Okaloosa County BOCC — January 18, 2013 — Attorney General P&T Audit — reading text

to the response to the oil spill. The County received reimbursements, totaling $5,655.23, for various goods or services for which County records did not evidence were necessary and allowable costs incurred by the contractor in responding to the oil spill. These goods and services included such items as an alcoholic beverage, personal hygiene products, prescription drugs, over-the-counter medications, out-of-state lodging and car rental, and airfare to and from locations outside the County. County personnel indicated that they obtained the best available supporting documentation for the contractor?s expenses under the circumstances, provided that support to BP, and BP approved the expenditures as reimbursable costs. Although BP reimbursed the County for these expenditures, the above reimbursements, totaling $385,184.63, were not supported by documentation required by the Agreement. Recommendation: For future reimbursement agreements, the County should ensure that reimbursement requests are made pursuant to terms of the agreements, including submission of required supporting documentation. Motor Vehicles Finding No. 21: Fuel Cards The County issued fuel cards for use in its vehicles, including those vehicles assigned to the Tourist Development Department and the convention center, and the Fleet Operations Department was responsible for compiling the monthly fuel charges invoiced by vendors and allocating the fuel charges to user departments. User departments were then responsible for reconciling the monthly fuel charges to gas receipts submitted by employees. During the period May 2010 through May 2012, the Tourist Development Department and the convention center were charged $24,146.86 for fuel purchased using fuel cards. Our review of these charges and the procedures used by County personnel to ensure the propriety of these charges disclosed the following deficiencies: The Fleet Operations Department generated exception reports, by vehicle, to identify unusual fuel consumption. However, the parameters for generating exceptions on these reports were default parameters of the tracking software and were not reasonable. For example, the fuel limits for vehicles assigned to the Tourist Development Department and the convention center ranged from 250 to 400 gallons per day and 900 to 1,050 gallons per week. When such high parameters are used for generating exceptions, the County is at an increased risk that unusual fuel consumption will not be detected. All six user department reconciliations of fuel card charges to gas receipts that we reviewed were not signed by the employees that prepared the reconciliations, and County records did not evidence that supervisory personnel reviewed and approved the reconciliations. In the absence of this information, County records did not evidence that the reconciliations were performed or reviewed and approved by an individual that did not use the fuel cards assigned to the departments? vehicles. Gas receipts for $3,672.25 (79.3 percent) of $4,628.43 in fuel charges that we reviewed were not retained by the user departments. County personnel indicated that the gas receipts may have been lost, destroyed, or not turned in by employees. In the absence of gas receipts, the County cannot demonstrate that fuel charges invoiced by vendors were accurately billed, and user departments cannot demonstrate that fuel costs charged to their departments were accurately allocated. 24  ****PRELIMINARY AND TENTATIVE FINDINGS**** Recommendation: The County should strengthen its vehicle usage procedures to include more reasonable fuel consumption parameters, the effective use of fuel card exception reports and user department reconciliations of fuel charges to gas receipts, and the retention of all gas receipts by user departments. Accounting Controls Finding No. 22: Classification and Reporting of Expenditures Section 218.32, Florida Statutes, requires that local government reporting entities submit annual financial reports to the Florida Department of Financial Services (DFS). Section 218.33, Florida Statutes, provides that the DFS shall make reasonable rules and regulations regarding uniform accounting practices and procedures by local governmental entities, including a uniform classification of accounts, as it considers necessary to assure the use of proper accounting and fiscal management techniques. To that end, the DFS developed a Uniform Accounting System Manual for Florida Counties (Manual) to be used as the standard for classifying and recording financial information. The Manual provides for expenditures to be recorded and reported using object (e.g., personnel expenses, operating expenses, capital outlay) and sub-object (e.g., salaries and wages, professional services, machinery and equipment) codes to identify the types of the expenditures. Our tests of 60 purchasing card transactions, totaling $37,000 and funded from tourist development taxes or BP grant funds, disclosed 5 transactions (8.3 percent), totaling $4,180.68, that were incorrectly classified and recorded by object or sub-object codes. Additionally, County records supporting many payments made to the two advertising and marketing firms were inadequate to determine whether the payments were classified and recorded correctly. However, based on available supporting documentation at the time of payment and additional documentation subsequently obtained by the County, we noted several payments to the firms that were incorrectly classified and recorded by object or sub-object codes. Examples of payments that were incorrectly classified and recorded included the following: The County purchased two recreational vehicles for a total of $94,766. The recreational vehicles were purchased for the TDC to use in advertising projects and marketing campaigns. These expenditures were incorrectly classified and recorded as operating expenditures (contracted services – public relations) rather than as capital outlay expenditures (machinery and equipment). The County purchased an exterior marquee for the convention center for $81,237.50 that was incorrectly classified and recorded as an operating expenditure (contracted services – advertising) rather than as a capital outlay expenditure (infrastructure). The County purchased two televisions for a total of $2,208.88. The televisions were purchased to be used in the recreational vehicles noted above. These expenditures were incorrectly classified and recorded as operating expenditures (motor vehicle repair and maintenance) rather than as capital outlay expenditures (machinery and equipment). County personnel indicated that payments made to the two advertising and marketing firms were often coded to contracted services – advertising regardless of the purpose of the payments. When expenditures are not correctly classified and recorded in the accounting records, management may draw incorrect conclusions about the activities funded from restricted resources such as tourist development taxes and BP grant funds, and their ability to make informed decisions based upon these records may be compromised. 25  ****PRELIMINARY AND TENTATIVE FINDINGS**** Recommendation: The County should strengthen its procedures to ensure that expenditures are properly classified and recorded in accordance with the . Electronic Funds Transfers Finding No. 23: Controls Over Electronic Funds Transfers Section 668.006, Florida Statutes, requires the head of each agency to implement control processes and procedures to ensure adequate integrity, security, confidentiality, and auditability of business transactions conducted using electronic commerce. The County used electronic funds transfers (EFTs) to make certain types payments, including payments to vendors and banking institutions, and had established a funds transfer agreement with a bank to provide these services. County records indicated that 13 EFTs, totaling $15.5 million, were made during the period May 2010 through May 2012 that involved tourist development taxes or funds received from BP. Our review disclosed that the County needed to strengthen its controls over EFTs as follows: The BCC had not developed written policies and procedures regarding the authorization and processing of EFTs, contrary to law. Employees that could initiate wire transfers also had the ability to record journal entries in the accounting system, allowing them both access to County assets and the accounting records for these assets. The funds transfer agreement with the bank allowed authorized users designated by the CCC to electronically initiate EFTs without the approval of another employee before the funds were transferred. The funds transfer agreement with the bank did not restrict the locations where County funds could be transferred, allowed nonrepetitive EFTs up to $20,000,000, and allowed unlimited dollar amounts of repetitive EFTs. The funds transfer agreement with the bank had not been updated to reflect changes in CCC personnel and authorized an employee who terminated with the CCC in May 2005 to initiate and approve EFTs. While our tests did not disclose any EFTs that were made for unauthorized purposes, such tests cannot substitute for management?s responsibility to establish effective internal controls. Without written policies and procedures and effective controls governing EFT activities, the County is at an increased risk that unauthorized transfers could occur and not be timely detected. In September 2012, the CCC updated its funds transfer agreement with the bank to delete the terminated employee noted above. Recommendation: The BCC should develop written policies and procedures addressing EFTs as required by Section 668.006, Florida Statutes, including providing for an adequate separation of duties over access to County assets and the related accounting records, and documenting independent approvals before the funds are transferred. In addition, the CCC should revise its funds transfer agreement with the bank to address the deficiencies noted above and timely update its funds transfer agreement with the bank when changes in authorized personnel occur. Information Technology Controls Finding No. 24: Access Controls Access controls are intended to protect data and information technology (IT) resources from unauthorized disclosure, modification, creation, or destruction. Effective access controls provide employees access to IT resources based on a 26  ****PRELIMINARY AND TENTATIVE FINDINGS**** demonstrated need to view, change, add, or delete data. Further, effective access controls provide employees access privileges that restrict employees from performing incompatible functions or functions outside of their area of responsibility. Periodically reviewing the appropriateness of IT access privileges assigned to employees promotes good internal control and is necessary to ensure that employees cannot access IT resources inconsistent with their assigned job responsibilities. As part of our review of the County?s expenditure payment process, we noted certain deficiencies in access controls as follows: All employees in the CCC?s Finance Department, including accounts