Loading...
HomeMy WebLinkAbout01-19-2000 Agenda Item 7.B SARATOGA CITY COUNCIL EXECUTIVE SUMMARY NO.: ~~ ~~ AGENDA ITEM: MEETING DATE: January 19, 2000 CITY MANAGER: ~,~/~' ORIGINATING DEPT.: Administrative Services PREPARED BY: \ SUBJECT: Response to Independent Auditor's Memorandum on Internal Control Structure for Fiscal Year Ended June 30, 1999 RECOMMENDED ACTION(S): Accept and file this report, and direct staff to implement recommended procedures. REPORT SUMMARY: Each year, as part of the audit process, the independent Certified Public Accounting firm which performs the City's annual audit issues to their clients a Memorandum on Internal Control Structure, also known as the Management Letter Comments. The purpose of this letter is to provide the City Council and management staff with recommendations for improving upon the internal control system and fiscal management. This procedure is an important aspect of the auditing process, and is a meaningful financial management tool. This year, the letter contains four recommendations. Below is summarized the auditor's comments, along with staff's response. The Finance Commission reviewed the auditor's comments and staffs draft responses at their January 10 meeting, and the Commission's comments have been incorporated into this report. 1. Transportation Development Act (TDA) reimbursement requests not completed Response -The City will submit grant reimbursements in January. The City will prepare reimbursement requests on an annual basis. 2. Cash and Investment Report accurately prepared. Response -The City received approximately $1 million into the money market account on March 31 when a Certificate of Deposit matured. That same day, the $1 million was transferred from the money market account into LAIF which earns a higher interest rate. When the month- end Comerica bank statements were received, the $1 million was shown as being transferred out of the money market account, but since the LAIF statement was not yet received when the Treasurer's Report was being prepared, the amount was not reflected as a LAIF deposit on the March 31 Treasurer's report. When the LAIF month-end report was finally received, it did show that the funds were correctly received on March 31. The City will be more careful to ensure the report is accurately prepared. Staff now always calls LAIF to confirm the month end balances when preparing the Treasurer's Report if the LAIF statement has not been received. 3. Cash Receipt Controls for the Recreation Department and Community Development Department. Response -Beginning January 1, with the implementation of the Parksoft system in the Recreation Department and the HTE building permit module in the Community Development Department, cash receipts are now fully integrated with the City's HTE financial system. Currently, the Recreation Department completes a cash receipt for transactions processed for building rentals only. Effective January 1, the Recreation Department began using the City's standard cash receipt form for cash and check collections made over the counter for class registration, excursions, etc. Another form of internal control is the class roster. The class roster lists all individuals enrolled in a class. The instructors are given this list prior to the start of class. If an individual paid for a class and is not listed on the roster, there is a discrepancy and City staff can begin investigating the situation. Centralizing cash collections in the Community Development Department with just the Office Specialist is not practical. This would add another step for citizens in the development fee and building permit process, and this would not counterbalance the benefit of slightly improved internal controls over cash collections. The City believes that it has sufficient controls over cash collections in the Community Development Department. The City Planners receive the fees and issue cash receipts to individuals or companies. They then place these monies in the cash register located in the Office Specialist workstation. The City inspectors also receive fees and issue cash receipts to individuals or companies, placing these monies in a cash box located in a secure location. The Office Specialist gathers all the monies from the cash box and the cash register and prepares the daily cash deposit. The Office Specialist then reconciles the cash deposit to the cash receipts and verifies all receipts to cash collected. This helps ensure an accurate account of all monies received. The fees are entered directly into the HTE system. Afterwards the Office Specialist brings the cash deposit along with the HTE reports to the Office Specialist in the Administrative Services Department for review. The Administrative Services Department audits the cash deposits against the HTE reports, thereby ensuring that all receipts are accounted for and the reports match the bank deposit. The City believes that these procedures will sufficiently reinforce internal controls in Cash Collections. The Auditors' suggestion that the collections could be handled in Finance is also impractical for two reasons. First, customers would have to visit two City departments before they were issued a valid permit, causing an inconvenience to those who wish to obtain building permits. Second, the City has limited staff in the Accounting Division making it difficult to receive and issue cash receipts for all customers paying for building permits. 4. User access and Controls should be updated and restricted in the HTE System Response -The City places user controls on HTE. The MIS Coordinator has been working with the Accounting Supervisor on updating user access on the HTE system. The MIS coordinator has already deactivated terminated employees, changed user profiles so employees could have their own access code, and updated user access. The Accounting Supervisor informs the MIS Coordinator what basic access is needed for staff for particular functions (i.e. cash receipts, occupational license, etc.). All staff members are given access to their appropriate functions. Restrictions are placed within the system to ensure that certain functions such as payroll are not accessible and to prohibit changes in any particular function group. The Accounting Supervisor plans to conduct a periodic audit to review user access levels. The City believes in awell-trained staff. The MIS Coordinator will be attending a series of training classes during the spring. Funds have been programmed in the fiscal year 1999-2000 MIS budget for this purpose. The City has an informal policy covering items such as password usage and protection and to log off the system when not in use. The City intends to write a formal policy addressing these items and other related topics during the spring. FISCAL IMPACTS: 1. TDA reimbursement requests -There are no direct fiscal costs involved with preparing grant reimbursement requests. The City will realize revenues once the TDA reimbursement requests are processed. The amount of the reimbursement is $16,473. 2. Investment Reports -There are no direct fiscal impacts of preparing the Investment Report. 3. Cash Receipt Controls -There are no direct fiscal impacts of the cash receipt controls for the Recreation Department and Community Development Department. 4. HTE System Access and Controls - To address training for the MI5 Coordinator, a total of $8,000 has been included in the MIS program budgets for ongoing technical training. There are no direct fiscal impacts of updating and restricting HTE system access and controls. CONSEQUENCES OF NOT FOLLOWING RECOMMENDED ACTION(S): 1. TDA reimbursement requests -The consequences of not completing reimbursement requests could result in the City forfeiting revenues. 2. Investment Reports -The Cash and Investment Report prepared monthly accurately reflects the cash and investments. If the Cash and Investment Report is not properly completed, the City will not have accurate financial data to make business decisions. 3. Cash Receipt Controls -'The consequence of not having Cash Receipt controls is that the City cannot safeguard its assets. Internal controls are designed to identify potential problems. Fraudulent transactions would go undetected until policies and procedures were in place regarding cash receipts and deposits. 4. HTE System Access and Controls -The consequence of not monitoring system access and placing internal controls is that users exist in the system that are no longer working at the City, and users have access to menus and functions they should not be allowed into. ALTERNATIVE ACTION(S): To be completed. FOLLOW UP ACTION(S): Accept and file the report. Staff to implement recommended procedures. ADVERTISING, NOTICING AND PUBLIC CONTACT: Nothing additional. ATTACHMENTS: Independent Auditors Memorandum on Internal Control Structure for year ended June 30, 1999. O:/MaryJo/CouncilRpt 1/13/2000 CITY OF SARATOGA MEMORANDUM ON INTERNAL CONTROL STRUCTURE FOR THE YEAR ENDED JUNE 30,1999 M ASES&OCIATES November 24, 1999 To the City Council of the City of Saratoga ACCOUNTANCY CORPORATION 1670 Riviera Avenue -Suite 100 Walnut Creek; California 94596 (925) 930-0902 • FAX (925) 930-035 Under generally accepted auditing standards, auditors are encouraged tv report various matters car-cerning an entity's internal control structure noted during an audit, and are required to report certain of those matters. Matters that are resluired to be reported are significant deficiencies in the design or the operation of the internal control stricture that, in the auditor's judgment, could adversely affect the. organization's ability to record, process, surrmnari~e and report financial data consistent with the. assertions of managerrient in the financial ~. As part of the interim phase of our audit of the financial statea~ts of the City of, Saratoga for the year ended June 30, 1999, we considered the City's internal control structure in detierrnining the scope of our audit procedures for the purpose of rendering an opinion on the financial statements. While our purpose was not to provide assurances on the internal control structure, certain matters came to our attention that we want to report to you. 'These mothers, along with our recommendations: are desgn'bed in the accompanying memorandum. A material vvealmess is a significant deficiency in which the design or operation of one or more of the internal control struchue elements does not reduce to a relatively low level the risk that errors or irregularities in amowMs that would be material in relation to~the financial statements being audited may occur and not. be. detected within a timely period by employees in the normal course of performing their assigned functions. Our consideration of the internal control structure would not necessarily disclose all matters in the internal control structure that might be significant deficiencies and, accordingly, would not necessarily disclose all significant deficiencies that are also considered to be material wealmesses as defined above. However, none of the significant deficiencies described in the accompanying memorandum is believed to be a material weakness. The accompanying memorandum on internal control structure is intended solely for the use of management and the City Council. This restriction is not intended to limit the distribution of this letter and the accompanying memorandum which, upon acceptance by the City Council, are a matter of public record. To the extent that the City Council intends to rely upon this letter and the accompanying memorandum, such reliance should take into account the limited basis on which our recommendations were developed, as described above, and the liraitatio~ns inherent in the internal control structure. In addition, the City Council should understand that the criteria used by us in considering the internal control structure could differ significantly frmn the criteria the City Council maybe using for its purpose. We wish to express our appreciation for the courtesies and cooperation extended to our representatives during the course of their work. We would be pleased to discuss these recommendations in greater detail or otherwise assist in their implementation: very truly yours, A Profi~ssionai Corporation CITY OF SARATOGA MEMORANDUM ON INTERNAL CONTROL STRUCTURE Transportation Development Act (TDA) During our testing, we noted that reimbursement requests had not been completed for FY 97/98 and FY 98/99. During our prior TDA audit, we reviewed correspondence from MTC granting an extension of tirtro to file for reimbursement under an allocation insizttction which had expired. We urge the City to place snore emphasis on the timely completion of tasks necessary for grant reimbursement Cash and Investment Report .:<. During our review of the Cash and Investment Report as of March 1999, we noted the I,AIF balance reported on the Report was understated by $1,000,OOU representing a transfer dated.March 31, 1999 from the checkiag account. More care should be taken to ensure the report is accurately prepared. Cash Receipt Controls Recreation Department Collections: As of March 1999, Cash receipts are not integrated with the City's H.T.E. financial system. Our tats of the old system showed that receipts are not always issued for transactions proeased_ The existing system has the capability of generating receipts for all transactions. The City should require that receipts be issued to all customers. In addition the system should be integrated with the H.T.E. financial system as soon as possible. Community Development Departm~t Collections: Cash collections are handled by the City Planners, Inspectors and the Office Specialist. The Plarmars meet with the clients between the hours of 8 a.m to 12 p.m., they receive fees (cash and checks) and deposit them into the cash register without ringing a sale. The City Inspectors also receive fees themselves, and deposit there in an unlocked drawer by the counter between 8 a.m. and 12 p.m. and the Office Specialist gets the fees from the drawer, and the cash register after 12 p.m., and enters the amount in the system. Per the Office Specialist, because the Planners also use the cash register without entering a~+ sale, they can't use the tape from the cash register to reconer~e totals from the cash register and H.T.E. The City should c>;niralize the cash collection in the Community Development Department and the Office Specialist should be the only one receiving fees. She is in the same office and the same counter as the City Planners and City Inspectors. She should also enter the fees directly into H.T.E, and she should deposit the money in the cash regisixr. She will have the ability to reconcile the total from the cash registrar and the total from H.T.B. at the end of the day. Altxrnatively, the Collections could be handled in Finance. The customer could then be issued a valid permit after collection is verified by Finance. H.T.E. System Access & Controls During our audit, we noted that user access should be updated and restricted. For example, • Three former employee were still listed $s active users on H.T.E., • Three users had two user profiles, instead of having their own access code, and • Several users had more access than what is required by their functions. We also noted brat the MIS Direc~r has not received formal training on ~e H.T.E. system We recommend that the current user profiles be reviewed for appropriateness, training be provided for the MIS director on H.T.E., and a periodic audit take place td review user access levels. To streamline future access level problems, generic access groups could be created and validated by Mary Jo detailing what basic access is needed for particular functions (i.e. cash receipts group, payroll group, planning director group, etc.): This way aback-up employee for a desk, can be quickly given access and that access can be retracted once the regular person returns. CITY OF SARATOGA MEMORANDUM ON INTERNAL CONTROL STRUCTURE Also noted during out audit was that passwords acre not changed on a regular basis. We recommend that the system automatically ask for a password change regularly and automatic lock-out occur if password is not changed. We also recommend that a formal system usage policy be created and distributed to all personnel The policy should included item such ag: • Password usage and protection (i.e. don't give out or write down). " • Log off system when not in use. • Don't load any software unless MIS has approved its use.