Okaloosa County BOCC — August 18, 2015 — Okaloosa Follow-Up Letter and P&T — reading text

certain goods and services in advance of their receipt, contrary to law. We recommended that the BCC strengthen policies and procedures to ensure that advance payments are approved and paid only if the payments result in a savings that is equal to or greater than the amount that would be earned by investing the funds and paying later, or if the payments are essential to BCC operations and the goods or services being paid for are available only if advance payment is made. Results of Follow-Up Procedures The BCC’s actions corrected this finding. Our review of six advance payments totaling $140,009 made during the period August 2014 through January 2015 disclosed that BCC records documented that the payments were for goods or services that were essential to BCC operations and the goods or services being paid for were available only if advance payments were made. TRAVEL Finding 13: Travel Allowances Previously Reported Several County Commissioners received monthly travel allowances based on typical month travel statements that were outdated, included unallowed mileage, or did not include adequate descriptions of the travel claimed. Page 8  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT We recommended that the BCC strengthen procedures to ensure that travel allowances are paid based on typical month travel statements that are updated annually, include sufficiently detailed information, and are correctly calculated in accordance with the provisions of law and guidance provided in applicable Attorney General opinions. Results of Follow-Up Procedures The BCC’s actions corrected this finding. Our review of travel allowances provided to five County Commissioners during the period August 2014 through January 2015 disclosed that the travel allowances were paid based on typical month travel statements that were updated annually, included sufficiently detailed information, and were correctly calculated in accordance with the provisions of law and guidance provided in applicable Attorney General opinions. CONTRIBUTIONS Finding 14: Contributions to Private Nonprofit Corporations Previously Reported The BCC had not adopted policies and procedures for making contributions to private nonprofit corporations. Also, the BCC did not consistently document how contributions to the corporations served an authorized public purpose, require the corporations to enter into a written agreement stating the purpose for which the contributions should be used, or obtain a subsequent accounting from the corporations as to how the contributions were ultimately used. We recommended that the BCC adopt written policies and procedures addressing criteria to be used to make contributions to private nonprofit corporations, the methodology for calculating the amount of the contributions, and the responsibilities of the corporations receiving the contributions to provide an accounting as to how the contributions were ultimately used. We also recommended that the BCC document how each contribution serves an authorized public purpose and obtain a subsequent accounting from each corporation to document that the authorized public purpose was accomplished. Results of Follow-Up Procedures The BCC’s actions partially corrected this finding. During the period August 2014 through January 2015, the BCC made contributions totaling $80,395 to nine different private nonprofit corporations. Our review of these contributions disclosed that the BCC did not always document how each contribution served an authorized public purpose or obtain a subsequent accounting from each corporation to document that an authorized public purpose was accomplished. Absent such documentation, there is an increased risk that contributions may be used for nonpublic purposes. On March 17, 2015, the BCC adopted a nonprofit funding policy (Policy) that established eligibility criteria and procedures to apply for and use such funding. The Policy requires the BCC to approve funding applications and purposes before funds are released, applicants requesting $10,000 or less to certify by affidavit that funds will be used in Page 9  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT compliance with the Policy, and applicants receiving over $10,000 to provide receipts and other documentation that evidence funding was used in compliance with the Policy. Recommendation: The BCC should continue efforts to ensure that contributions to private nonprofit corporations are only for authorized public purposes. MOTOR VEHICLES Finding 15: Fuel Card Purchases Previously Reported The BCC had not established adequate controls over the use of fuel cards. In February 2013, the County Administrator notified all departments that receipts for fuel charges at retail locations should be submitted and retained and that reconciliations of fuel charges to receipts should be performed and documented. We recommended that the BCC continue efforts to strengthen controls over the use of fuel cards by requiring BCC departments to retain all receipts from retail locations and perform reconciliations of fuel charges to those receipts. Results of Follow-Up Procedures The BCC’s actions did not correct this finding. Our review of December 2014 fuel charges totaling $8,345 at two departments disclosed that one department did not retain 21 receipts totaling $946 for fuel charges at retail locations and, as a result, could not confirm that the fuel card vendor accurately invoiced the fuel charges or that fuel costs were accurately charged to BCC departments. In the absence of reconciliations of the invoice from the fuel card vendor to receipts from retailers, the BCC cannot be assured that fuel charges incurred at retail locations were accurately invoiced by the fuel card vendor or that fuel costs were accurately charged to BCC departments. Recommendation: The BCC should enhance procedures to ensure that BCC departments retain all receipts from retail locations and perform reconciliations of fuel charges to those receipts and fuel card vendor invoices. Page 10  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT FINDINGS AND RECOMMENDATIONS OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT ORGANIZATIONAL OVERSIGHT Finding 16: CCC Duties and Responsibilities Previously Reported The CCC did not ensure that adequate documentation accompanied certain BCC payment vouchers or deny payment of BCC payment vouchers that were inadequately supported. We recommended that the CCC ensure that adequate documentation accompanies each BCC payment voucher to evidence the validity, legality, and authorized public purpose of the expenditures, or deny payment of the expenditures until such documentation is provided. Results of Follow-Up Procedures The CCC’s actions partially corrected this finding. According to CCC personnel, BCC payment vouchers were typically reviewed for adequate documentation of the validity, legality, and authorized public purpose of the expenditures before payments were processed. However, as noted in finding 14, although BCC records for certain disbursements to nonprofit organizations did not evidence the authorized public purpose served, the CCC did not deny payment. Without such documentation, BCC records do not evidence that payments were proper expenditures of public funds. Recommendation: The CCC should continue efforts to ensure that adequate documentation accompanies each BCC payment voucher to evidence the validity, legality, and authorized public purpose of the expenditures, or deny payment until such documentation is provided. Finding 17: Internal Auditing Previously Reported The CCC had not adopted policies and procedures governing the operations of the Internal Audit Department, nor did the Internal Audit Department prepare periodic work plans that detailed planned audits and work activities. We recommended that the CCC adopt policies and procedures governing the operations of the Internal Audit Department and approve periodic work plans that detail the Department’s planned audits and work activities. Page 11  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT Results of Follow-Up Procedures The CCC’s actions corrected this finding. In August 2014, the CCC approved an annual work plan that outlines the Department’s planned audits and work activities and, in September 2014, the CCC developed policies and procedures governing the operations of the Internal Audit Department. FRAUD AND ETHICS CONTROLS/RISK ASSESSMENT Finding 18: Fraud Controls and Risk Assessments Previously Reported The CCC had not performed periodic fraud and risk assessments of the operations of CCC departments. We recommended that the CCC ensure periodic fraud and control risk assessments are performed and documented for all CCC departments. We also recommended that the CCC consider the risk assessments obtained by the BCC. Results of Follow-Up Procedures The CCC’s actions partially corrected this finding. In July 2014, the CCC established a plan and methodology for performing risk assessments of key operations. The CCC also engaged a CPA firm to perform an information technology risk assessment. In September 2014, the CPA firm issued a report that identified several risks, including a lack of written policies and procedures, weaknesses in security controls, incomplete disaster plan testing, diminished accountability due to shared use of administrator level accounts, and risk of loss of sensitive data. As of April 2015, the CCC was still in the process of implementing its risk assessment plan, completing risk assessments for all CCC departments, and addressing the information technology risks identified by the CPA firm. Failure to timely implement a risk assessment plan diminishes the CCC’s ability to timely address fraud risks and control weaknesses that could adversely affect CCC operations. Recommendation: The CCC should continue efforts to fully implement its risk assessment plan, complete risk assessments for all CCC departments, and address the information technology risks identified by the CPA firm. Finding 19: Conflicts of Interest Previously Reported CCC policies and procedures were not adequate to identify and prevent potential conflicts of interest. We recommended that the CCC establish policies and procedures designed to