PERFORMANCE AUDIT REPORT

PERFORMANCE AUDIT REPORT Kansas Fire Marshal: Reviewing the Funding and Administration of the Agency Executive Summary with Conclusions and Recommendations A Report to the Legislative Post Audit Committee By the State of Kansas 04-09

Legislative Post Audit Committee THE LEGISLATIVE POST Audit Committee and its audit agency, the Legislative Division of Post Audit, are the audit arm of Kansas government. The programs and activities of State government now cost about $9 billion a year. As legislators and administrators try increasingly to allocate tax dollars effectively and make government work more efficiently, they need information to evaluate the work of governmental agencies. The audit work performed by Legislative Post Audit helps provide that information. We conduct our audit work in accordance with applicable government auditing standards set forth by the U.S. General Accounting Office. These standards pertain to the auditor s professional qualifications, the quality of the audit work, and the characteristics of professional and meaningful reports. The standards also have been endorsed by the American Institute of Certified Public Accountants and adopted by the Legislative Post Audit Committee. The Legislative Post Audit Committee is a bipartisan committee comprising five senators and five representatives. Of the Senate members, three are appointed by the President of the Senate and two are appointed by the Senate Minority Leader. Of the Representatives, three are appointed by the Speaker of the House and two are appointed by the Minority Leader. Audits are performed at the direction of the Legislative Post Audit Committee. Legislators or committees should make their requests for performance audits through the Chairman or any other member of the Committee. Copies of all completed performance audits are available from the Division s office. LEGISLATIVE POST AUDIT COMMITTEE Senator Derek Schmidt, Chair Senator Bill Bunten Senator Anthony Hensley Senator Dave Kerr Senator Chris Steineger Representative John Edmonds, Vice-Chair Representative Tom Burroughs Representative Bill McCreary Representative Frank Miller Representative Dan Thimesch LEGISLATIVE DIVISION OF POST AUDIT 800 SW Jackson Suite 1200 Topeka, Kansas 66612-2212 Telephone (785) 296-3792 FAX (785) 296-4482 E-mail: LPA@lpa.state.ks.us Website: http://kslegislature.org/postaudit Barbara J. Hinton, Legislative Post Auditor The supports full access to the services of State government for all citizens. Upon request, Legislative Post Audit can provide its audit reports in large print, audio, or other appropriate alternative format to accommodate persons with visual impairments. Persons with hearing or speech disabilities may reach us through the Kansas Relay Center at 1-800-766-3777. Our office hours are 8:00 a.m. to 5:00 p.m., Monday through Friday.

LEGISLATURE OF KANSAS LEGISLATIVE DIVISION OF POST AUDIT 800 SOUTHWEST JACKSON STREET, SUITE 1200 TOPEKA, KANSAS 66612-2212 TELEPHONE (785) 296-3792 FAX (785) 296-4482 E-MAIL: lpa@lpa.state.ks.us June 15, 2004 To: Members of the Kansas Legislature This executive summary contains the findings and conclusions, together with a summary of our recommendations and the agency responses, from our completed performance audit, Kansas Fire Marshal: Reviewing the Funding and Administration of the Agency. This report includes several recommendations for the Legislature, the State Fire Marshal s Office, and the Information Technology Executive Council. We would be happy to discuss these recommendations or any other items in the report with you at your convenience. If you would like a copy of the full audit report, please call our office and we will send you one right away. Barbara J. Hinton Legislative Post Auditor

Overview of the State Fire Marshal s Office The Fire Marshal s Office assists local fire departments and promotes fire safety. The Office s mission is to protect Kansans lives and property from fires and explosions. It supplements the fire safety efforts of local fire departments. To accomplish its mission, the Office is organized into 4 separate divisions: fire prevention, fire investigations, hazardous materials, and the youth fire setter program. The Fire Marshal s employees are represented by 2 different unions. The Kansas Association of Public Employees (KAPE) represents the investigators, and the Wyandotte County branch of the International Association of Fire Fighters (IAFF) was recently chosen by the inspectors to be their representative.... page 3 Question 1: Is There Sufficient Oversight of the Operations of the Fire Marshal s Office? The Fire Marshal s Office has less oversight than most of the agencies we looked at. The Office is a relatively small, autonomous agency with 51 employees. The Fire Marshal is appointed by, and reports directly to the Governor. Only 5 state fire safety offices nationwide and 7 of Kansas smaller executive branch agencies are as independent as the Fire Marshal s Office. Senate Bill 252, which was introduced in 2003 but didn t pass, would have created a board to oversee the operations of the Fire Marshal s Office. Agency officials raised several concerns about such a board, including that it would slow down decision making, adding new costs, and creating the potential for in-fighting among board members. These concerns, while understandable, aren t unique and confront any agency that reports to a board or commission. Question 1 Conclusion. We re not certain why the Fire Marshal s Office was established without an oversight board or commission, but we found no compelling reason why it shouldn t be subject to the same level of oversight as most other agencies. Although the Fire Marshal s concerns about slower decisions and additional costs are understandable, they don t in our opinion overshadow the benefits to be gained from increased oversight and accountability. These include helping to ensure that government programs and agencies are responsive to the public, operate as intended, are administered in a cost-effective way, and are free of waste, fraud, abuse, and misconduct. An oversight board or commission also can help ensure that more diverse viewpoints are included in agency decisions, and can provide for more continuity in leadership. Question 1 Recommendations. The Legislature should amend State law to place the Fire Marshal s Office under the same level of oversight as most other State agencies. Options include placing it under a board or commission, within an existing State agency, or within a new consolidated public safety agency.... page 5... page 7... page 7 EXECUTIVE SUMMARY 1

Question 2: Is the Fire Marshal s Office Efficiently and Effectively Carrying Out the Functions Assigned to It by Law? Issues Related to Investigations: The Office has 12 investigators throughout the State. Of the approximately 17,000 fires in Kansas during 2003, the Fire Marshal s Office investigated 355 at the request of local officials. The Fire Marshal s Office conducts timely and thorough investigations to help local law enforcement. We reviewed case files for 15 investigations conducted during 2003. In those cases, investigators consistently arrived at the scene within 48 hours of being contacted by local law enforcement officials, in accordance with the agency s unwritten policy. The investigations appeared to be thorough and consistent, following the agency s systematic procedures for conducting investigations. Training documentation and the quality control process for investigations need to be improved. All investigators are required to be certified as law enforcement officers and complete at least 40 hours of ongoing training each year to maintain their certification. Internal computer reports indicated that all investigators had received at least 40 hours of ongoing training in 2003 to maintain their law enforcement certifications, but there was little evidence to support those reports, such as training certificates, agendas, or attendance sheets. The chief of the Investigation division reviews other investigators reports to ensure the investigations are conducted correctly. However, because she is allowed to sign her own investigation reports as both the investigator and the reviewer, her reports never receive an independent review.... page 8... page 8... page 10 Issues Related to Inspections: State law requires annual fire inspections of schools, health care facilities, and State correctional facilities. In addition, the Fire Marshal s Office inspects other facilities, such as preschools, day care facilities, and fuel facilities, even though there are no annual requirements for these facilities in State law. In 2003, about 4,700 facilities were inspected under State fire codes by either the Fire Marshal s Office or local fire departments. We surveyed the agency s inspectors about a number of issues related to the inspection process, but couldn t use their responses. The inspectors union sent its members an e-mail containing recommended answers to each survey question, compromising the survey results.... page 11 The Fire Marshal has taken a number of steps to try to increase inspectors productivity. After he was appointed in March 2003, the Fire Marshal adopted a number of new policies, including establishing new workload requirements, scaling-down the scope of certain annual inspections, and revising the inspection regions to make them more balanced. In addition, federal officials instructed the Fire Marshal s Office to rate the 2 EXECUTIVE SUMMARY

violations it finds during federal health care inspections more severely, triggering more follow-up inspections. The Fire Marshal s new policies and the changes to health care inspections helped contribute to a 57% increase in the number of facilities inspected from 2001 to 2003. Despite this increase in inspections, inspectors aren t conducting all the annual inspections required by law. As of March 2004, 19% of schools and 24% of health care facilities hadn t been inspected during the previous 13 months, in accordance with statutory requirements. The agency s information about school inspections conducted by local fire departments is incomplete, making it difficult for the agency to track which schools haven t been inspected. Even so, the Office should have known that not all school inspections had been conducted and followed up with inspectors and local fire departments as needed. The Fire Marshal told us he didn t have the staff resources to conduct all the required inspections of health care facilities, although he left 2 inspector positions open during 2003 and didn t reassign other inspectors to catch up on health care inspections. The Fire Marshal s inspection process doesn t follow best practices in several important areas. The agency s formal policy is to give facilities advance notice for routine State fire inspections which may give them time to hide violations. The inspection form used by inspectors doesn t include a checklist of the requirements that should be checked, increasing the risk that an inspector will forget something. There were documentation problems with 15% of the inspection files we reviewed, including missing or unsigned forms, and several reports couldn t be located at the main office in Topeka. The agency s documentation of the training it provides to inspectors is incomplete, and inspectors aren t required to disclose potential conflicts of interest. The Fire Marshal s Office s system for handling complaints is inadequate. There are no written policies on whether or when a facility should be inspected in response to a complaint, and the officials responsible for complaints had different and sometimes contradictory understandings of how quickly a complaint should be inspected. For 10 of the 16 complaint inspections we reviewed, there was no documentation of the actual complaint, which prevented us from assessing how long it actually takes the agency to respond to complaints. The agency has no system for tracking how complaints are handled and does a poor job of overseeing the complaint handling process.... page 12... page 13... page 15... page 16 The Office s enforcement efforts against facilities that don t correct violations are inadequate. Facilities are required to develop a plan for correcting each violation found during an inspection, although we found some cases where the approved plans didn t appear to be sufficient. The Office rarely conducts follow-up inspections to determine whether violations have been corrected, and it rarely imposes fines or penalties against facilities that have a history of not correcting violations. According to agency officials, the agency focuses on educating facilities rather than EXECUTIVE SUMMARY 3

penalizing them, and there seldom are any consequences for facilities that don t correct violations. Other Management Issues: We looked at a number of aspects of the Office s operations to determine whether they appeared to be appropriate and well managed. The current structure of the Fire Marshal s Office is more top-heavy than most fire safety offices we reviewed. When the Fire Marshal was appointed in March 2003, he reorganized the agency s management, creating 2 deputy fire marshal positions to oversee the 4 division chiefs and disbanding the Administrative division by moving most of its staff to other divisions or top management. The reorganization created an additional $73,000 per year in new and increased salaries, which in the short term were primarily paid for by leaving 2 inspector positions vacant for several months. Fully 5 of the 6 state fire safety offices we reviewed had fewer managerial positions than the Fire Marshal s Office, and only 1 other state (Delaware) had 2 deputy positions like Kansas. Employees reactions to the reorganization were strongly divided: many thought the reorganization appropriately addressed problems caused by the previous administration, while others felt the creation of the deputy positions was wasteful and politically motivated. The Office had inadequate password controls, increasing the risk that someone could access its computer data. The agency had no formal password policies, and its practices met few of the best practices we typically look for. As a result, employees were using very weak passwords. We were able to crack almost 60% of the passwords within 3 seconds, and more than 80% within 3 minutes. The agency has very limited information technology resources and its information technology manager has little knowledge of computer security. The agency has corrected, or is in the process of fixing, all the problems we found. We found no problems with other management areas we reviewed. We looked at the agency s actions or practices in 3 other areas: the use of regular license plates instead of official State license plates, the Office s handling of employee terminations, and the appropriateness of payments to employees. We found no problems in any of these areas. Question 2 Conclusion. The Fire Marshal s Office needs to make significant improvements to its inspection, complaint-handling, and enforcement processes to ensure that it is following best practices, carrying out the responsibilities assigned to it by law, and adequately protecting people and property from harm. As part of this effort, the Fire Marshal will need to determine how best to use the staff resources assigned to the agency, and how to improve cooperation with local fire departments.... page 18... page 21... page 21... page 26... page 26... page 27 Question 2 Recommendations. We make a number of recommendations to the Fire Marshal s Office to improve several processes, including: 4 EXECUTIVE SUMMARY

Investigation Process Develop written policies regarding the time frame for starting an investigation. Maintain sufficient documentation of the training investigators receive. Require an independent review of investigations conducted by the division chief. Inspection Process Discontinue the policy of scheduling inspections in advance. Develop a detailed checklist to be completed by inspectors during inspections. Maintain sufficient documentation of the training inspectors receive. Require inspectors to sign a form disclosing all potential personal impairments. Develop a system for management to identify whether facilities are being inspected in a timely manner. Enforcement Efforts Develop written policies for enforcement actions that make better use of the Office s authority to conduct follow-up inspections, assess fines or penalties, and issue cease and desist orders. Require local inspectors to submit copies of their school inspection reports as required by law. Assign responsibility for ensuring that violations in schools are corrected to the agency s enforcement staff. Use of Resources Review the responsibilities of the 2 deputy positions and the 4 division chief positions to determine whether they should be changed or eliminated. Computer Security Finalize a policy on password security. Provide the agency s information technology manager with training in network administration and general computer security. In addition, to better ensure that all agencies have adequate password controls, we recommend that the Information Technology Executive Council establish minimum password standards, require all agencies to comply with them, and provide security assistance and training to smaller agencies.... page 27 EXECUTIVE SUMMARY 5

Question 3: How Does the Amount of Money Generated by the Levy on Fire Insurance Premiums Compare to the Amount Needed to Operate the Fire Marshal s Office? Over time, the levy on fire insurance premiums generated far more money each year than the Fire Marshal s Office needed. Since it was created in 1913, the Fire Marshal s Office has been funded by a levy on fire insurance premiums collected throughout the State. Until fiscal year 2003, the revenues generated by the levy were used only to support the Fire Marshal s Office. From 2000 through 2002, the levy generated an average of $4.0 million each year, compared with an average of only $3.4 million each year in expenditures. As a result, the balance in the Fire Marshal Fee Fund grew from $2.8 million to $3.9 million during that time, a 39% increase.... page 30 Since 2003, significant portions of the levy revenues and fee fund balances have been transferred or used to support other programs. Beginning in fiscal year 2003, the Legislature has divided the levy between the Fire Marshal s Office, the Board of Emergency Medical Services, and the KU Fire Services Training Center. The shares of the Board and the Center, which total about $2 million each year, were made permanent by the 2004 Legislature. In 2004 and 2005, the Office s statutorily authorized share of the levy may not cover its estimated costs. From 2000 to 2003, the Office s share of the levy revenues, combined with the other revenues it receives, covered its operating expenditures each year. In contrast, revenues in 2004 and 2005 may not be sufficient to cover the agency s expenses. If current projections hold, the Fire Marshal s Office will have about $775,000 at the beginning of 2006, or about half of what it would need to pay its expenses until it receives new revenues in December 2006. Question 3 Conclusion. It s difficult to know how much fire insurance premiums will grow in 2004 and 2005 (although final revenues for 2004 should be available in a matter of weeks). Because the Fire Marshal s Office now receives a smaller share of those revenues and the balances in its fee fund have significantly decreased, the agency is more vulnerable if levy revenues don t grow significantly. The Division of Budget and the Legislature will need to keep a close eye on the actual growth of the fire insurance premium revenues. It the current estimates of revenues and expenditures are correct, and moneys are transferred to the General Fund in fiscal year 2005 as planned, the Fire Marshal s Office will be in difficult fiscal position at the start of 2006. APPENDIX A: Scope Statement... page 32... page 33... page 34... page 35 6 EXECUTIVE SUMMARY

APPENDIX B: Auditee Responses... page 37 In its response, the Fire Marshal s Office generally agreed with our recommendations, except for our recommendations to develop a more efficient system for managing inspection dates and to assign its enforcement staff responsibility for ensuring that violations found in schools are corrected. It also disagreed with our recommendation to the Legislature that the agency be placed under additional oversight. As a result of the agency s response to Question 3, we changed our projection of the agency s future revenues, which altered our findings and conclusions. In addition, we provided a copy of the section in Question 2 that pertains to computer password security to the chair of the Information Technology Executive Council, who indicated the Council would address our recommendation at its next meeting. This audit was conducted by Scott Frank, Lisa Hoopes, and Amy Thompson. Cindy Lash was the audit manager. If you need any additional information about the audit s findings, please contact Mr. Frank at the Division s offices. Our address is:, 800 SW Jackson Street, Suite 1200, Topeka, Kansas 66612. You also may call us at (785) 296-3792, or contact us via the Internet at LPA@lpa.state.ks.us. EXECUTIVE SUMMARY 7