Okaloosa County BOCC — November 16, 2013 — Carr, Riggs, & Ingram Internal Audit Report — reading text

particularly when changes in rates occur. Other risks include failure to collect sales tax when applicable or verify that a lessee has renewed its standby letter of credit. Consideration should be given to purchasing a software program designed for the tracking and billing of airport leases and fees. Ideally, the program should be able to interface with the County's accounting system for the recording of Airport revenues and receivables. Certain revenues of the Airport are based on a percentage of revenues earned by rental car companies, concessionaires providing food, beverage, or retail sales, or fixed base operators located at the Crestview and Destin facilities. Additionally, the collection of parking fee revenues is managed by a third party, and the airlines and rental car companies are responsible for collecting and remitting passenger and customer facility charges. The Airport must rely on information provided by these outside parties for the accuracy of its own revenues. As a result, there is a risk that these parties may understate the revenues they report, either intentionally or due to error. In addition, the Airport reimburses Republic Parking for certain direct expenses related to the operation of the parking lot. There is a risk that these expenses could be overstated, resulting in excess reimbursement to Republic Parking. There are some compensating controls in place to minimize these risks. Some agreements require the lessee/concessionaire to provide statements related to the entity's revenues that have been audited by an independent certified public accountant, while others provide that the County has the right to audit or inspect the entity's records. As part of our assessment procedures, we obtained copies of several audit or agreed-upon attestation reports performed by various independent CPA firms on the revenues of the rental car companies and fixed base operators. We also obtained a list of audits/agreed-upon procedures performed for the last three fiscal years noting that such engagements had been performed for the rental car and fixed base operator agreements only. Airport management indicated that it plans to have an audit of the Republic Parking operation performed for the fiscal year ending September 30, 2013. We recommend an increased level of audits or agreed-upon procedures be performed each year on the Airport's revenue leases and contracts. While it is not necessary to audit every agreement on an annual basis, there should be a plan that subjects all types of lessees and concessionaires with variable rate contracts to being selected for audit. The Okaloosa County enterprise funds earned over $70 million in revenues and grants during the fiscal year ended September 30, 2012; however, documented policies and procedures related to the billing and collection of these revenues are weak, and in some cases nonexistent. Weak or missing written policies and procedures can result in employees taking shortcuts that undermine internal controls and inconsistencies when employee turnover occurs. Every department that is responsible for the billing and collection of revenues should have a policies and procedures manual that is organized, contains well documented policies and procedures related to billings and collections (identify objectives, procedures, responsible employee positions, reporting requirements, and monthly and year-end closing deadlines), and identifies dates that policies are written or amended. Overall policies and procedures for the billing and collection of revenues need to be established by the Finance Department and then each department needs to develop the policies and procedure specific to its operations that are consistent with the overall policies. We appreciate the opportunity to be of service to the Okaloosa County Board of County Commissioners and the citizens of Okaloosa County. Can, Regge é Jngram), £4.0, Miramar Beach, Florida Appendix A Internal Audit Plan Objectives The purpose of the internal audit function is to assist management in achieving four key objectives: e Safeguarding of assets e Effectiveness and efficiency of operations e Compliance with policies, procedures, laws, and regulations e Reliable financial reporting In order for the internal audit function to achieve these objectives, it is important that an audit plan be established and updated annually. The purpose of this document is to establish an initial audit plan that identifies a framework for performing internal audits and recommends specific internal audits for the upcoming fiscal year and beyond. Framework Fraud, errors, inefficiencies, and noncompliance matters can occur at any level of BCC operations; therefore, it is important to include every department in the internal audit plan. Every department should be subject to at least one internal audit every five years, with certain departments having higher inherent risk having at least one internal audit every three years. Exhibit A presents a proposed schedule of departments selected for audit over the next five years. This schedule should not be considered static, as conditions will likely occur that will require changes to planned internal audit projects and it may be necessary for some departments to be audited more frequently. It is important that completed projects by department and year be tracked so that this schedule will be properly updated on an annual basis. Rather than performing department-wide internal audit projects, each project should focus on a specific matter, e.g. testing cash controls at the Water & Sewer Department by performing surprise cash counts at the department's payment locations. The determination of specific internal audit projects will be driven by a variety of factors, with the severity of risks to Okaloosa County being a key determining factor in identifying the projects and their priority. We have compiled a list of proposed internal audit projects for the BCC departments. Some of these projects address specific weaknesses identified in our fraud risk assessment performed for the BCC, while others address the inherent risks of the various departments. Proposed Internal Audit Projects for the 2013-2014 Fiscal Year e Work with the Human Resources Department to develop a fraud awareness training program for employees. A-1 Appendix A Internal Audit Plan e Work with the BCC departments to develop a fraud risk assessment checklist that is tailored to the inherent risks of each department and assist the BCC in the implementation of an internal fraud risk assessment program. e Review the distribution of credit cards to BCC employees and make recommendations for reducing the number of cards issued and establishing guidelines for issuing cards in the future. ¢ Select airport leases for testing, including examination of lessee accounting records. e Review and test controls over convention center revenues. e Test outgoing wire transfers for propriety. e Select purchases to test for compliance with purchasing policy. e Test expenditures made by Fleet Operations to determine they are for County-owned vehicles. e Perform surprise cash counts. Recommendations for Future Internal Audit Projects e Annual review of internal fraud risk assessments. e Review fraud hotline reports and case management. e Accounts receivable reconciliation and collection procedures. e Revenue controls and testing. e Major capital projects expenditures. e Advertising and marketing expenditures. e Travel expenditures. e Credit card purchases. e Review vendor master file for fake vendors. e Check and ACH disbursement testing. e Compliance with County contracting requirements. e Test remittances made/received under franchise agreement with Waste Management. e Year-end spending. e Review cost accounting allocations on Water & Sewer Department projects. e Analyze employee overtime costs. e Business continuity and disaster recovery plans. e Fixed asset acquisition and accountability. e Inventory acquisition and accountability. e Surplus procedures and sales. e Journal entry review. e Test IT security controls. A-2 Appendix A Internal Audit Plan Exhibit A - Five Year Audit Plan by Department Department 2013-14 2014-15 2015-16 2016-17 2017-18 Airport xX xX BOCC Finance xX x Corrections X County Administrator x Court Services X Extension Service X Facility Maintenance X Fleet Operations X Xx Growth Management X X Health Department x Human Resources Xx Information Systems X Xx Law Library Xx Library Co-op X Public Safety X Public Transit Xx Public Works X Xx Purchasing X X Risk Management X Tourist Development xX Xx Veteran Services x Water & Sewer x Xx A-3 Appendix B Internal Fraud Risk Assessment Program Identify Responsible Parties Each department should establish a fraud risk assessment team that will meet according to schedule with a goal of performing a fraud risk assessment for the department. At least one member of the department’s senior management should be included on the team; other members should represent different levels of knowledge or skills. One individual on each team should be assigned responsibility for documentation of the fraud risk assessment. An overall coordinator of the fraud risk assessment program for the BOCC should be selected. This person will be responsible for collecting the fraud risk assessment documentation from the departments, reporting significant issues to the County Administrator or BOCC, and following up with those departments that fail to perform their risk assessment. While we recommend that all BOCC employees receive fraud awareness training, at a minimum all individuals involved in performing a fraud risk assessment should receive this training. Establish a Schedule A formal fraud risk assessment should be performed more than once per year. We believe a reasonable frequency is every six months. If conditions warrant it, a special meeting may need to be called in-between the regularly scheduled meetings. Develop a Fraud Risk Assessment Checklist Not every department is subject to the same risks. There are standardized checklists available that can be tailored to each department. Each department's checklist should list the fraud risks and schemes that are inherent to that department, along with space to record the results of the fraud risk assessment. Perform and Document the Fraud Risk Assessment Each team should plan to meet according to schedule. Using the checklist that has been tailored to the department, the team should consider the likelihood and significance of occurrence of each risk, identify the positions in each department where a fraud could occur, identify the existence and effectiveness of antifraud controls applicable to each risk, and identify any actions that need to be taken. While performing the assessment, the team should give special consideration to recent or planned changes in organizational structure or operations. In connection with the fraud risk assessment, each department should review its policies and procedures manual annually in order to identify any needed updates. B-1