Report on and Discussion of Internal Audit Activities

Transcription

1 CONTACT: Mark Filippone MEETING DATE: May 21, 2015 AGENDA ITEM: RELEVANT POLICY, STATUTE OR GUIDING PRINCIPLE: 2010 CAWCD Strategic Plan Reliability: Effectively Operate and Maintain CAP Assets PREVIOUS BOARD ACTION/ACTIVITY: The Finance Audit and Power Committee (FAP) receives regular reports on Internal Audit activities. ISSUE SUMMARY/DESCRIPTION: A final report was issued for the Banking/Cash Management Audit. Fieldwork is in progress for the IT Department Information Security Policy Audit, the CAGRD Water Provider Reports, and the audit of Heath Benefits Administration. Details are provided in the attachment to this brief. s.

2 Banking/Cash Management Audit Final report was issued on 5/4/15 Background: Reserves Restricted reserves are those specified by contract or law. Committed reserves are for special purposes as made by Board action. Banking/Cash Management Arizona Revised Statute (ARS) Title 48, Chapter 22, Article 1.0 governs all funds received on behalf of CAP. ARS (A)(5) specifies that excess funds not immediately required must be invested with the Arizona State Treasurer pursuant to ARS A listing of State Treasurer investments permitted by law is detailed under ARS In addition to participating in State Treasurer investment pools, funds needed to meet the immediate expenses and costs of the CAP are held in a Bank of America/Merrill Lynch checking account. The objectives of CAP's cash management guidelines are to ensure the: (a) safety of principal by maximizing investment income while maintaining the preservation of capital; (b) cash and investment fund balances will remain sufficiently liquid to enable CAP to meet all operating requirements and expenses that might be reasonably anticipated; (c) investment pools and fund balances will be managed with the objective of attaining at a minimum, a market-average rate of return, taking into account the constraints of state-mandated statutes and cash flow needs. Scope and Objectives: The objective of this audit was to evaluate internal controls over cash management. We also verified that disbursements and replenishments from restricted and committed reserves were in accordance to Page 1 of 5

3 governing criteria. Our scope did not include the Captive Reserve because it had adequate third-party oversight by both the State of Hawaii and CAP's external auditors. Audit scope also did not include a review of the 9(d) Debt Reserve because it has yet to be established. Banking/Cash Management Audit Executive Summary: Based on our audit procedures, we believe that 's (CAP) internal controls for reserves are good and are effectively managing risks. With the exception of a few minor improvement opportunities, banking/cash management internal controls were found to be operating as designed. We found improvement opportunities dealing with information security, check handling, and the online banking payment template approval structure. We found a desk operating procedure in the Livelink document management system that contained login credentials to websites containing sensitive employee and retiree information. Login credentials should be safeguarded, especially if they are used to access sensitive information. Management removed login credentials from the procedure and changed the password for the credentials that access sensitive information. Upon check receipt Mailroom staff should restrictively endorse checks "for deposit only" to CAP's and CAGRD's bank accounts. The current mailroom check processing procedure does not require restrictive endorsements. Finance Management ordered the restricted stamp. Once the stamp arrives, Mailroom staff will restrictively stamp all checks "For Deposit Only CAWCD." Some incoming checks are received by Central Arizona Groundwater Replenishment District (CAGRD) staff prior to being received and logged by the Mailroom. CAGRD staff explained that sometimes customers drop off checks and correspondence at CAP's Front Desk either personally or via overnight packages. After copying the checks and marking them with the appropriate account codes, CAGRD staff hand carry checks over to the Mail Room. A key component of an effective cash-handling process Page 2 of 5

4 Banking/Cash Management Audit Executive Summary (Continued): is having a centralized point of cash collection, where all incoming checks are logged for future reconciliation by other employees who work independently from the mail opening step of the process. This control point is used to ensure that checks cannot be fraudulently removed without detection. The control is circumvented when individual departments receive checks prior to the Mailroom. During our fieldwork we found one instance where CAP was not following Bank of America's recommended approval structure for the CashPro Online system. We found one CashPro user who had the ability to approve his own templates, which was not an appropriate segregation of duties. Management immediately took action to change CashPro Online's entitlements to the recommended approval structure. There are no pending management actions. All management actions were completed prior to the issuance of this report. Records Retention Scheduled for late 2 nd Quarter IT Department Information Security Policy Audit Onsite fieldwork completed the week of May 11 th. The final report should be issued in early June. Page 3 of 5

5 CAGRD Water Provider Reports The last member land inspection is scheduled for the week of May 18 th. All final audit reports and inspection findings should be resolved by mid-june. Health Benefits Administration Fieldwork is in progress for audits of third-party administration of CAP's third-party administration of heath claims processing and prescription drug program. Final reports are due by the end of June. Tools, Consumable Supplies, and Other Accountable Non- Capitalized Property Scheduled for 3 rd Quarter Palo Verde Morgan Transmission Scheduled for 3 rd Quarter Page 4 of 5

6 Warehouse Management Scheduled for 4th Quarter Page 5 of 5