HomeMy WebLinkAbout2223-1 2022 Global Follow-up report (Final 12-15-22)2022 Global Follow-up Report #22/23-1 December 2022 2022 Global Follow-up Report Outstanding recommendations – Administration, CDD, Health Services, Human Resources, and Treasurer/Finance To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@deschutescounty.gov Deschutes County, Oregon The Office of County Internal Audit David Givans, CPA, CIA - County Internal Auditor Aaron Kay – Performance Auditor internal.audit@deschutescounty.gov Audit committee: Daryl Parrish, Chair - Public member Jodi Burch - Public member Joe Healy - Public member Scott Reich - Public member Summer Sears - Public member Stan Turel - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director
2022 Global Follow-up Report #22/23-1 December 2022 TABLE OF CONTENTS: 1. INTRODUCTION 1.1. Background on Audit …………………..………………………………..……………….... 1 1.2. Objectives and Scope ……………….…………………..…………………..……………… 1 1.3. Methodology …………………………………….…………………………………………… 1-3 2. FOLLOW-UP RESULTS …………………….………………..………………………….….… 3-9 APPENDIX I – Updated workplan for identified outstanding recommendations (Status as of December 2022) ….................................. 10-20
2022 Global Follow-up Report #22/23-1 December 2022 Page 1 1. Introduction 1.1 BACKGROUND ON AUDIT Audit Authority: The Deschutes County Audit Committee has suggested that follow-ups occur within nine months of the reports. The Audit Committee would like to make sure departments satisfactorily address prior recommendations that have not been completed at the time of the initial or subsequent follow-ups. This is the fourteenth annual global follow-up looking back to unresolved recommendations in prior follow-ups. 1.2 OBJECTIVES and SCOPE “Audit objectives” define the goals of the audit. Objectives: The objective was to follow-up on previously incomplete recommendations. Scope: This 2022 Global follow-up included reports with incomplete recommendations that did not have a follow-up report completed in approximately a year. The audit reports in TABLE I are covered in this report. There are thirty-seven (37) recommendations included in this follow-up over nine (9) audit reports. (as compared to fifteen recommendations covering six reports in the prior year). Status was determined through information provided by departments in December 2022. The original internal reports should be referenced for the full text of recommendations and associated discussion. All internal audit performance reports are published on the County website at https://www.deschutes.org/administration/page/internal-audit-reports 1.3 METHODOLOGY The follow-up report was developed from information provided by appropriate staff in the associated departments. In cases where recommendations have not been implemented, comments were sought for the reasons why and the timing for addressing these. The follow-ups are, by nature, subjective. In
2022 Global Follow-up Report #22/23-1 December 2022 Page 2 Table I Reports and number of recommendations included in follow-up {Original reports hyperlinked} determining the status of recommendations that were followed up, we relied on assertions provided by those involved and did not attempt to independently verify those assertions. It is understandable that some of these recommendations will take more than one year to be completed. Departments should be acknowledged for the work and commitment to address the recommendations. Since no substantive audit work was performed, Government Auditing Standards issued by the Comptroller General of the United States were not followed. Department / Area Original Report # Date Report Issued Last Follow-up Report Last Follow-up Date # of Original Recommendations # Recommendations in this follow-up % of Original Administration – COVA Report on Spending 06/07-1 Nov-06 07/08-1 Aug-07 17 1 6% Administration – Gas Control Cards 07/08-5 Jul-08 09/10-1 Jul-09 9 1 11% Administration –Verizon Cellular Costs 17/18-5 Mar-20 20/21-5 Dec-20 9 5 56% Health Services – Fiscal Revenue Controls 17/18-8 Oct-18 19/20-2 Aug-19 23 4 17% Treasurer/Finance Director Transition 19/20-1 Dec-19 20/21-1 Sep-20 22 2 9%
2022 Global Follow-up Report #22/23-1 December 2022 Page 3 Table I Continued Department / Area Original Report # Date Report Issued Last Follow-up Report Last Follow-up Date # of Original Recommendations # Recommendations in this follow-up % of Original Human Resources - Cash Handling 19/20-4 Sep-20 20/21-2 Sep-20 14 1 14% Finance- Munis Purchasing Topics Part I – Security and workflows (NEW) 19/20-9 Jan-21 21/22-4 Oct-21 18 17 94% CDD – Cash Handling (NEW) 19/20-10 Jun-20 20/21-7 Jun-21 2 1 50% Finance- Munis Purchasing Topics Part II – Vendor master (NEW) 20/21-6 Mar-21 21/22-8 Mar-22 12 6 50% Totals 126 37 29% 2. Follow-up Results Coming into the follow-up The follow-up includes thirty-seven (37) recommendations made over nine internal audit reports. The number of recommendations followed up on was up from fifteen (15) in 2021. The number of outstanding recommendations represented twenty-one percent (29%) of the original recommendations (up from 21% in 2021). For some of the reports, more than one follow-up has
2022 Global Follow-up Report #22/23-1 December 2022 Page 4 Figure I - How were recommendations implemented? occurred. There are three new follow-up audits included in this Global follow-up with twenty-four outstanding recommendations. A few completed reports had follow-ups that completed all recommendations in the first follow-up, so no additional follow-ups are required. Follow-up results The follow-up indicates that eleven (11) of these outstanding recommendations (or 30%) have been completed. This compares with twenty-seven (27%) percent in 2021. Sixty-two percent (62%) of the reviewed recommendations are still underway for implementation. This compares with sixty-seven percent (67%) of the reviewed recommendations still underway for implementation in 2021. Eight percent (8%) of the reviewed recommendations were still planned, compared to six (6%) percent in 2021. Implementation is expected to take time for some recommendations, but the idea would be to have these incomplete recommendations resolved as soon as practicable. Generally, there is a natural progression seen as “planned” implementation moves into an “underway” status and then to “completed”. Figure I provides a summary of the change in status for these followed up recommendations.
2022 Global Follow-up Report #22/23-1 December 2022 Page 5 Figure II - Percentage of completion in each recommendation category by follow up Prior Follow-up progress Current Follow-up progress A detailed listing of all the recommendations followed up on and their status is included at the end of the report in Appendix I. In interpreting the status, the County Internal Auditor may sometimes raise or lower the status provided by the department based on the communication(s) received from the department. Figure II provides a breakdown of the completion status of these recommendations by audit report. It illustrates progress made towards completion in the time between each follow up report.
2022 Global Follow-up Report #22/23-1 December 2022 Page 6 Figure III - How has the status changed for outstanding recommendations? No change from prior status Moved to Complete Figure III indicates the movement within the status of recommendations coming into this follow-up and progression from one category to another. Lack of movement does not necessarily mean that no work was performed, but that it has not moved from one category to another. The number of recommendations per audit report included in this follow-up are found within the parentheses. Table II indicates for these reports 79% of the original recommendations accepted have been deemed completed. This does not include all the reports fully completed (over this period) and not part of the global follow-up. In 2021, the global follow-up completion rate was 85%. After this follow-up, twenty-one percent (21%) of the original recommendations for these reports are still outstanding. Two of four recommendations were completed, while two changed from planned to underway.
2022 Global Follow-up Report #22/23-1 December 2022 Page 7 Table II Reports, number of recommendations included in follow-up, and percentage still outstanding Department / Area Original Report # # of Original Recommendations # Recommendations in this follow-up % of Original # of Recommendations Still Outstanding % Outstanding Administration – COVA Report on Spending 06/07-1 17 1 6% 0 0% Administration – Gas Control Cards 07/08-5 9 1 11% 0 0% Administration – Verizon Cellular Costs 17/18-5 9 5 56% 5 56% Health Services – Fiscal Revenue Controls 17/18-8 23 4 17% 0 0% Treasurer/Finance Director Transition 19/20-1 22 1 5% 1 5% Human Resources - Cash Handling 19/20-4 14 1 7% 1 7% Finance- Munis Purchasing Topics Part I – Security and workflows (NEW) 19/20-9 18 17 94% 14 78% CDD – Cash Handling (NEW) 19/20-10 2 1 50% 1 50% Finance- Munis Purchasing Topics Part II – Vendor master (NEW) 20/21-6 12 6 50% 4 33% Totals 126 37 29% 26 21%
2022 Global Follow-up Report #22/23-1 December 2022 Page 8 2022 Three-Year Implementation Rate Implementation rates are similar to completion rates. However, from an organizational standpoint more than a year is generally accepted for implementing recommendations. The Government Accountability Office (GAO) in their FY 2022 Performance and Accountability report, use a four-year time period and had a 77% implementation rate. The calculations below for Deschutes County for 2022 use a three-year period and come up with a 68% implementation rate for the included audit reports. Figure IV1 shows the implementation rate of accepted recommendations for the 14 reports issued in the last three years and that have come up for follow-up. The number of recommendations for this three-year period was 145, with 99 of those recommendations having been completed, and 46 recommendations still outstanding. 1 While the same nine audits with follow-up reports are listed in Figure I through Figure III. Figure IV includes eight reports not included in Figure III.
2022 Global Follow-up Report #22/23-1 December 2022 Page 9 Figure IV Status of recommendations for reports that have come up for follow-up for the prior three years.
2022 Global Follow-up Report #22/23-1 December 2022 Page 10 APPENDIX Appendix I – Updated workplan for identifed outstanding recommendations. (status as of December 2022) Items that are not complete are grayed out. Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 1 Administration/Cell Audit work group - Verizon Cellular Costs 17/18-5 1 It is recommended for the County to consider updating the Cell Phone Policy to address management and expectations around utilization. This would include monitoring and routine assessment as to whether an employee truly needs the device/phone, what services, and what plan best fits their intended usage. Underway Underway This project was put on the back burner during COVID. Now, with the transition of the IT Department to Deputy County Administrator Whitney Hale, Whitney will pick the project back up. Jul-23 2 Administration/Cell Audit work group - Verizon Cellular Costs 17/18-5 6 It is recommended for departments to periodically review their cellular plans by line to align them with plan design, device, availability, usage, and cost. Underway Underway This project was put on the back burner during COVID. Now, with the transition of the IT Department to Deputy County Administrator Whitney Hale, Whitney will pick the project back up. Jul-23
2022 Global Follow-up Report #22/23-1 December 2022 Page 11 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 3 Administration/Cell Audit work group - Verizon Cellular Costs 17/18-5 7 It is recommended for the County to consider updating policies regarding cellular devices to improve adherence to policy, reduce costs, and reduce risks. The policy improvements should consider addressing: • relationship of stipend levels to the cost of cellular phone services to the County; • developing plan selection criteria for business needs aligned with anticipated usage to right size costs; • developing legal and information technology framework to assure that technologies, data, and security are aligned and appropriate given the rise in new technologies and software; • criteria for selecting between employee phone (stipend) and County owned phone; • monitoring and modification of plan levels (including elimination of devices) for actual usage below anticipated; • utilizing free devices and upgrades to maintain the level of technology as well as getting credits for devices sold back. • establishing when devices require mandatory applications and restrictions from modification for protecting data; and • addressing applicability of policy to non-employee users. Underway Underway This project was put on the back burner during COVID. Now, with the transition of the IT Department to Deputy County Administrator Whitney Hale, Whitney will pick the project back up. Jul-23
2022 Global Follow-up Report #22/23-1 December 2022 Page 12 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 4 Administration/Cell Audit work group - Verizon Cellular Costs 17/18-5 8 It is recommended the County consider how to address the risks that come with allowing mobile device access or external computer access to internal County information and who and how the risks will be mitigated. Underway Underway This project was put on the back burner during COVID. Now, with the transition of the IT Department to Deputy County Administrator Whitney Hale, Whitney will pick the project back up. Jul-23 5 Administration/Cell Audit work group - Verizon Cellular Costs 17/18-5 9 It is recommended the County provided forms for cell phone allowance be updated to reflect any updated policy language. Underway Underway This project was put on the back burner during COVID. Now, with the transition of the IT Department to Deputy County Administrator Whitney Hale, Whitney will pick the project back up. Jul-23 6 Health Services - Fiscal Revenue Controls 17/18-8 4 It is recommended for the billing manager to develop written procedures for staff on billing and collections procedures including how to properly process and apply payments received. Underway Completed Updated and streamlined the existing policy/procedure we had to add more detail and incorporate some of the items that David Givans discussed, but I am working on a brand-new policy/procedure for a number of items to address the payments, collections, and general patient account oversight which is above and beyond what was requested in the audit. 7 Health Services - Fiscal Revenue Controls 17/18-8 13 It is recommended for the Department to develop written policies and procedures over the billing and collection oversight activities. Underway Completed This was ultimately included with the above recommendation since it would be all encompassing. See above.
2022 Global Follow-up Report #22/23-1 December 2022 Page 13 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 8 Health Services - Fiscal Revenue Controls 17/18-8 14 It is recommended for the Administrative Services Division (or selected supervisors) periodically audit gift card accounting in a comprehensive way and periodically check custody logs for completeness and accuracy. Underway Completed A Gift Card Policy/Procedure needed to be drafted and published since there were no written guidelines around the custody of gift cards. All of this has been completed. The policy/procedure outlines expectations that audits will be done quarterly and my internal communication to the department was that these would start in FY23. We now have better controls, guidelines, policies, and procedures around gift cards than our department ever has. 9 Health Services - Fiscal Revenue Controls 17/18-8 21 It is recommended for the department to update their fiscal policies and procedures. Underway Completed We have an entire folder of procedures and policies that did not exist at the time of this audit. I am in the process of creating a policy/procedure document that can be published on SharePoint for other people to read but our internal processes, which have never been documented, are now documented, and all existing policies/procedures have either been replaced, updated, or new ones are being drafted. 10 Treasurer/Finance Director Transition 19/20-1 9 It is recommended for the Treasurer to develop a written system of internal control over the investments covering the investment policy requirements and those issues identified above. Planned Planned Treasurer position is up for election in November 2022. Prior recommendations will be shared with the incoming Treasurer elect. Jun-23
2022 Global Follow-up Report #22/23-1 December 2022 Page 14 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 11 Human Resources - Cash Handling 19/20-4 10 It is recommended for Human Resources to consider using Munis to enter and provide receipts and bill and manage receivables. Underway Underway Project was paused due to turnover and will be discussed with new CFO. Mar-23 12 Finance - Munis Purchasing - Security and workflows 1920-9 1 It is recommended for segregation of duties to be considered in the overall design of roles given to users. Underway Underway Munis business systems administrator hired January 2022, attended Tyler training in May 2022, and is currently evaluating design of Munis roles. As new roles are assigned, segregation of duties is being evaluated. As capacity permits, Finance and IT plan to establish periodic review of roles. 13 Finance - Munis Purchasing - Security and workflows 1920-9 2 It is recommended Finance segregate significant duties within the system and provide greater guidance on approvals. This might include additional policy and procedural requirements to discourage self-approvals and further describe proper forwarding of approvals. Underway Underway Finance and IT have setup new Munis helpdesk to assist users and provide training tools. With Munis upgrade occurring July 2023, we are planning to provide additional training and guidance. Jul-23 14 Finance - Munis Purchasing - Security and workflows 1920-9 3 It is recommended that periodically IT and Finance join forces to perform a segregation of duties review by user of their assigned permissions. Internal audit can provide guidance on how to carry out this review. Underway Underway Accounting manager and new Munis business systems administrator are reviewing on case by case basis. As capacity permits, Finance and IT plan to establish periodic review of roles.
2022 Global Follow-up Report #22/23-1 December 2022 Page 15 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 15 Finance - Munis Purchasing - Security and workflows 1920-9 4 It is recommended for the County to consider how it might address the additional resources (staffing time) necessary to help Finance and IT maintain ongoing support; document systems controls (such as roles and workflows); and reinforce segregation of duties. Underway Completed Munis business systems administrator hired January 2022. 16 Finance - Munis Purchasing - Security and workflows 1920-9 5 It is recommended periodically IT and Finance review the history for the “Munis” roles and make sure that it is not being assigned without reason and that it is not being used to approve any transactions. Underway Underway As capacity permits, Finance and IT plan to establish periodic review of roles. 17 Finance - Munis Purchasing - Security and workflows 1920-9 6 It is recommended for the procedures for establishing new Munis users be updated to include a provision to include the association with their employee number, if applicable. Underway Underway As capacity permits, Finance and IT plan to update employees without number included. 18 Finance - Munis Purchasing - Security and workflows 1920-9 7 It is recommended for the County Administrator be included in workflow for all disbursements in excess of department limits. Underway Underway Finance evaluating cost/benefit of adding County Administrator into workflow. Finance working on updating policies to align with Munis and current processes.
2022 Global Follow-up Report #22/23-1 December 2022 Page 16 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 19 Finance - Munis Purchasing - Security and workflows 1920-9 8 It is recommended the Board of County Commissioners have the County Administrator (or designee) review all payments over $150 thousand before they go to them. Underway Completed As part of the BOCC meeting agenda review, the CAO reviews requests for BOCC approval for payments/contracts over $150 thousand. In additional Legal reviews contracts for legal sufficiency and adherence to the Deschutes County public contracting code. 20 Finance - Munis Purchasing - Security and workflows 1920-9 9 It is recommended the County Administrator (or designee) receive the Finance designed disbursement control reports on at least a monthly basis and review for any anomalies (approvals made without the County Administrator or Board designee). The Information Technology department should assure the monitoring reports are working as designed. Underway Underway Report is being forwarded weekly to County Admin and BOCC. Munis business systems administrator to evaluate if this report can be sent automatically from the system. 21 Finance - Munis Purchasing - Security and workflows 1920-9 10 It is recommended for the Board of County Commissioners (or designee) assure that disbursements over $150 thousand have their approval. They might consider staffing this review through Administration/BOCC to lend additional segregation of duties over Finance. Underway Completed The CFO reviews all Munis requests over $150 thousand to ensure proper approval prior to forwarding to CAO through Munis workflow.
2022 Global Follow-up Report #22/23-1 December 2022 Page 17 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 22 Finance - Munis Purchasing - Security and workflows 1920-9 11 It is recommended the Board of County Commissioners clarify by policy (perhaps in Policy F-15 – Department purchasing thresholds) that the purchasing approval thresholds also apply to all payments being made and excluding certain payments that by statute can be made by the County Treasurer. It would also be a place where they direct whether the County Administrator should review and approve any payments coming to them for approval. Underway Underway With new CFO hired September 2022, finance team is starting process to update all Finance policies. 23 Finance - Munis Purchasing - Security and workflows 1920-9 12 It is recommended for Finance to work with departments on the rollout of using the purchase card rebate program and who should benefit from the purchase card rebate. Underway Underway With new CFO hired September 2022, current use of rebate program is under review. 24 Finance - Munis Purchasing - Security and workflows 1920-9 13 It is recommended for the department considering use of a purchase card to see what payment arrangements can be made with their vendor that maximizes the potential discount on timely payment. Underway Underway With new CFO hired September 2022, current use of rebate program is under review. 25 Finance - Munis Purchasing - Security and workflows 1920-9 14 It is recommended for vendors who are to be setup for payment through purchase card be setup from the beginning by the department. Underway Underway With new CFO hired September 2022, current use of rebate program is under review.
2022 Global Follow-up Report #22/23-1 December 2022 Page 18 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 26 Finance - Munis Purchasing - Security and workflows 1920-9 15 It is recommended for Finance to regularly collect on purchase card rebates and post them to the County accounting records. Underway Underway With new CFO hired September 2022, current use of rebate program is under review. 27 Finance - Munis Purchasing - Security and workflows 1920-9 17 It is recommended for the County to consider some of the workflows they have not been using. Underway Underway As capacity permits, Finance and IT will review workflows not being utilized. 28 Finance - Munis Purchasing - Security and workflows 1920-9 18 It is recommended for the County to consider and document how they are controlling roles, permissions, and workflows for Munis. Underway Underway As capacity permits, Finance and IT plan to establish periodic review of roles which will include documenting the evaluation process. 29 Finance - Munis Purchasing - Vendor master 2021-6 2 It is recommended for the County to consider how to implement electronic signatures across County departments and functions based on the associated risks and requirements. Planned Planned Under consideration. 30 Finance - Munis Purchasing - Vendor master 2021-6 3 It is recommended for Finance to consider establishing vendor self-service to collect vendor information directly from vendors. The self-service modules provided by Munis have varying degrees of success and choosing to use vendor self-service will require additional research to see if adoption is worthwhile at this time. Planned Completed Accounting manage evaluated vendor self-service during Tyler training in May 2022. Finance has decided not to move forward with the module as this time. Finance will continue to re-evaluate as Tyler releases improvements to Vendor self-service module.
2022 Global Follow-up Report #22/23-1 December 2022 Page 19 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 31 Finance - Munis Purchasing - Vendor master 2021-6 6 It is recommended all vendors be setup to search for duplicate invoices. Underway Completed A feature in Munis allows vendors to post duplicate invoices. This is a default feature on vendor set up but intended to be used only for vendors that provide statements rather than traditional invoices (i.e., utility companies). The Finance Department is reviewing all vendors and leaving the feature active for only those that it applies. We expect the exercise to be completed within the next 60 days. 32 Finance - Munis Purchasing - Vendor master 2021-6 10 It is recommended that Finance and County departments investigate if they are receiving all of the discounts they can get by paying in a timely manner. Planned Underway Finance and IT have setup new Munis helpdesk to assist users and provide training tools. With Munis upgrade occurring July 2023, we are planning to provide additional training and guidance. 33 Finance - Munis Purchasing - Vendor master 2021-6 11 It is recommended for Finance to work with departments to utilize the discounts field when discounts are available. Planned Underway Finance and IT have setup new Munis helpdesk to assist users and provide training tools. With Munis upgrade occurring July 2023, we are planning to provide additional training and guidance.
2022 Global Follow-up Report #22/23-1 December 2022 Page 20 Count Dept./Responsible Party - Audit Title Audit # Rec # Recommendation Prior or Original Status New Status New Comments New Estimated Date 34 Finance - Munis Purchasing - Vendor master 2021-6 12 It is suggested that vendors be evaluated as to whether a better type could be assigned that better reflects the service or product they provide. Planned Planned Finance and IT have setup new Munis helpdesk to assist users and provide training tools. With Munis upgrade occurring July 2023, we are planning to provide additional training and guidance. 35 CDD - Cash Handling 1920-10 2 It is recommended the County consider updating fiscal policy to allow Finance the authority to manage increases and decreases in petty cash. Underway Underway With new CFO hired September 2022, finance team is starting process to update all Finance policies. 36 Administration - COVA Report on Spending 0607-1 15 It is recommended the County develop appropriate performance measures (such as real room tax growth) to monitor COVA’s performance. The County should develop a cost benefit analysis as to whether the monies provide a reasonable return to the funds expended. Underway Completed Admin and Finance will continue working with COVA on metrics, including suggestions from the Budget Committee. 37 Administration - Gas Card Controls 0708-15 7 The County should consider for fuel purchases whether it could negotiate better pricing for fuel at the locations it would like to use. Underway Completed This recommendation was considered and no changes to this process are anticipated. Note: bulk fuel purchased by the Road Department goes through the bidding out process for each load of fuel. {End of Report}