Okaloosa County BOCC — January 8, 2013 — Final AG Report and Board Response - January 2013 — reading text

generating exceptions, the County is at an increased risk that unusual fuel consumption will not be detected.  All six user department reconciliations of fuel card charges to gas receipts that we reviewed were not signed by the employees that prepared the reconciliations, and County records did not evidence that supervisory personnel reviewed and approved the reconciliations. In the absence of this information, County records did not evidence that the reconciliations were performed or reviewed and approved by an individual that did not use the fuel cards assigned to the departments’ vehicles.  Gas receipts for $3,672.25 (79.3 percent) of $4,628.43 in fuel charges that we reviewed were not retained by the user departments. County personnel indicated that the gas receipts may have been lost, destroyed, or not turned in by employees. In the absence of gas receipts, the County cannot demonstrate that fuel charges invoiced by vendors were accurately billed, and user departments cannot demonstrate that fuel costs charged to their departments were accurately allocated. Recommendation: The County should strengthen its vehicle usage procedures to include more reasonable fuel consumption parameters, the effective use of fuel card exception reports and user department reconciliations of fuel charges to gas receipts, and the retention of all gas receipts by user departments. Accounting Controls Finding No. 22: Classification and Reporting of Expenditures Section 218.32, Florida Statutes, requires that local government reporting entities submit annual financial reports to the Florida Department of Financial Services (DFS). Section 218.33, Florida Statutes, provides that the DFS shall make reasonable rules and regulations regarding uniform accounting practices and procedures by local governmental 24 JANUARY 2013 REPORT NO. 2013-085 entities, including a uniform classification of accounts, as it considers necessary to assure the use of proper accounting and fiscal management techniques. To that end, the DFS developed a Uniform Accounting System Manual for Florida Counties (Manual) to be used as the standard for classifying and recording financial information. The Manual provides for expenditures to be recorded and reported using object (e.g., personnel expenses, operating expenses, capital outlay) and sub-object (e.g., salaries and wages, professional services, machinery and equipment) codes to identify the types of the expenditures. Our tests of 60 purchasing card transactions, totaling $37,000 and funded from tourist development taxes or BP grant funds, disclosed 5 transactions (8.3 percent), totaling $4,180.68, that were incorrectly classified and recorded by object or sub-object codes. Additionally, County records supporting many payments made to the two advertising and marketing firms were inadequate to determine whether the payments were classified and recorded correctly. However, based on available supporting documentation at the time of payment and additional documentation subsequently obtained by the County, we noted several payments to the firms that were incorrectly classified and recorded by object or sub-object codes. Examples of payments that were incorrectly classified and recorded included the following:  The County purchased two recreational vehicles for a total of $94,766. The recreational vehicles were purchased for the TDC to use in advertising projects and marketing campaigns. These expenditures were incorrectly classified and recorded as operating expenditures (contracted services – public relations) rather than as capital outlay expenditures (machinery and equipment).  The County purchased an exterior marquee for the convention center for $81,237.50 that was incorrectly classified and recorded as an operating expenditure (contracted services – advertising) rather than as a capital outlay expenditure (infrastructure).  The County purchased two televisions for a total of $2,208.88. The televisions were purchased to be used in the recreational vehicles noted above. These expenditures were incorrectly classified and recorded as operating expenditures (motor vehicle repair and maintenance) rather than as capital outlay expenditures (machinery and equipment). County personnel indicated that payments made to the two advertising and marketing firms were often coded to contracted services – advertising regardless of the purpose of the payments. When expenditures are not correctly classified and recorded in the accounting records, management may draw incorrect conclusions about the activities funded from restricted resources such as tourist development taxes and BP grant funds, and their ability to make informed decisions based upon these records may be compromised. Recommendation: The County should strengthen its procedures to ensure that expenditures are properly classified and recorded in accordance with the Manual. Electronic Funds Transfers Finding No. 23: Controls Over Electronic Funds Transfers Section 668.006, Florida Statutes, requires the head of each agency to implement control processes and procedures to ensure adequate integrity, security, confidentiality, and auditability of business transactions conducted using electronic commerce. The County used electronic funds transfers (EFTs) to make certain types payments, including payments to vendors and banking institutions, and had established a funds transfer agreement with a bank to provide these services. County records indicated that 13 EFTs, totaling $15.5 million, were made during the period May 2010 25 JANUARY 2013 REPORT NO. 2013-085 through May 2012 that involved tourist development taxes or funds received from BP. Our review disclosed that the County needed to strengthen its controls over EFTs as follows:  The BCC had not developed written policies and procedures regarding the authorization and processing of EFTs, contrary to law.  Employees that could initiate wire transfers also had the ability to record journal entries in the accounting system, allowing them both access to County assets and the accounting records for these assets.  The funds transfer agreement with the bank allowed authorized users designated by the CCC to electronically initiate EFTs without the approval of another employee before the funds were transferred.  The funds transfer agreement with the bank did not restrict the locations where County funds could be transferred, allowed nonrepetitive EFTs up to $20,000,000, and allowed unlimited dollar amounts of repetitive EFTs.  The funds transfer agreement with the bank had not been updated to reflect changes in CCC personnel and authorized an employee who terminated with the CCC in May 2005 to initiate and approve EFTs. While our tests did not disclose any EFTs that were made for unauthorized purposes, such tests cannot substitute for management’s responsibility to establish effective internal controls. Without written policies and procedures and effective controls governing EFT activities, the County is at an increased risk that unauthorized transfers could occur and not be timely detected. In September 2012, the CCC updated its funds transfer agreement with the bank to delete the terminated employee noted above. Recommendation: The BCC should develop written policies and procedures addressing EFTs as required by Section 668.006, Florida Statutes, including providing for an adequate separation of duties over access to County assets and the related accounting records, and documenting independent approvals before the funds are transferred. In addition, the CCC should revise its funds transfer agreement with the bank to address the deficiencies noted above and timely update its funds transfer agreement with the bank when changes in authorized personnel occur. Information Technology Controls Finding No. 24: Access Controls Access controls are intended to protect data and information technology (IT) resources from unauthorized disclosure, modification, creation, or destruction. Effective access controls provide employees access to IT resources based on a demonstrated need to view, change, add, or delete data. Further, effective access controls provide employees access privileges that restrict employees from performing incompatible functions or functions outside of their area of responsibility. Periodically reviewing the appropriateness of IT access privileges assigned to employees promotes good internal control and is necessary to ensure that employees cannot access IT resources inconsistent with their assigned job responsibilities. As part of our review of the County’s expenditure payment process, we noted certain deficiencies in access controls as follows:  All employees in the CCC’s Finance Department, including accounts payable and payroll employees, had the ability to record journal entries. However, CCC procedures did not provide for an independent review of all journal entries recorded in the accounting system to determine that the journal entries were properly authorized. County IT personnel indicated that, due to software limitations, an employee’s ability to record journal entries could not be limited without also limiting the employee’s ability to view certain accounting records. 26 JANUARY 2013 REPORT NO. 2013-085  Two CCC payroll employees and the CCC’s Financial Services Manager had the ability to record pay rate and other changes in the payroll system. These employees also had the ability to process payroll transactions and print payroll checks. However, CCC procedures did not provide for an independent review of all changes recorded in the payroll system to determine that the changes were properly authorized by the Human Resources Department.  Two CCC accounts payable employees had the ability to add new vendors and make other changes in the master vendor file. These employees also had the ability to process and pay vendor invoices, and print and distribute checks to vendors. However, CCC procedures did not provide for an independent review of all changes made to the master vendor file to determine that the changes were properly authorized by the Purchasing Department. We also noted that end-user departments were not routinely required to review employee access privileges to County resources (e.g., accounting records, payroll system data, master vendor files) to determine whether these access privileges were necessary and appropriate given an employee’s job responsibilities. Without such reviews, unnecessary or incompatible access privileges may not be timely detected and addressed by the County, increasing the risk of unauthorized disclosure, modification, creation, or destruction of data and IT resources. Recommendation: The County should strengthen its procedures to include the periodic review of access privileges granted to employees and timely remove or modify unnecessary or incompatible access privileges detected. Public Records Finding No. 25: TDC and TDC Subcommittee Meeting Minutes Section 286.011, Florida Statutes, commonly referred to as the Sunshine Law, requires that minutes of public