October 29, Audit Committee City of Ashland 20 East Main Street Ashland, OR Re: FY City of Ashland Audit Management Letter

Transcription

1 October 29, 2007 Audit Committee City of Ashland 20 East Main Street Ashland, OR Re: FY City of Ashland Audit Management Letter This year s Management Letter is filled with information that is not just about a review but forward-thinking and appropriate because of what has occurred over the last decade in the private and government sectors. As in the past, the Finance staff takes these to heart and endeavors to address them in an expeditious manner. Even with that perspective, it sometimes takes multiple years to clear an issue and I want to assure the Committee that available resources are allocated to clear current and recurring comments and observations, large and small. For FY the biggest issue is, and will be for some time, complying with SAS No. 61, Communication with Audit Committees and SAS No.112, Communicating Internal Control Related Matters Identified in an Audit. These relatively new requirements will task the City and Parks, Audit Committee and respective staff to resolve, in part due to our various configurations. My recommendation is that staff work toward placing these issues before the elected bodies by January or February. This will allow staff to prepare a comprehensive approach to resolve these major initiatives in a proactive manner. This does not preclude simple adjustments that are quick fixes but such changes must fit into the written internal control policies and procedures document(s) adopted by those responsible for governance. FY significant deficiencies in internal control: 1. We (the Auditors) noted that the City does not have a written internal control policies and procedures document. In applying SAS No. 112 we believe that the City should adopt formal policies/procedures for all accounting areas, especially as it pertains to internal controls and the identification of key controls. Our audit did not uncover significant deficiencies pertaining to these areas other than the items noted below, however the policies/procedures in place are not in writing. We recommend at a minimum that the following areas be addressed (this constitutes a partial list, other areas of internal control should be addressed): a. Computer security and who should has access to passwords and how often passwords are changed. b. Controls over expenditures to ensure that there are no fraudulent checks or checks written in error - Who tracks the check sequence, who reviews the canceled checks back from the bank, who has custody of checks, and who is authorized to approve disbursements? i

2 c. Detailed explanation of the controls over cash accounts, including how many people it takes to open/close an account, controls over wire transfers, and review of bank reconciliations. d. Controls over cash receipting How do you ensure that receipts are always given, and that all receipts are recorded in the general ledger. How often are deposits taken to the bank. e. What internal controls and monitoring is used for reviewing and ensuring that the financial statements are accurate and are in conformance with GAAP (the control procedure here would be sending staff to training on new pronouncements, etc.) f. Any internal audit functions, antifraud programs, etc. g. Monitoring of internal controls by management and the governing body to ensure that controls are functioning properly and are evaluated when systems, the environment, and employees change. h. Other areas that could be discussed - capital asset accounting, employee dishonesty insurance, physical security of documents, payroll processing/timesheets, and any other applicable financial areas. i. Because of a limited number of available personnel, it is not always possible to adequately segregate certain incompatible duties so that no one employee has access to both physical assets and the related accounting records or to all phases of a transaction. Consequently, the possibility exists that unintentional or intentional errors or irregularities could exist and not be promptly detected. We recommend that the City address their segregation of duties issue in their internal control policies and procedures. Response: Staff agrees with the Auditor s assessment however the reader must note that there are things being done within many of the bulleted areas but they are insufficient in practice or documentation to clear this comment. I do not believe there is one document that addresses all of the issues to the detail level identified within SAS No.112. The key here is understanding and acceptance by those responsible for governance. This is an ideal time for the City to update, combine and augment the financial management policies included in the budget document and the cash and investment policies administered through the City Recorder/Treasurer s office for review and acceptance by City Council. This process should address each of the points included in the auditor comment, incorporating anything that is in existence or has already been accomplished so that the written requirement is met. This document must then be trained upon and used to ensure it remains current and can be validated routinely by Council. 2. We (the Auditors) noted that the Information Technology (IT) department does not have written internal control procedures that documents their internal controls over their internally developed utility billing system. We also noted that there was no written internal control procedures that details the general controls over all computers and systems Citywide. We recommend that the City develop written internal control procedures for these areas. Response: Staff agrees with the Auditor s assessment. Prior Technology Plans and software documentation require updating and revision and the Technology Department is working on them. Updates are in process and should be complete in FY The points identified in this comment will be addressed as part of the new documentation. ii

3 The following are Auditor recommendations for the previous year. The comments are repeated from their report to management for the year ended June 30, 2006, for perspective. Staff has provided updates as Responses for June 30, We (the Auditors) noted that not all major balance sheet accounts were reconciled on a periodic basis. We recommend that all major balance sheet accounts be reconciled on a monthly basis. Response: Materially completed in time for this audit. 2. In order to get fixed asset information into a format that is needed for the financial report, the City must export their fixed asset register out of Eden and into Excel. The City then manipulates the data within Excel. Excel is not made for fixed asset accounting and is prone to errors. We (the Auditors) recommend that the City work with Eden to enhance their fixed asset accounting system, in order to make it easy to work with and in the needed formats for financial reporting. Response: Not completed in time for this audit. Because of other tasks done to meet Point #1, this project has lagged. Excel was used again this year to provide audit work papers, however, the documentation was in better shape than prior years despite the use of a spreadsheet. Staff has already begun the project to convert records back into the financial management system. This comment should be revisited as part of the FY audit. 3. We (the Auditors) noted that the utility billing system cannot produce a report that breaks out the utility receivables by fund. This report would be a useful reconciliation tool for the City. We recommend that the City address this report writing issue. Response: Materially completed in time for this audit. Future requirements that the City should begin addressing as part of the above work during FY : SAS No. 114 The Auditor s Communication with Those Charged with Governance Statement on Auditing Standards (SAS) No. 114 supersedes SAS No. 61, Communication with Audit Committees, as amended. This SAS establishes standards and provides guidance to an auditor on matters to be communicated with those charged with governance In order to be in compliance with these new auditing standards the auditors and the City Council needs to evaluate the audit oversight committee for any issues that may come up. The City has a unique situation in that the City Recorder is an elected official, a voting member of the audit committee as well as part of accounting process at the City. We recommend that the Council discuss this issue and re-affirm their position on whether or not the City Recorder be a voting member on the audit committee. We believe that as long as the City Council understands the unique nature of the City Recorder s position that whatever decision is made will be acceptable. iii

4 Response: Staff agrees that a review and validation by Council of the roles, responsibilities and expected communications between the mentioned groups or positions will be beneficial to all and provide compliance to this new requirement. SAS No The Risk Assessment Suite The Auditing Standards Board has issued eight additional new statements related to risk assessment, effective for audits of financial statements for periods beginning on or after December 15, This SAS Suite s primary objective is to enhance auditors application of the risk assessment model in practice, and will require additional auditor and staff time in future years. Response: Staff looks forward to working with the auditor on these relatively new requirements. In summary, I hope these responses are helpful in understanding the work being done by the Administrative Services Department to meet or exceed City expectations and legal requirements. It should be understood that increased requirements such as those presented and discussed above will have a financial impact (staffing, workload and training) to ensure compliance. Sincerely, Lee Tuneberg City of Ashland Administrative Services & Finance Director iv

5 CITY OF ASHLAND ASHLAND, OREGON MANAGEMENT REPORT

6 October 19, 2007 City of Ashland City Council and Audit Committee In planning and performing our audit of the financial statements of City of Ashland as of and for the year ended June 30, 2007, in accordance with auditing standards generally accepted in the United States of America, we considered City of Ashland s internal control over financial reporting (internal controls) as a basis for designing our auditing procedures for the purpose of expressing our opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the City s internal controls. Accordingly, we do not express an opinion on the effectiveness of the City s internal controls. Our consideration of internal controls was for the limited purpose described in the preceding paragraph and would not necessarily identify all deficiencies in internal controls that might be significant deficiencies or material weaknesses. In addition, because of inherent limitations in internal controls, including the possibility of management override of controls, misstatements due to error or fraud may occur and not be detected by such controls. However, as discussed below, we identified certain deficiencies in internal controls that we consider to be significant deficiencies. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or a combination of control deficiencies, that adversely affects the entity s ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity s financial statements that is more than inconsequential will not be prevented or detected by the entity s internal controls. The Auditing Standards Board issued SAS No. 112, Communicating Internal Control Related Matters Identified in an Audit, effective for audits of financial statements for periods ending on or after December 15, This statement requires auditors to evaluate identified control deficiencies and determine whether those deficiencies, individually or in combination, are significant deficiencies or material weaknesses, and if so communicate them in writing to those charged with governance. SAS No. 112 specifically identifies a few common control deficiencies which must be addressed in each audit to determine if a significant deficiency exists, and based on our evaluation we have identified significant deficiencies in the design or implementation of internal controls, which are noted below. We consider the following deficiencies to be significant deficiencies in internal control: 1. We noted that the City does not have a written internal control policies and procedures document. In applying SAS 112 we believe that the City should adopt formal policies/procedures for all accounting areas, especially as it pertains to internal controls and the identification of key controls. Our audit did not uncover significant deficiencies pertaining to these areas other than the items noted below, however the policies/procedures in place are not in writing. We recommend at a minimum that the following areas be addressed (this constitutes a partial list, other areas of internal control should be addressed): o Computer security and who should has access to passwords and how often passwords are changed.

7 o Controls over expenditures to ensure that there are no fraudulent checks or checks written in error - Who tracks the check sequence, who reviews the canceled checks back from the bank, who has custody of checks, and who is authorized to approve disbursements? o Detailed explanation of the controls over cash accounts, including how many people it takes to open/close an account, controls over wire transfers, and review of bank reconciliations. o Controls over cash receipting How do you ensure that receipts are always given, and that all receipts are recorded in the general ledger. How often are deposits taken to the bank. o What internal controls and monitoring is used for reviewing and ensuring that the financial statements are accurate and are in conformance with GAAP (the control procedure here would be sending staff to training on new pronouncements, etc.) o Any internal audit functions, antifraud programs, etc. o Monitoring of internal controls by management and the governing body to ensure that controls are functioning properly and are evaluated when systems, the environment, and employees change. o Other areas that could be discussed - capital asset accounting, employee dishonesty insurance, physical security of documents, payroll processing/timesheets, and any other applicable financial areas. o Because of a limited number of available personnel, it is not always possible to adequately segregate certain incompatible duties so that no one employee has access to both physical assets and the related accounting records or to all phases of a transaction. Consequently, the possibility exists that unintentional or intentional errors or irregularities could exist and not be promptly detected. We recommend that the City address their segregation of duties issue in their internal control policies and procedures. 2. We noted that the Information Technology (IT) department does not have written internal control procedures that documents their internal controls over their internally developed utility billing system. We also noted that there was no written internal control procedures that details the general controls over all computers and systems City-wide. We recommend that the City develop written internal control procedures for these areas. The following are our recommendations for the previous year. The comments are repeated from our report to management for the year ended June 30, 2006, for perspective. 1. We noted that not all major balance sheet accounts were reconciled on a periodic basis. We recommend that all major balance sheet accounts be reconciled on a monthly basis. 2. In order to get fixed asset information into a format that is needed for the financial report, the City must export their fixed asset register out of Eden and into Excel. The City then manipulates the data within Excel. Excel is not made for fixed asset accounting and is prone to errors. We recommend that the City work with Eden to enhance their fixed asset accounting system, in order to make it easy to work with and in the needed formats for financial reporting. 3. We noted that the utility billing system cannot produce a report that breaks out the utility receivables by fund. This report would be a useful reconciliation tool for the City. We recommend that the City address this report writing issue. A material weakness is a significant deficiency, or a combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the entity s internal control. We did not identify any significant deficiencies that are considered to be material weaknesses:

8 New Issues Not Control Deficiencies In order to keep our clients aware of new accounting and auditing requirements we have detailed upcoming new issues: SAS No. 114 The Auditor s Communication with Those Charged with Governance Statement on Auditing Standards (SAS) No. 114 supersedes SAS No. 61, Communication with Audit Committees, as amended. This SAS establishes standards and provides guidance to an auditor on matters to be communicated with those charged with governance. In the wake of well-publicized audit failures and emerging best practices in corporate governance, expectations have increased for auditors to communicate openly and candidly with those charged with governance regarding significant findings and issues related to the audit. The SAS uses the term those charged with governance to refer to those with responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity, including overseeing the entity s financial reporting process. It uses the term management to refer to those who are responsible for achieving the objectives of the enterprise and who have the authority to establish policies and make decisions by which those objectives are to be pursued. Management is responsible for the entity s financial statements. The SAS identifies specific matters to be communicated, many of which are generally consistent with the requirements in SAS No. 61. However, the SAS includes certain additional matters to be communicated and provides additional guidance on the communication process. In particular, the SAS: Describes the principal purposes of communication with those charged with governance and stresses the importance of effective two-way communication. Requires the auditor to determine the appropriate person(s) in the entity s governance structure with whom to communicate particular matters. That person may vary depending on the nature of the matter to be communicated. Recognizes the diversity in governance structures among entities (including the existence of audit committees or other subgroups charged with governance) and encourages the use of professional judgment in deciding with whom to communicate particular matters. Recognizes the unique considerations for communicating with those charged with governance when all of those charged with governance are involved in managing the entity, which may be the case with some small entities. Adds requirements to communicate: An overview of the planned scope and timing of the audit. Representations the auditor is requesting from management. Provides additional guidance on the communication process, including the forms and timing of communication. Significant findings from the audit should be in writing when, in the auditor s profession judgment; oral communication would not be adequate. Other communications may be oral or in writing, Requires the auditor to evaluate the adequacy of the two-way communication between the auditor and those charged with governance. Establishes a requirement to document required communications with those charged with governance. In order to be in compliance with these new auditing standards the auditors and the City Council needs to evaluate the audit oversight committee for any issues that may come up. The City has a unique situation in that the City Recorder is an elected official, a voting member of the audit committee as well as part of accounting process at the City. We recommend that the Council discuss this issue and re-affirm their position on whether or not the City Recorder be a voting member on the audit committee. We believe that as long as the City Council understands the unique nature of the City Recorder s position that whatever decision is made will be acceptable.

9 SAS No The Risk Assessment Suite The Auditing Standards Board has issued eight additional new statements related to risk assessment, effective for audits of financial statements for periods beginning on or after December 15, This SAS Suite s primary objective is to enhance auditors application of the risk assessment model in practice, and will require additional auditor and staff time in future years. This communication is intended solely for the information and use of management, the Council, and others within the organization, and is not intended to be and should not be used by anyone other than these specified parties. PAULY, ROGERS AND CO., P.C.

10 November 16, 2006 Audit Committee City of Ashland 20 East Main Street Ashland, OR Auditor reportable conditions for FY : 1. We noted that not all major balance sheet accounts were reconciled on a periodic basis. We recommend that all major balance sheet accounts be reconciled on a monthly basis. Response: Staff agrees with the Auditor s assessment. Current and consistent reviews and reconciliations of major and minor balance sheet accounts are needed to provide accurate and timely financial reports and the basis for a good annual review. The Administrative Services Department (including Finance Administration and Accounting divisions) continues to struggle with hiring and maintaining qualified staff to do assigned work. Because of this, we have been unable to assess whether the number of staff and corresponding skill levels are appropriate for the workload. We have already begun to evaluate roles, responsibilities and skill gaps within the Accounting Division, and throughout the rest of the department, in order to reorganize. This will not be a comment for FY In order to get fixed asset information into a format that is needed for the financial report, the City must export their fixed asset register out of Eden and into Excel. The City then manipulates the data within Excel. Excel is not made for fixed asset accounting and is prone to errors. We recommend that the City work with Eden to enhance their fixed asset accounting system, in order to make it easy to work with and in the needed formats for financial reporting. Response: The City has been in a process of improving fixed asset records over the last five years. This process was somewhat affected by reporting requirements from GASB 34 and we have made good progress. Staff will not finish developing processes, procedures and training on the Eden software until FY All accounting staff can use spreadsheets and sometimes must resort to downloading into a format that is easier to work with to provide detail and supporting documentation. In general, I agree with the auditor about problems with spreadsheets, especially for accounting control. This will be resolved as part of the development of the software and training during this year. i

11 I hope these responses are helpful in understanding the work being done by the Administrative Services Department to meet or exceed City expectations and legal requirements. Sincerely, Lee Tuneberg City of Ashland Administrative Services & Finance Director PRIOR YEAR CONDITIONS, RESPONSES & UPDATES: Staff comments reviewing the prior year reportable conditions was provided to the auditor and included in their report. They are also presented below for your information: 1. We noted that the utility billing system cannot produce a report that breaks out the utility receivables by fund. This was part of a management comment that was issued in that has not been implemented (although the other parts of the prior management comment have been implemented). This report would be a useful reconciliation tool for the City. We recommend that the City address this report writing issue. FY Status: The City is in the process of converting to an enhanced utility billing system developed by Ashland s Information Technology department. Improved features (including reporting capabilities) within that application is currently meeting this need. Staff anticipates an external review of this software between January and March, 2007, before final acceptance. Prior Year Response: Staff agrees with the Auditor s assessment but believe it is a greater issue than just report generation. The rest of the comment from FY 2003 was cleared by hiring another programmer and Finance promising an independent review of the internally-built software. The City now has two programmers on staff and both of them are working on the upgrade to the internal package but progress has been slow. At the time of this report no schedule or plan is in place for implementation, documentation and training. Additionally, Finance did conduct a review of the existing software by the Government Finance Officers Association between March and September, GFOA s report recommended the City go out to bid for a new UB package for many reasons including the current software s inability to generate balancing reports. A copy of the report is available for review Key issues to consider when looking at bidding software are: Business processes - Ashland has a unique approach to most everything, especially with AFN as part of the billing process and such approaches may limit software packages that could be considered. ii

12 Complexity Ashland s utility bills have many components but fees and charges generally are either formula or table driven. On-staff programming does provide unique customization. Internal controls - Controls and documentation have been a problem for the city with the existing software and is a potential problem with the proposed new release of the internally-built software. Cost to buy and maintain - The city has many financial applications and are charged 16% (approximately $61,000 in FY ) annually for support and updates. A new UB system may cost over $200,000 and be $32,000+ per year to maintain. Staffing - We pay approximately $200,000 per year for programming staff support but they also do other work besides software creation and revision. Computer services has had difficulty in meeting demands put upon them in the recent past even though the total staff has grown by 3 since A possible approach to the challenge of a conversion is to permit the internally built software to compete in a RFP process with evaluations done by independent reviewers having no connection with the city s final decision. If the internal software was omitted from the process then programming staff would be expected to participate in evaluations and could be used to meet other systems needs after a conversion was complete. 2. We noted that bank reconciliations were a few months behind in Performing timely reconciliations of all accounts, especially cash accounts, are a necessary part of good internal control. We recommend that cash be reconciled monthly, preferably prior to the twentieth day of the subsequent month. FY Status: The Administrative Services Department has this as a goal for each month. Having a small staff, vacancies in positions and experiencing difficulty in filling positions with qualified staff has caused delays in getting all work done. Reconciliations for FY are up-to-date at this time. Prior Year Response: Staff recognizes this shortfall and has worked to be current as of the date of this report. The Accounting Division has endured four different changes in staff in the last 12 months. This has disrupted processes and put us behind in many areas. Errors and delays in financial reporting, and this year s annual audit, attest to this. Day to day activities are being done but monthly activities can lag and improvements in other areas have been delayed. As the new employees become more experienced with the City the likelihood of this recurring will be minimized. 3. We noted a few visa statements had supporting receipts missing. Maintaining appropriate documentation is a major part of maintaining control over disbursements. Also, the visa's are being paid before all of the receipts are received. Account Payable is instructed to do this in order to avoid late charges. There appears to be a few individuals who disregard the visa iii

13 documentation requirements, so the credit card policy should be enforced to either charge the employee personally for all unsubstantiated receipts or revoke card privileges. (Please note that the Internal Revenue Service (IRS) requires that employees substantiate all credit card reimbursements. The elements required for substantiation include: amount, time and date, place, and business purpose. According to the IRS, if credit card charges are not substantiated, the reimbursement amount could potentially be included in the employee s income.) FY Status: We have seen improvement in this area through enforcement by Accounts Payable staff, however, the Administrative Services Department is preparing to provide renewed training on this and other purchasing processes in the coming months. During the last year, Ashland has changed some purchasing polices. They also will be addressed in the training. The timing of payments on credit card charges does not match well with city processes and is now requiring considerable manual work to meet deadlines and to minimize fees. Missing receipts or documentation from a card holder are pursued by the Accounting Division. If an employee fails to adhere to guidelines, they can be held personally accountable and will, at least, lose credit card privileges. The existing process is still considered necessary given the potential costs related to more restrictive purchasing barriers on those operations needing materials and services immediately. Prior Year Response: The City works hard to keep costs down while effectively managing purchasing procedures and controls. Ashland s CAFR recognizes that no control will cost more than the benefit derived. Reviews of purchases, especially by credit cards, are done monthly to ensure the highest level of compliance possible given staff and exposure. Paying bank statements immediately does not sacrifice any control and does avoid thousands of dollars of late fees annually. Those individuals who carry credit cards are educated on the rules. Single or infrequent problems with lost invoices are professionally dealt with but ongoing violations result in rescinding the authority to use a City credit card. This can result in operational deficiencies when emergencies arise but it is then the department s responsibility to take necessary steps to minimize any such impact. The credit card for the employee with multiple violations was revoked and alternate purchasing methods were established. iv

14

15 RESOLUTION NO O v A RESOLUTION CHANGING THE COMPOSITION OF THE MUNICIPAL AUDIT COMMITTEE BY MAKING THE CITY RECORDER A VOTING MEMBER ALLOWING THE MAYOR AS AN ALTERNATIVE FOR A COUNCIL MEMBER AND REPEALING RESOLUTION NO RECITALS A The role and responsibilities ofthe Municipal Audit Committee were established in June 1991 pursuant to Resolution The committee wasre established in 1995 with modified objectives and responsibilities as set forth in Resolution and98 06 B The city council desires to modify the composition ofthe committee by making the city recorder a voting member and allowing the mayor to serve as a voting member THE CITY OF ASHLAND RESOLVES AS FOLLOWS SECTION 1 Committee Established The Municipal Audit Committee is established and shall consist offive voting members The committee may request the presence of any city official at its meetings SECTION 2 Terms Qualifications Vacancies A Four voting members shall be appointed by the city council and shall consist ofone council member or mayor one budget committee member andtwo citizens at large The fifth voting member shall be the City Recorder The terms of the council member or mayor and budget committee member shall be for one yeareach expiring on April 30 of each year and the terms for the citizens at large shall be for three yearterms expiring on April 30 or until their respective successors are appointed and qualified provided that in the first instance the terms of the initial citizen at large members shall be staggered for two and three years B In making the appointments the council shall give preference to persons with accounting or auditing experience background or expertise C Any committee member other than the city recorder who is absent without prior permission from the committee chair from two or more meetings in a one yearperiod shall be considered no longer active and the position vacant and a new person shall be appointed to complete the term SECTION 3 Quorum and Rules Three voting members shall constitute a quorum The committee shall establish rules for its meetings and shall meet at least semi annually and at such other times as may be necessary SECTION 4 Responsibilities The committee shall be responsible to the city A Recommend to the council an independent firm of certified public accountants to perform the annual audit of B Analyze and report to the council significant findings in the annual audit report and make recommendations regarding such findings C Make recommendations if any to the council regarding the following financial documents 1 Annual financial statements 2 Management letter submitted by the independent auditor and 3 Response to management letter submitted by city staff SECTION 5 Reports The committee shall submit copies of minutes of its meetings to the council Reports or recommendations of the committee shall be considered advisory in nature and shall not be binding on the mayor or city council

16 SECTION 6 Repeal Resolution No 98 06is repealed This resolution was read byitle only in accordan e with Ashland Municipal Code duly day of 1Sttt l 2003 ADOP TED this 7 PASSED and 3arbara Christensen Cty Rcorder SIGNED and APPROVED this day of x 2003 Alan DeBoer Mayor fhviewedato form Paul Nolte City Attorney