial transactions that took place in 2023 revealed that 0.77% of them were made with currency. Additionally, 19% of these transactions involved checks written to the county, 6.5% were credit card transactions credited to the county’s bank, and 74% were made via ACH transfer to the county’s bank. In other Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 22 of 28 words, less than 1% of all financial transactions in 2023 were actual currency being tendered that would require direct handling by staff. Approximately 80% of these transactions were bank-to-bank direct deposits and transfers. We agree with the audit that controls to mitigate theft need to be in place. As a result, the County Clerk’s Office Recording Department Procedures will need to be updated as additional forms of payment such as inter-fund transfers, credit card and ACH payments are now being received. Despite written procedures not being up to date, exposure to theft is minimized due to the nature of how revenue is received and processed. As many are aware, the County Clerk is an elected position in Deschutes County and takes an oath to uphold the United States Constitution and the laws of the State of Oregon. Employees within the Clerk’s Office also take the same oath. Moreover, statutes, administrative rules and county policy are our guard rails while serving the community. Equally as important is that we are accountable to our community, our customers and the residents of Deschutes County. This accountability is the common thread in all the services we provide. Among the many statutes, rules and county policies the Clerk’s Office include: • ORS 205.110(1), Duties of the county clerk – The county clerk in each county shall keep and maintain the records of the county governing body. • ORS 205.130(1), Recording duties of county clerk – Have the custody of, and safely keep and preserve, all files and records of deeds and mortgages of real property and a record of all maps, plats, contracts, powers of attorney and other interests affecting the title to real property required or permitted by law to be recorded. • OAR 166-150, Administrative Records – Since 2004, Deschutes County Clerk’s Office also oversees and supports many county departments with their records retention. County Archives/Records Center accepts records that are no longer needed to carry out day-to-day business activities from all county departments and other agencies. Staff follows Oregon Secretary of State – Archives Division Chapter 166-150 while discharging its duties. • ORS 246, Administration of Election Laws and Voting Recording Systems – The County Clerk is the chief election official of the County. The office plans, coordinates and conducts all elections in Deschutes Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 23 of 28 County. It ensures that elections are conducted according to statute and other related federal and state requirements. • GA-18, Retention of Original County Documents Policy – It is the policy of Deschutes County that original documents, relating to a real estate transaction or protection for an asset in which Deschutes County is a named party, be retained at the County Clerk’s Office. Currently, several million dollars of negotiable instruments are securely under management. In the “Observations” section of this audit, there is mention of a component of our lobby doors that was recently repaired. Prior to the repair, the doors were still in compliance with Americans with Disabilities Act requirements. It is noted in the auditors’ report that there have not been any Americans with Disabilities Act complaints in the past five years. To clarify further, we would like to highlight that there have been no complaints reported looking back beyond five years. Also, the auditors’ comments of “making the space more welcoming” and “Open doors are more welcoming” are subjective and a matter of opinion. These comments are not based on any customer or employee feedback. The County Clerk’s Office is honored to serve the public as the recorder and custodian of real property recording, issuer of marriage licenses, processor of passport applications, facilitator of the property value assessment appeals board and elections. The team of dedicated public servants in the Clerk’s Office are passionate about the work entrusted to them and continue to perform their duties securely, cost-effectively, efficiently, and at the highest standards possible in accordance with federal, state, and county laws. The office has a long track record of doing outstanding work while providing excellent customer service. The office’s mission statement is, “A professional, knowledgeable and friendly team that takes pride in its work, providing excellent and timely service to customers while embracing and actively meeting change.” Our team optimizes that statement every day. 4. Auditor Comments We appreciate the Clerk’s Office cooperation during the audit and Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 24 of 28 commitment to implementing the audit recommendations. Their expertise, insights, and documentation helped us conduct the audit and identify improvements. We are pleased to note that the Clerk’s Office agreed with all the recommendations. However, the Office’s response included some areas which we would like to address. 1. The response states that the County Administrator signs off on purchases that exceed the $50,000 threshold. The Office is referring to workflows within the County financial system that allow individual payments to proceed. The County Administrator did not approve contracts with the vendors mentioned in the audit, as required by DCC 2.37.060, because there were no contracts. The contract approval process would have ensured competitive procurements, required by state law, and contract provisions to lower risk to the County. 2. Recommendations 5, 7, and 9 recommend that the Office consider how often and why it conducts some information system practices that involve higher levels of risk. Documentation of the consideration should not take place in the audit response, rather it should live with documents that support the development of Office procedures. The reason this should not be restricted to the audit response is that auditors do not perform management roles and the decision for what level of risk to accept is a management function. For the subsequent recommendations (6, 8, and 10), the proposed procedures seem to conflict with the level of risk accepted in the preceding recommendation. For example: a. The responses to 5 and 6 state that segregating duties would require a lower level of customer service, but then state that enabling software controls to segregate recording and reviewing is possible while maintaining customer service levels. b. The responses to 7 and 8 state that there were compensating controls in place, but then state that the Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 25 of 28 Office would re-enable the requirement for supervisor sign-off. c. The responses to 9 and 10 are similar, stating that compensating controls were in place, but then agreeing to discontinue use of the generic username and password. 3. The finding related recommendation 9 (shared account and password) was referring to the Helion account (recording software), not a County active directory account. Discussion about access to drives, Outlook, or Teams accounts is not relevant. A shared credential to the County network is also concerning and against County policy. 4. County policy defines currency, check, and credit card payments as cash because all these instruments come with a higher level of risk than ACH payments. The number the Office shares for currency transactions (.77%) was not verified by auditors because County policy refers to all cash and not currency only. In closing, we thank the Clerk’s Office for its cooperation and professionalism throughout the audit. We look forward to verifying implementation of the recommendations when we follow up next year. 5. Appendix A: Objective, Scope, and Methodology The County Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 26 of 28 every relevant system, procedure, or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. Management has responsibility for the system of internal controls, including monitoring internal controls on an ongoing basis to ensure that any weaknesses or non-compliance are promptly identified and corrected. Internal controls provide reasonable but not absolute assurance that an organization’s goals and objectives will be achieved. Objectives and Scope Objectives included: 1. Review internal controls for cash handling with the Clerk’s Office as outlined in the section of County Finance policy for cash handling (F-7). Identify areas to improve efficiency and effectiveness. Additionally, review management of any change cash, petty cash, receipts, credit cards, judgements, collections, and billings, as applicable. 2. Identify top five vendors for the agency. Verify audit clause, licensing requirements, current insurance record. Review payment methods for vendors. Test against County Policy regarding payments to suppliers (F-15) and Deschutes County Code 2.37. 3. Use an information security checklist to test general level information security controls. Check against Federal Information Security Controls Audit Manual. 4. Review performance reporting from County dashboard and compare measures to prior reporting. Test against Government Finance Officers Association standards. Request back-up materials supporting reported goals and measures. 5. Review safety committee meeting materials for compliance “Audit objectives” define the goals of the audit. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 27 of 28 with Occupational Safety and Health Administration rules. Review any safety training records for regularity and compare them to active roster. Complete Americans with Disabilities Act checklist. Test against County policy regarding Americans with Disabilities notice and grievance policy (GA-13). 6. Identify the number of active employees and demographic information; vacancy rate (current and historic); current turnover rate; employee evaluation completion. Compare trends over time and to County averages. 7. Determine budgetary significance of grants for the agency. Review selected grant agreements. Test against County policy regarding grant applications and administration (GA- 20). 8. Be aware of any issues with compliance with federal and state regulations and requirements, as may be applicable. We did not report findings related to objective six because there were too few employees in the Clerk’s Office to draw meaningful conclusions about employee information. We did not report findings about objective seven because the Clerk’s Office did not have any grants. Scope and timing: The audit occurred in February – May 2024. It included activity in Fiscal Year 2023 and the first half of Fiscal Year 2024. Methodology Audit procedures included: • Interviewing staff about cash handling, information systems, purchasing, performance measurement, and physical security and safety. • Reviewing documents provided including policies and procedures, performance measures, vendor contracts, and purchasing card documentation. Audit procedures are created to address the audit objectives. Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Page 28 of 28 • Reviewing user roles and reports in Helion, the information system used for receipts. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) Clerk’s Office—Integrated Audit—23/24-14 June 2024 Deschutes County Office of the Internal Auditor Please take a survey on this report by clicking this link: https://forms.office.com/g/GPg7NE3yRf Or use this QR Code: If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.