Okaloosa County BOCC — January 8, 2013 — Final AG Report and Board Response - January 2013 — reading text

provide for the effective control of expenditures, and the BCC and TDC should perform periodic budget-to-actual comparisons. The CCC should reject invoices presented for payment when sufficient authorized funds are not available to pay for them. Finding No. 2: TDC Duties and Responsibilities As noted in the Background section of this report, the BCC created the TDC as an advisory council pursuant to Section 125.0104(4)(e), Florida Statutes. County ordinances and the TDC’s operations and procedures manual in effect during the period May 2010 through May 2012 generally prescribed to the TDC only the advisory duties provided for in Section 125.0104(4)(e), Florida Statutes. However, our review of the actions taken by the TDC and TDC subcommittees disclosed that they performed certain duties that were not of an advisory nature. For example, we noted the following actions taken by the TDC or TDC subcommittees during the period May 2010 through May 2012 for which County records did not evidence BCC approval:  On October 10, 2010, the TDC voted to give the former TDC Executive Director authority to spend up to $50,000 from BP grants to investigate and move forward with the use of three-dimensional and virtual reality technology for marketing purposes.  On August 27, 2011, the TDC voted to designate $300,000 from BP grants for special events funding.  On various dates, the TDC and TDC subcommittees approved the use of a total of $341,361.89 in tourist development taxes and BP grants to support special events in the County as further discussed in finding No. 15. In September 2012, the BCC approved revisions to the TDC’s operations and procedures manual that allow the TDC to approve funding requests for special events. When the TDC or TDC subcommittees authorize expenditures without BCC approval, the County is at an increased risk that expenditures will be made that are not in accordance with BCC intentions. 7 JANUARY 2013 REPORT NO. 2013-085 Recommendation: The BCC should implement policies and procedures to ensure that the TDC performs only those duties authorized by Section 125.0104(4)(e), Florida Statutes, and County ordinances. Finding No. 3: TDC Monitoring of Expenditures Section 125.0104(4)(e), Florida Statutes, requires the TDC to continuously review all expenditures of tourist development taxes and receive, at least quarterly, expenditure reports from the BCC or its designee. In addition, this Section requires the TDC to report expenditures it believes to be unauthorized to the BCC and the Florida Department of Revenue. In response to our inquiry, the TDC’s legal counsel indicated that the TDC reviewed planned expenditures as part of the annual budget review and adoption process. However, the TDC did not regularly receive summary or detailed reports of expenditures of tourist development taxes. When timely, detailed expenditure reports are not provided to the TDC for review, the TDC cannot effectively carry out its responsibility to continuously review these expenditures, and the County is at an increased risk that unauthorized expenditures, such as those noted in finding No. 9, could be made and not timely detected by the TDC. In May 2012, the TDC began receiving monthly expenditure reports for its review. Recommendation: The TDC should continue to strengthen its monitoring controls by ensuring that it timely receives and reviews detailed reports of expenditures of tourist development taxes as required by Section 125.0104(4)(e), Florida Statutes. Finding No. 4: Conflicts of Interest Pursuant to Section 112.313(3), Florida Statutes, no county employee acting in his or her official capacity as a purchasing agent, or public officer acting in his or her official capacity, may either directly or indirectly purchase, rent, or lease any realty, goods, or services for the county from any business entity i n which the officer or employee or the officer’s or employee’s spouse or child is an officer, partner, director, or proprietor, or in which such officer or employee or the officer’s or employee’s spouse or child, or any combination of them, has a material interest. This Section further prohibits a county public officer or employee from acting in a private capacity to rent, lease, or sell any realty, goods, or services to the county or any agency thereof. Pursuant to Section 112.313(7)(a), Florida Statutes, no county public officer or employee may have or hold any employment or contractual relationship with any business entity or agency that is subject to the regulation of, or is doing business, with the county. This Section further prohibits a county public officer or employee from having or holding any employment or contractual relationship that will create a continuing or frequently recurring conflict between his or her public duties, or that would impede the full and faithful discharge of his or her duties. Section 112.313(1), Florida Statutes, defines a public officer to include any person elected or appointed to hold office in any agency, including any person serving on an advisory body. County records supporting many purchases made through two advertising and marketing firms were inadequate to determine whether the payments were made to business entities or agencies that could potentially represent conflicts of interest pursuant to the laws noted above. However, based on available supporting documentation, we noted purchases during the period May 2010 through May 2012 that appear contrary to the laws noted above. For example, we noted the following purchases made through an advertising and marketing firm:  The County paid $27,066.95 for sponsorships of a local chamber of commerce. A BCC member was, at the time, the executive director of the chamber of commerce. 8 JANUARY 2013 REPORT NO. 2013-085  The County paid $17,500 for two companies to promote and advertise local volleyball tournaments. A TDC member was, at the time, an owner or director of these companies.  The County paid $2,200 for a company to provide aerial advertising. A TDC Marketing Subcommittee member was, at the time, the president of the company. Section 112.313(12), Florida Statutes, states that the requirements of Sections 112.313(3) and 112.313(7), Florida Statutes, as they relate to persons serving on advisory boards such as the TDC and TDC Marketing Subcommittee may be waived in a particular instance by the appointing body upon full disclosure of the transaction or relationship prior to the waiver and an affirmative vote in favor of waiver by a two-thirds vote of the appointing body. However, no such waivers were recorded in BCC or TDC meeting minutes. Recommendation: The BCC should implement policies and procedures to ensure that future purchases of goods and services are not made from vendors in which a potential conflict of interest exists or that waivers of the requirements of Sections 112.313(3) and 112.313(7), Florida Statutes, as they relate to TDC and TDC subcommittee members, are granted and documented in accordance with Section 112.313(12), Florida Statutes. Fraud Controls and Control Risk Assessments Finding No. 5: Fraud Controls An effective anti-fraud program is an important part of an organization’s system of internal control. It can decrease the risk of fraud occurring in an organization and minimize the impact of fraud on an organization should it occur. Comprehensive fraud policies and procedures are an important part of an effective anti-fraud program. BCC policies and procedures in effect during the period May 2010 through May 2012 included a code of conduct, addressed unlawful and prohibited actions, and provided consequences for these actions. In addition, the BCC had adopted a whistleblower’s protection policy that provided protection to individuals who reported known or suspected violations of statutes, rules, or regulations. However, these policies and procedures did not include a written fraud response plan that addressed investigation protocols and guidance on reporting known or suspected fraud to the appropriate authorities. Without a written fraud response plan, the County is at an increased risk that known or suspected fraud may not be investigated and reported in accordance with BCC intentions. In addition to comprehensive fraud policies and procedures, an effective anti-fraud program includes periodic fraud risk assessments and fraud controls monitoring. In response to our inquiry, County personnel indicated that identifying and assessing fraud risks are routinely part of the continual monitoring and interaction of the County Administrator and CCC. County personnel also provided examples of recent risks identified and controls put in place to mitigate these risks. However, the County had not performed and documented periodic fraud risk assessments of the operations of each County department, including the Tourist Development Department. Such fraud risk assessments would provide greater assurance of identifying potential fraud risks that may be unique to each department. Once potential fraud risks are identified, written action plans that implement and monitor controls designed to mitigate these risks would provide greater assurance of preventing or detecting fraud. Recommendation: The BCC should strengthen its anti-fraud program by adopting a fraud response plan, requiring periodic fraud risk assessments, and developing action plans to implement and monitor fraud controls. 9 JANUARY 2013 REPORT NO. 2013-085 Finding No. 6: Control Risk Assessments As discussed in the Background section of this report, the County is responsible for collecting, accounting for, and making disbursements from restricted resources, including tourist development taxes and funds received from BP. Therefore, it is important that the County identify the control risks associated with these activities and develop internal controls to mitigate significant control risks identified. Performing periodic control risk assessments can help to identify and analyze these risks. Control risk assessments should involve a systematic identification of circumstances or events that could prevent the County’s goals and objectives from being met, an assessment of the probability and significance of these circumstances or events, and a determination on the part of County management as to whether it is cost-beneficial to implement controls to prevent or detect these circumstances or events. As a practical matter, a formal control risk assessment could be performed and documented on an annual basis; however, as a good business practice, the control risk assessment process should be ongoing as new internal and external threats constantly develop. Upon inquiry, County personnel indicated that they had not performed and documented a recent control risk assessment relating to the activities of collecting, accounting for, and making disbursements from restricted resources, including tourist development taxes and funds received from BP. Periodic control risk assessments would provide greater assurance of identifying potential control weaknesses, such as those noted throughout this report, and would help ensure that adequate internal controls are in place to minimize the risks that control weaknesses could adversely affect the County’s operations. Recommendation: The County should perform and document periodic control risk assessments over the