Okaloosa County BOCC — November 16, 2013 — Carr, Riggs, & Ingram Internal Audit Report — reading text

Okaloosa County Report on Risk Assessment mn C RI] CARR Carr, Riggs & Ingram, LLC RIGGS & 500 Grand Boulevard INGRAM Suite 210 CPAs and Advisors Miramar Beach, Florida 32550 (850) 837-3141 (850) 654-4619 (fax) www.cricpa.com August 26, 2013 To the Board of County Commissioners 1804 Lewis Turner Blvd, Suite 100 Ft. Walton Beach, FL 32547 Gentlemen: You selected our firm to review entity-wide internal controls, fraud risk assessment and overall risk assessment for Okaloosa County and our report is attached. We appreciate the opportunity to work with Okaloosa County (the County) during this painful but necessary time of reflection and review. The purpose of this letter is to discuss “big picture” matters regarding the County’s financial reporting process. We consider our discussion here to be an integral part of our risk assessment report which addresses specific recommendations. An organization’s culture and “tone at the top” are inherently difficult to define and one’s conclusions are subjective. The “tone at the top” is the most important component of an organization’s control environment. A commitment to accountability, integrity and ethics is paramount. We believe unless meaningful changes are made in how the Clerk of Court's office and Finance Director function and operate, the next TDC theft is either happening now or can happen in the future. Without change, the next very public theft at the County level is not a matter of IF, but a matter of WHEN. The County must have systems in place to either prevent or more quickly detect theft and other errors in this County. The systems currently in place are insufficient due to the current financial reporting structure of the County. Many of us have asked ourselves how we got to this point. As we work through that question from a financial reporting perspective, we try to identify the places and the processes that are not adequate to prevent or detect certain errors, omissions or theft. While there were numerous breakdowns in the process, we have come to the conclusion the most significant breakdown was in ownership and responsibility from those charged with maintaining the County's financial records. Pursuant to the State of Florida Constitution and Statute, the Clerk of Court (the Clerk) is charged with being the ex officio clerk of the Board of County Commissioners (the BCC), county auditor and custodian or treasurer of all county funds. There is a reason the Clerk's Finance Director attends every BCC meeting. Prior to this engagement, we have kept up to date with the events surrounding the Tourist Development District and have internally analyzed this issue at length. Following the hearings with the Florida Joint Legislative Audit Committee, we made the observation there were many assumptions of oversight by (1) the Clerk of Court (the Clerk), (2) the liaison from Board of County Commissioners and (3) the Tourist Development Council (the TDC) that have us where we are today. This is oversimplified, but is an explanation of how Mr. Bellinger was able to commit such a significant fraud. The TDC assumed the Clerk was reviewing all invoices to ensure everything was accurate and they assumed there was some involvement from the BCC liaison. The BCC liaison assumed the Clerk’s office and the TDC were ensuring everything was correct and was not privy to the financial records of the TDC. The Clerk assumed signatures on a request for payment were an authorization to pay the invoice as another party had reviewed everything, which included some involvement from the TDC and BCC liaison. Three parties had three different assumptions regarding one process. At the end of the day, there was only one party responsible for the accuracy of the requests for payment of TDC expenses, which is the Clerk of Court. The Board of the County Commissioners takes the blame, but the responsibility as County auditor and custodian of County funds rests with the Clerk of Court. A structural deficiency exists in the financial reporting process. We are referring to inadequate oversight and involvement over County funds by the Clerk and the Finance Director. In the limited time we had, we have not seen anything that would leave us to believe this has been fixed. There have been stopgap measures put in place, but we are not confident this would prevent other errors, intentional or unintentional. There is a large amount of trust placed on staff outside of the Clerk’s office to do the right thing. Their reliance on trust is a significant part of the culture and “tone at the top.” However, TRUST IS NOT AN INTERNAL CONTROL. The County needs someone to change the culture and “tone at the top” to one that applies professional skepticism in all aspects of financial reporting. Trust, but. verify. The accounting function for the County is decentralized with some departments having their own accounting staff, such as the Airport. The Clerk’s office is not actively involved in every aspect of financial reporting for those departments. There is a lack of understanding by the Clerk as to what each department does to ensure their records are complete and accurate. The Clerk's office is not active in the design, implementation and monitoring of internal controls to ensure the financial results are complete and accurate. This is a significant problem. We believe the Clerk’s office is reacting to findings as opposed to being proactive with regard to change. The Clerk’s office currently employs Tim Pozza as Director of Internal Audit. We requested the internal audit reports for the past five years. There have not been any internal audits issued during the past five years. The BCC has been and is currently funding 100% of the position for Director of Internal Audit. The Board may want to consider allocating those funds for the purpose of an internal audit function. Early in the process of our engagement, the nature of this letter was unforeseen and has been the most difficult part of the engagement. After all, we are addressing issues related to specific people. By all accounts, the Clerk of Court, Don Howard and the Finance Director, Gary Stanford are good, moral people. This letter is not designed to attack these men’s character. In our proposal to the BCC, we stated, “We want to be part of the new day in financial management and accountability in Okaloosa County.” County officials, employees and vendors such as our firm, work for the citizens of Okaloosa County. It is my sincere hope that this report opens up discussion for meaningful changes. If there is ever a time for change, that time is now. At the beginning of this engagement, we wanted our report to accomplish several things. We wanted the report to focus on higher risk areas, be easy to understand and be pragmatic as opposed to giving the Board so many suggestions that they all get lost in the minutia. We wanted our report to give the BCC a jumping off point for finding solutions to existing problems. For every engagement we are involved in, we constantly ask ourselves, “What would | want to know and what actions would | take if | personally was an elected member of the Okaloosa Board of County Commissioners.” Those two questions are the foundation of this report. It has been our honor to be given this opportunity to serve the BCC and citizens of my home, Okaloosa County. We believe the problems noted above and in our report can be corrected. We appreciate the tone of support every Commissioner has given us during this process. It is vital to all that we do not face future financial embarrassments in this County. We believe that our report is a starting point in ensuring hard-earned dollars are collected, accounted for and spent for the benefit of the taxpayers of Okaloosa County. Sincerely, gh < | Cows tephen C. Riggs IV, CPA August 26, 2013 To the Board of County Commissioners Okaloosa County, Florida We respectfully submit this report regarding fraud risk assessment procedures performed for the Okaloosa County Board of County Commissioners (“BCC”). Executive Summary This report covers Phase | of our agreement, the objective of which is the performance of an overall fraud risk assessment for the BCC, to make recommendations that address each risk identified, and to present an internal audit plan. This phase of our work did not include the performance of any internal audit procedures; therefore, it was not designed to identify any actual occurrence of fraudulent activity. Core policies and procedures covering human resources, purchasing, financial processing, and grants are generally well documented and support a system of strong internal controls; however, we identified a few key controls for the prevention and detection of fraud that are either missing or not implemented in the most effective manner. We also identified areas of improvement needed in the policies and procedures unique to certain BCC departments. Other significant risks (e.g. risk of significant error occurring) identified during our procedures are also addressed in this report. We have made recommendations regarding possible solutions to mitigate each risk and many of these recommendations have costs associated with them; however, we believe the benefits will likely far outweigh these costs when considering the extent of fraudulent activity, abuse, and errors that have occurred in recent Okaloosa County history. Summary of Procedures e We reviewed the Okaloosa County Comprehensive Annual Financial Report for the year ended September 30, 2012. e We conducted interviews at the following BOCC departments: Human Resources, Purchasing, Finance, Airport, Water & Sewer, and Emergency Medical Services. The director of each department was present at these meetings and most meetings included other members of management or staff. e We reviewed the following key policy and procedures manuals: Human Resources, Purchasing, Finance, and Grants. We also reviewed departmental policies and procedures manuals provided by Airport, Water & Sewer, and Emergency Medical Services departments. e We reviewed organizational charts. e We reviewed documentation provided by Warren Averett O’Sullivan Creel regarding that firm’s consideration of internal controls when performing its external audit. e We reviewed various revenue leases and contracts for the Airport and the third-party billing contract for Emergency Medical Services. e We reviewed responses to questionnaires sent to the directors of the following departments: Corrections, Court Services, Facility Maintenance, Fleet Operations, Growth Management, Public Works, Tourist Development, and Information Technology. Summary of Findings and Recommendations e The 2012 global fraud study performed by the Association of Certified Fraud Examiners (“ACFE”) revealed that 43% of frauds are detected by tips, with approximately half of these tips coming from employees. The BCC currently offers several tip reporting options that include: a) verbally submitting a report to the County Administrator, any member of management, or a County Commissioner, or b) submitting a written report to the County Administrator or a BCC or Human Resources e-mail address. This decentralized reporting mechanism can result in inconsistencies in the receipt, investigation, and tracking of reported issues. Employees could suspect improper activity that may involve their superiors. There needs to be a reporting method that assures employees they will suffer no consequences from reporting a tip. We believe the most effective tip reporting method is the use of a hotline managed by an independent party that can also assist with case management. A hotline that allows employees, vendors, and the public to report a tip anonymously will generally lead to the reporting of more instances of misconduct. e The ACFE study also showed that in organizations having more than 100 employees, the second most effective fraud