Okaloosa County BOCC — January 18, 2013 — reading text

and funded from tourist development taxes or BP grant funds, disclosed 5 transactions (8.3 percent), totaling $4,180.68, that were incorrectly classified and recorded by object or sub-object codes. Additionally, County records supporting many payments made to the two advertising and marketing firms were inadequate to determine whether the payments were classified and recorded correctly. However, based on available supporting documentation at the time of payment and additional documentation subsequently obtained by the County, we noted several payments to the firms that were incorrectly classified and recorded by object or sub-object codes. Examples of payments that were incorrectly classified and recorded included the following: The County purchased two recreational vehicles for a total of $94,766. The recreational vehicles were purchased for the TDC to use in advertising projects and marketing campaigns. These expenditures were incorrectly classified and recorded as operating expenditures (contracted services – public relations) rather than as capital outlay expenditures (machinery and equipment). The County purchased an exterior marquee for the convention center for $81,237.50 that was incorrectly classified and recorded as an operating expenditure (contracted services – advertising) rather than as a capital outlay expenditure (infrastructure). The County purchased two televisions for a total of $2,208.88. The televisions were purchased to be used in the recreational vehicles noted above. These expenditures were incorrectly classified and recorded as operating expenditures (motor vehicle repair and maintenance) rather than as capital outlay expenditures (machinery and equipment). County personnel indicated that payments made to the two advertising and marketing firms were often coded to contracted services – advertising regardless of the purpose of the payments. When expenditures are not correctly classified and recorded in the accounting records, management may draw incorrect conclusions about the activities funded from restricted resources such as tourist development taxes and BP grant funds, and their ability to make informed decisions based upon these records may be compromised. 25 Packet Pg. 359  9.1.a ****PRELIMINARY AND TENTATIVE FINDINGS**** Recommendation: The County should strengthen its procedures to ensure that expenditures are properly classified and recorded in accordance with the . Electronic Funds Transfers Finding No. 23: Controls Over Electronic Funds Transfers Attachment: Attorney General P&T Audit (1278 : Response to the Auditor General's Report) Section 668.006, Florida Statutes, requires the head of each agency to implement control processes and procedures to ensure adequate integrity, security, confidentiality, and auditability of business transactions conducted using electronic commerce. The County used electronic funds transfers (EFTs) to make certain types payments, including payments to vendors and banking institutions, and had established a funds transfer agreement with a bank to provide these services. County records indicated that 13 EFTs, totaling $15.5 million, were made during the period May 2010 through May 2012 that involved tourist development taxes or funds received from BP. Our review disclosed that the County needed to strengthen its controls over EFTs as follows: The BCC had not developed written policies and procedures regarding the authorization and processing of EFTs, contrary to law. Employees that could initiate wire transfers also had the ability to record journal entries in the accounting system, allowing them both access to County assets and the accounting records for these assets. The funds transfer agreement with the bank allowed authorized users designated by the CCC to electronically initiate EFTs without the approval of another employee before the funds were transferred. The funds transfer agreement with the bank did not restrict the locations where County funds could be transferred, allowed nonrepetitive EFTs up to $20,000,000, and allowed unlimited dollar amounts of repetitive EFTs. The funds transfer agreement with the bank had not been updated to reflect changes in CCC personnel and authorized an employee who terminated with the CCC in May 2005 to initiate and approve EFTs. While our tests did not disclose any EFTs that were made for unauthorized purposes, such tests cannot substitute for management?s responsibility to establish effective internal controls. Without written policies and procedures and effective controls governing EFT activities, the County is at an increased risk that unauthorized transfers could occur and not be timely detected. In September 2012, the CCC updated its funds transfer agreement with the bank to delete the terminated employee noted above. Recommendation: The BCC should develop written policies and procedures addressing EFTs as required by Section 668.006, Florida Statutes, including providing for an adequate separation of duties over access to County assets and the related accounting records, and documenting independent approvals before the funds are transferred. In addition, the CCC should revise its funds transfer agreement with the bank to address the deficiencies noted above and timely update its funds transfer agreement with the bank when changes in authorized personnel occur. Information Technology Controls Finding No. 24: Access Controls Access controls are intended to protect data and information technology (IT) resources from unauthorized disclosure, modification, creation, or destruction. Effective access controls provide employees access to IT resources based on a 26 Packet Pg. 360  9.1.a ****PRELIMINARY AND TENTATIVE FINDINGS**** demonstrated need to view, change, add, or delete data. Further, effective access controls provide employees access privileges that restrict employees from performing incompatible functions or functions outside of their area of responsibility. Periodically reviewing the appropriateness of IT access privileges assigned to employees promotes good internal control and is necessary to ensure that employees cannot access IT resources inconsistent with their assigned job responsibilities. As part of our review of the County?s expenditure payment process, we noted certain deficiencies in access controls as follows: Attachment: Attorney General P&T Audit (1278 : Response to the Auditor General's Report) All employees in the CCC?s Finance Department, including accounts payable and payroll employees, had the ability to record journal entries. However, CCC procedures did not provide for an independent review of all journal entries recorded in the accounting system to determine that the journal entries were properly authorized. County IT personnel indicated that, due to software limitations, an employee?s ability to record journal entries could not be limited without also limiting the employee?s ability to view certain accounting records. Two CCC payroll employees and the CCC?s Financial Services Manager had the ability to record pay rate and other changes in the payroll system. These employees also had the ability to process payroll transactions and print payroll checks. However, CCC procedures did not provide for an independent review of all changes recorded in the payroll system to determine that the changes were properly authorized by the Human Resources Department. Two CCC accounts payable employees had the ability to add new vendors and make other changes in the master vendor file. These employees also had the ability to process and pay vendor invoices, and print and distribute checks to vendors. However, CCC procedures did not provide for an independent review of all changes made to the master vendor file to determine that the changes were properly authorized by the Purchasing Department. We also noted that end-user departments were not routinely required to review employee access privileges to County resources (e.g., accounting records, payroll system data, master vendor files) to determine whether these access privileges were necessary and appropriate given an employee?s job responsibilities. Without such reviews, unnecessary or incompatible access privileges may not be timely detected and addressed by the County, increasing the risk of unauthorized disclosure, modification, creation, or destruction of data and IT resources. Recommendation: The County should strengthen its procedures to include the periodic review of access privileges granted to employees and timely remove or modify unnecessary or incompatible access privileges detected. Public Records Finding No. 25: TDC and TDC Subcommittee Meeting Minutes Section 286.011, Florida Statutes, commonly referred to as the Sunshine Law, requires that minutes of public board or commission meetings be promptly recorded and open to public inspection. Florida?s Government-in-the-Sunshine Manual, compiled by the Florida Attorney General?s Office, further provides that advisory boards and committees created by public agencies may be subject to the Sunshine Law, even though their recommendations are not binding upon the entities that create them. When an advisory board or committee has been delegated decision-making authority as opposed to mere information-gathering or fact-finding authority, their meetings must be open to public scrutiny, regardless of the review procedures eventually used by the traditional governmental body. 27 Packet Pg. 361  9.1.a ****PRELIMINARY AND TENTATIVE FINDINGS**** The TDC is responsible for advising the BCC on the implementation of its tourist development plan, including making recommendations to the BCC regarding the effective use of tourist development taxes. In carrying out its responsibilities, the TDC established two standing subcommittees that met during the period May 2010 through May 2012. The Promotion Review Subcommittee met periodically until October 2010 when it was disbanded. The Marketing Subcommittee was then formed and began meeting in May 2011. The stated responsibilities of both subcommittees included reviewing and recommending advertising and marketing consultants to the TDC and reviewing and recommending specific tourism marketing proposals presented to the TDC by private industry and