KAREN E. RUSHING. FOLLOW UP of. Tourist Development Tax. Visit Sarasota County

Transcription

1 KAREN E. RUSHING Clerk of the Circuit Court and County Comptroller FOLLOW UP of Tourist Development Tax Visit Sarasota County Original Audit Report Issued October 24, 2013 Audit Services Jeanette L. Phillips, CPA, CGFO, CIG Director of Internal Audit and Inspector General David Beirau, CIGA, CFE Manager of Audit Services Debra D. Martin, CPA, CFE, CGMA, CIGA Senior Internal Auditor/Investigator September 2015

2 TABLE OF CONTENTS Page Summary and Results 3 Closed Conditions and Follow-up Results 5 Appendix A Original Audit Report dated October

3 Summary and Results Background The purpose of the October, 2013 audit of Tourist Development Tax- Visit Sarasota County was to perform a limited review of management control practices at Visit Sarasota County and to review processes and controls relative to the County s contract with Visit Sarasota County. The original audit report concluded that Visit Sarasota County appeared to have adequate controls in place to mitigate risks related to Tourist Development Tax- Visit Sarasota County. In addition, the County appeared to be in compliance with applicable laws, resolutions and County policies and procedures. There were, however, opportunities for improvement identified for Visit Sarasota County to strengthen procedures and controls regarding computer passwords, receiving practices, and contract provisions, as detailed in the Opportunities for Improvement section of the original audit report. Objectives The objectives of this follow-up audit were to evaluate the observations reported on the Tourist Development Tax- Visit Sarasota County audit report, dated October 24, 2013 and subsequent corrective actions taken by responsible management. This was achieved by providing independent, objective analysis as well as reasonable assurance that the previous concerns have been addressed and appropriate corrective measures implemented. To meet the objectives of the follow-up audit, the following procedures were performed: Performed inquiries of the Sarasota County Office of Financial Management and Visit Sarasota County managers and staff. Obtained an understanding of changes made to the policies and procedures related to Tourist Development Tax Visit Sarasota County since the original audit report date. Examined supporting documentation for six invoices paid during the period of October 1, 2014, through September 8, 2015, totaling $114, Reviewed 100% of Visit Sarasota County contracts with vendors for tourism services including marketing, advertising, media, research analysis, and customer service. 3

4 Overall Results Based on the results of our follow-up audit procedures, Visit Sarasota County has addressed the previous concerns and implemented appropriate corrective action on the conditions identified in the original audit report. Condition Status A Computer Passwords Closed B Receiving Practices Closed C Contract Provisions Closed 4

5 Closed Conditions and Follow-up Results A. Computer Passwords Visit Sarasota County should strengthen its procedures and controls concerning the use and over-site of computer passwords. Audit Observation, Original Report dated October 2013: Computer access controls are intended to protect data and information technology (IT) resources from unauthorized disclosure, modification, creation or destruction. Effective access controls provide employee access to IT resources based on a demonstrated need to view, change, add, or delete data. Passwords are a measure commonly used to enhance computer security. Passwords should not be written down, spoken or shared with others. Visit Sarasota County s Financial Policies require a master record of all employee passwords be maintained by the Managing Director. The Managing Director for Visit Sarasota County confirmed that she maintains a file of all employee passwords. Recommendation, Original Report dated October 2013: Revise the Financial Policies to eliminate the maintenance of a master record of employee passwords. Cease the current practice. Current Status, Follow-Up Audit dated September 2015: The auditor observed that Visit Sarasota County s Financial Policies were modified and no longer require a master record of employee passwords be maintained by the Managing Director. We were advised by the Managing Director that the practice ceased after the original audit. 5

6 B. Receiving Practices Visit Sarasota County should strengthen its procedures to ensure that all invoices for goods and services are supported by evidence demonstrating receipt of the invoiced goods or services. Examples could include a packing list or other receiving reports approved by the individual who actually received the goods or services. Audit Observation, Original Report dated October 2013: Internal control processes and procedures are intended to protect assets and resources from unauthorized use. Effective receiving controls provide for documentation evidencing receipt of the goods ordered or services provided and invoiced. The review of purchases made by Visit Sarasota County employees disclosed that evidence was not maintained to demonstrate the receipt of the goods or services that were invoiced. Audit tests performed included the inspection of seven items that that were invoiced. The sample disclosed no exceptions. Recommendation, Original Report dated October 2013: Strengthen the internal control process to ensure that invoices presented for payment have adequate documentation to support receipt of the goods or services and corresponding payment. This can be accomplished by including evidence of receipt, i.e. a packing list or other receiving report approved by the individual who actually received the goods or services. Current Status, Follow-Up Audit dated September 2015: Our testing of supporting documentation included six reimbursement requests submitted to the County by Visit Sarasota County. Testing revealed that receipt for all goods or services was appropriately documented. This was evidenced by the receiving individual signing and dating the packing list or, if a packing list was not present, noting on the invoice that all goods were received as ordered and in good condition. Although proper receipting processes were implemented, the Visit Sarasota County Procedure Manual was not modified to include these activities. The document is currently being updated and the draft document shows inclusion of the proper receipting practices. The auditor observed two instances where approval for purchases was not appropriate. In one instance, there was no approval evidenced on the purchase transaction form. The auditor validated the existence of these items on September 15, In the second instance, the purchase of Visit Sarasota County advertising space was requested, received, and approved by the same person. The President advised that she has approved purchases after-the-fact when items are needed and she is unavailable, however, these two were missed. The Visit Sarasota County s Procedure Manual is being revised to allow for proper approval when the President is unavailable. 6

7 C. Contract Provisions Visit Sarasota County should strengthen its procurement procedures to ensure that all contracts include provisions that specify a not to exceed limit and monetary terms in US Dollars. Audit Observation, Original Report dated October 2013: Contracts should specify a maximum dollar limit and state monetary consideration in terms of US Dollars. Review of contracts initiated by Visit Sarasota County disclosed: One contract provided a detailed schedule of fees for various services but did not include a total contract value or a not to exceed contract dollar limit. The scope of the contract included services for Inbound Telemarketing, Reader Response Data Entry, Mail Fulfillment, and Database Maintenance and Reports. As of June 28, 2013 fiscalyear-to-date expenditures for this contract total $107, Further review of the procedures for contract over-site disclosed that the expenditures on the contract are regularly compared to the allotted budget for the contract. In the case sampled, the expenditures remained within the approved budget. Two contracts are defined in currency other than US Dollars. Both contracts include detailed provisions for exchanging the currency into US Dollars and set limits on the amount of exchange rate fluctuation that may occur. Specifically noted in the contract, the parties will determine the currency exchange rate found on to establish a Contract Exchange Rate. For each subsequent expenditure, the parties shall use the exchange rate set forth at the above referenced web address to determine the Exchange Rate of the Day. The Exchange Rate of the Day shall be determined as of the invoice date and shall apply to each subsequent expenditure. The parties agree to impose a cap on the maximum fluctuation in each applicable exchange rate to five percent (5%) for the original Contract Exchange Rate on October 1, of the initial contract year. In no event shall the applicable exchange rate exceed a five percent (5%) change from the Contract Exchange Rate. Documentation was available to support the currency conversion utilized to exchange the money. However, documentation was not available to evidence the monitoring of fluctuation in rates during the contract term. Further review of these specific contracts disclosed that all payments were within the established range of currency fluctuation. Recommendation, Original Report dated October 2013: Modify or revise standard contract language to include a defined contract limit and state monetary values in US Dollars. This will strengthen the contract to more effectively protect the interests of the contracting parties. 7

8 Current Status, Follow-Up Audit dated September 2015: The auditor reviewed six (6) contracts initiated by Visit Sarasota County for fiscal year The contracts were for tourism items related to marketing, advertising, media, research analysis, and customer service. One of the six was with an international firm and all monetary values were observed to be stated in US Dollars. Two contracts did not have verbiage that included a defined contract limit. Fee schedules for both contracts required monthly retainer fee payments as compared to variable payments. Although the risk of over payments to these vendors is reduced due to the fixed retainer amounts, Visit Sarasota County management has advised that appropriate verbiage setting limits will be included in all future contracts, regardless of fee structure. The auditor also observed two contracts with mathematical inconsistencies. Visit Sarasota County management advised that they will ensure that such discrepancies do not exist in the future. 8

9 Appendix A: Original Audit Report KAREN E. RUSHING Clerk of the Circuit Court and County Comptroller AUDIT OF Tourist Development Tax Visit Sarasota County Audit Services Karen E. Rushing Clerk of the Circuit Court and County Comptroller Jeanette L. Phillips, CPA, CGFO, CIG Director of Internal Audit Audit Team Jody Maxwell, CPA, CIA, CFE, CIGA Senior Internal Auditor October 24,

10 TABLE OF CONTENTS Page Summary and Results 3 Opportunities for Improvement, Management Response and Action Plan 6 10

11 Summary and Results The Clerk of the Circuit Count and County Comptroller s Internal Audit Department has completed an audit of the Tourist Development Tax Revenues specifically related to promotions and the contract with Visit Sarasota County. The audit was planned and conducted in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The purpose of the audit was to review internal controls and compliance with applicable laws, regulations, policies and procedures. Background The Board of County Commissioners (BCC) created the Tourist Development Council (TDC) in 1986 by adopting County Resolution No Pursuant to Section (4)(e), Florida Statutes, the TDC s primary purpose is to act in an advisory capacity to the BCC in matters relating to tourism and to review expenditures of tourist development taxes to ensure that they are made for authorized purposes. The TDC is composed of 13 members appointed by the BCC. Section , Florida Statutes, governs the assessment and use of tourist development taxes and allows counties to assess up to 6 percent of each dollar collected from rents of living quarters or accommodations in short-term (less than six months) facilities. This Section of the law specifies how counties that assess tourist development taxes can use each percent of the tax and requires that counties assessing tourist development taxes establish county ordinances that specify how each percent of the tax will be used. The BCC assessed tourist development taxes totaling 5 percent and established ordinances as required. The following chart summarizes revenues by approved allocation type and use for the Fiscal Year , as of August 31, Beach Maintenance Related Projects * Arts Promotion Tourist Promotions $13,400,087 Revenues as of August 31, 2013 FY $4,824,031 36% $3,216,021 24% $4,020,026 30% $1,340,009 10% * Beach Renourishment, Stadium, Aquatic Center, etc. 11

12 Source: Sarasota County Tax Collector, Tourist Development Tax Collections. As noted below, the promotion and advertising of Tourism is funded by 17.5% of the third penny, plus 12.5% of the third penny until May 1, 2013 and 100% of both the fourth penny and the last one-half cent of the fifth penny. Source: Sarasota County Office of Financial Management. 12

13 Objectives, Scope and Methodology Sarasota County promotes tourism through a contract with Visit Sarasota County. The audit team has conducted a follow-up of the current status of findings noted in Project , A Limited Review of management Control Practices at the Sarasota Convention and Visitors Bureau currently known as Visit Sarasota County. Additionally, the scope of the audit included a review of the processes and controls relative to the County s current contract with Visit Sarasota County; in the amount of $4,902,344, as amended. The objectives of the audit were to: Determine if adequate and effective controls are in place to provide reasonable assurance that key financial and operational risks have been mitigated in the administration of the related contract. Determine if the county and Visit Sarasota County have policies and procedures in place to ensure compliance with the provisions of the contract. To meet the objectives of the audit, the following procedures were performed: Reviewed authoritative rules and regulations including Section , Florida Statutes, section , Sarasota County Code of Ordinances, and and (addendum No. 1 to contract No ) County contracts with Sarasota Convention & Visitors Bureau, Inc. d/b/a Visit Sarasota County (VSC) Conducted interviews at both the county and Visit Sarasota County with staff responsible for management and oversight of the contract. Reviewed contracts, reports and other supporting documentation related to the terms of the agreement. Traced invoices to the receipt of goods. Identified opportunities for improvement. Overall Results There appears to be adequate controls in place to ensure that the provisions of the Visit Sarasota County contract funded by Tourist Development Tax are met. There are, however, opportunities for improvement as detailed in the Opportunities for Improvement section of this report. The following summarizes the results of the audit: Passwords - Visit Sarasota County should strengthen its procedures and controls concerning the use and over-site of computer passwords. Receiving Practices - Visit Sarasota County should strengthen its procedures to ensure that all invoices for goods and services are supported by evidence demonstrating receipt of the invoiced goods or services. Examples could include a packing list or other receiving reports approved by the individual who actually received the goods or services. Contract Provisions- Visit Sarasota County should strengthen its procurement procedures to ensure that all contracts include provisions that specify a not to exceed limit and monetary terms in US Dollars. 13

14 Opportunities for Improvement The audit disclosed certain policies, procedures, and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the Opportunities for Improvement presented in this report may not be all-inclusive of areas where improvement may be needed. Observations and recommendations were made in the following areas: A. Visit Sarasota County should strengthen its procedures and controls concerning the use and over-site of computer passwords. Observation Computer access controls are intended to protect data and information technology (IT) resources from unauthorized disclosure, modification, creation or destruction. Effective access controls provide employee access to IT resources based on a demonstrated need to view, change, add, or delete data. Passwords are a measure commonly used to enhance computer security. Passwords should not be written down, spoken or shared with others. Visit Sarasota County s Financial Policies require a master record of all employee passwords be maintained by the Managing Director. The Managing Director for Visit Sarasota County confirmed that she maintains a file of all employee passwords. Recommendation Revise the Financial Policies to eliminate the maintenance of a master record of employee passwords. Cease the current practice. Management Response On August 7, 2013, the Visit Sarasota County (VSC) Board of Directors approved revisions to the VSC Financial Policies which included the deletion of the master record of employee passwords provision (in section 11) and the practice immediately ceased. 14

15 B. Visit Sarasota County should strengthen its procedures to ensure that all invoices for goods and services are supported by evidence demonstrating receipt of the invoiced goods or services. Examples could include a packing list or other receiving reports approved by the individual who actually received the goods or services. Observation Internal control processes and procedures are intended to protect assets and resources from unauthorized use. Effective receiving controls provide for documentation evidencing receipt of the goods ordered or services provided and invoiced. The review of purchases made by Visit Sarasota County employees disclosed that evidence was not maintained to demonstrate the receipt of the goods or services that were invoiced. Audit tests performed included the inspection of seven items that that were invoiced. The sample disclosed no exceptions. Recommendation Strengthen the internal control process to ensure that invoices presented for payment have adequate documentation to support receipt of the goods or services and corresponding payment. This can be accomplished by including evidence of receipt, i.e. a packing list or other receiving report approved by the individual who actually received the goods or services. Management Response In September 2013, the VSC Procedures Manual was updated, reflecting that staff retain the packing list and/or receiving report if available upon receiving a shipment. The packing list and/or receiving report shall be attached as backup to the invoice. Should neither a packing list nor a receiving report be included with the merchandise delivery, the staff will indicate on the invoice that the shipment was received in good order and as invoiced (or describe the variance such as a backorder). 15

16 C. Visit Sarasota County should strengthen its procurement procedures to ensure that all contracts include provisions that specify a not to exceed limit and monetary terms in US Dollars. Observation Contracts should be designed to effectively protect the interests of the contracting parties. Contracts should specify a maximum dollar limit and state monetary consideration in terms of US Dollars. Review of contracts initiated by Visit Sarasota County disclosed: One contract provided a detailed schedule of fees for various services but did not include a total contract value or a not to exceed contract dollar limit. The scope of the contract included services for Inbound Telemarketing, Reader Response Data Entry, Mail Fulfillment, and Database Maintenance and Reports. As of June 28, 2013 fiscal-year-to-date expenditures for this contract total $107, Further review of the procedures for contract over-site disclosed that the expenditures on the contract are regularly compared to the allotted budget for the contract. In the case sampled, the expenditures remained within the approved budget. Two contracts are defined in currency other than US Dollars. Both contracts include detailed provisions for exchanging the currency into US Dollars and set limits on the amount of exchange rate fluctuation that may occur. Specifically noted in the contract, the parties will determine the currency exchange rate found on to establish a Contract Exchange Rate. For each subsequent expenditure, the parties shall use the exchange rate set forth at the above referenced web address to determine the Exchange Rate of the Day. The Exchange Rate of the Day shall be determined as of the invoice date and shall apply to each subsequent expenditure. The parties agree to impose a cap on the maximum fluctuation in each applicable exchange rate to five percent (5%) for the original Contract Exchange Rate on October 1, of the initial contract year. In no event shall the applicable exchange rate exceed a five percent (5%) change from the Contract Exchange Rate. Documentation was available to support the currency conversion utilized to exchange the money. However, documentation was not available to evidence the monitoring of fluctuation in rates during the contract term. Further review of these specific contracts disclosed that all payments were within the established range of currency fluctuation. Recommendation Modify or revise standard contract language to include a defined contract limit and state monetary values in US Dollars. This will strengthen the contract to more effectively protect the interests of the contracting parties. Management Response Contracts for FY 2014 with international firms have been converted to U.S. Dollars and all contracts contain the do not exceed wording. For the remaining months of FY 2013, evidence that the currency fluctuation has been monitored has been noted on invoices. 16