REPORT #: 2013-01 Risk Management Operations Audit August 29, 2012
In accordance with Internal Audit s fiscal year 2011-12 annual work plan, Internal Audit completed a Risk Management Operational audit. The objectives of this audit were to obtain an understanding of the Risk Management function and to determine if adequate controls exist to ensure that the Risk Management function is performed in a consistent, effective, and efficient manner. processing of all invoices and time tracking, that have not been fully implemented within ivos. The specific areas included within this Risk Management audit were as follows: Claims Background The Risk Management function is currently a collaborative effort performed by the City Clerk s Office, City Attorney s Office, Risk Management Division of the Finance Department, and Human Resources. Currently, all claims and litigation are received by the City Clerk s office and forwarded to the City Attorney s Office who is responsible for processing and resolving these claim or litigation files. All insurance is handled by the Finance Department along with the responsibility for identifying, controlling, and financing risks. Workers compensation and safety is the responsibility of the Human Resources Department. For the purposes of this audit, the workers compensation and safety functions performed by the Human Resources Department was excluded. To facilitate the recording and tracking of all claims and/or litigation, the City utilizes the ivos Liability and Property Claims Management System. This system was obtained to replace the FileMaker Pro system that was previously being utilized to record and track claims and/or litigation cases by the City Attorney s Office. At the time of the audit, all claims and/or litigation cases were being recorded within the ivos system. However, there were other functions, such as the Anyone that believes he/she has a right to payment for damages from the City of Glendale or on an unpaid contract with the City of Glendale may file a written claim within six months from the event s occurrence. Claims are presented to the City Clerk s Office and routed to the City Attorney s Office for review and resolution. Litigation In the event the claim is rejected, the claimant has the right to file a lawsuit within six months of the claim being rejected. Lawsuits are presented to the City Clerk s Office, routed to the City Attorney s Office, and assigned to a Litigation Attorney for processing and resolution. Insurance Risk Management and Legal is responsible for setting insurance requirements for all procurements and agreements. Acquiring insurance for the City and loss notification to our carriers, resolving coverage issues on City policies. Reviewing and approving third-party insurance policies submitted August 29, 2012 1
with responses to requests for proposals, purchase orders, contracts, filming/special events, and permits issued by Public works (Engineering and Traffic Engineering). Risk Management is also responsible for handling claims against our Property Insurance Policy(s) when the City has a property loss. Currently, the City carries the following types of insurances: o Excess Liability Risk Management currently administered by the Human Resources Department, which includes Workers Compensation and Safety, has been excluded from this audit. In order to accomplish the audit objectives, Internal Audit performed the following: Reviewed the City s administrative policies Reviewed the Business Process Review performed by Aon esolutions o Excess Workers Compensation o Employment Practice/Directors and Officers o Property Insurance for GWP o Property Insurance for the City, excluding GWP o Aviation o City Crime Policy o Surety Bonds for the City Clerk and City Treasurer s Office o Builders Risk for Individual Capital Projects Scope and Procedures The scope of this audit included the Risk Management process related to claims, litigation, and insurance for the period of January 1, 2011 March 12, 2012. The portion of Conducted staff interviews Performed detailed testwork to verify the following: o The consistency, accuracy, and timeliness of the establishment of claims and litigation cases. o The consistency, accuracy, and timeliness of the establishment of the reserve amounts. o The consistency and completeness of internal staff time invoiced. o The completeness of electronic records. o The accuracy of the internal staff billing rates. Conducted a short survey of neighboring cities on structure and establishment of reserves. August 29, 2012 2
Summary of Results As a result of the audit procedures performed, 16 improvement opportunities were identified related to the claims, litigation, reserve, and insurance processes. Recommendations included, but were not limited to, considering the consolidation of the Risk Management functions, excluding Workers Compensation and Safety, under the management of one department, documentation of Risk Management roles and responsibilities, documentation of policies and procedures for the notification of incidents that have potential and/or actual liability to the City, documentation of detailed procedures relating to submitting third-party insurance for review and approval for purchase orders, contracts, and request for proposals. August 29, 2012 3
General Controls 1. Currently, the Risk Management function does not have a strong coordination in its activities, issues, information sharing, etc. The Risk Management related tasks appear to be handled separately with little coordination. This may be partially due to the fact that claims processing and mitigation are managed by two separate departments. Improved coordination of the Risk Management functions will decrease the risk that information is not properly communicated between the related parties and improve operationally efficiency. It is recommended that the coordination of Risk Management functions, regardless of the departments handling those functions, improve. This may be accomplished with more frequent meetings to discuss claims, issues, etc. and improved reporting and frequencies of those reports. Improved coordination may also be accomplished by centralizing the management oversight of the claims processing and mitigation functions. The City Attorney s Office and Risk recommendation. The City Attorney s Office believes that claims should continue to be handled inhouse to avoid or minimize liability due to early oversight of problematic claims/cases and litigation must continue to be handled by the City Attorney s Office. A proposal to the City Manager s Office for the division and/or consolidation of department responsibilities and coordination of risk management related activities is anticipated to be completed by October 31, 2012. 2. Risk Management s liability function related responsibilities have not been clearly designated and communicated to City staff. Failure to clearly define all Risk Management job responsibilities may result in documents being routed to the wrong locations and could decrease the efficiency of the review processes. It is recommended that the responsibilities for each of the Risk Management related staff be defined and documented. This document should include a list of activities and/or transactions that require third-party insurance coverage review and/or transactions that require the City to obtain additional coverage (i.e. when additional City property is purchased). Risk Management agrees with the recommendation and will create a defined work program that will include roles, responsibilities, objectives, and an organizational structure. The anticipated completion date is October 31, 2012. August 29, 2012 4
3. A procedure has not been established to ensure that all incidents involving City property and/or incidents that may potentially involve damage caused by the City should be reported to the Risk Management and/or Legal Department immediately. Lack of a procedure to document the details of who should be notified, what types of incidents need to be reported, a timeframe for the reporting of the incident, and the information that needs to be captured for recording purposes increases the risk that the total potential liabilities to the City are not properly recognized, addressed, and/or recorded in a timely and complete manner. Additionally, proper and timely notification of incidents that are or may potentially be the City's responsibility will enable the City to respond and mitigate any further damages. It is recommended that a procedure be established and implemented to ensure that all incidents responded to by City staff involving City property and/or potential responsibility for damages should be reported to designated personnel within a City prescribed timeframe. These procedures should also include the individuals that should be notified once the City has been made aware of an incident that has actual and/or potential liability to the City. For example, in the event that Fire or Police Staff are dispatched for a trip and fall, procedures should be established to ensure that the condition of the location is noted, pictures are taken, and the appropriate City staff (i.e. Public Works) is notified to establish a work order to repair any hazardous areas. Once established, the policy should be communicated to all City staff. The City Attorney's Office and Risk recommendation and will work together to establish, document, and communicate a policy and procedure that will specify the individuals to be notified for each type of incident with an actual or potential liability to the City. The anticipated completion date is November 30, 2012. August 29, 2012 5
4. Citywide procedures for submitting insurance documents and/or bonds related to contracts, purchase orders, change orders, and request for proposals for review and approval have not been established. Lack of a procedure for the submission of insurance and/or bonds related to contracts, purchase orders, change orders, and/or request for proposals for review and approval increases the risk that insurance documentation is not forwarded to the appropriate Risk Management personnel which delays the insurance approval process. Additionally, for change orders, the lack of a procedure to ensure that the previously approved insurance coverages are sufficient to cover the additional work included within the change order increases the City's potential liability exposure. It is recommended that a desk procedure for submitting insurance documents for review and approval be established. This procedure should include when insurance is required, who is responsible for performing the review, where the insurance documents should be routed, what documents are required to be submitted to facilitate the insurance document review, when the insurance documents should be submitted to Risk Management, and the importance of following the procedures. The City Attorney's Office and Risk Management agree with this recommendation and will work collaboratively to develop an insurance and/or bond approval process for the contract, purchase order, change orders, and/or requests for proposal. Documentation will include a work flow for insurance review and approval for each type listed above and will be communicated Citywide. Targeted Completion June 30, 2013. August 29, 2012 6
5. User identifications and passwords have been established within the ivos system that cannot be supported by the appropriate Request for ivos access form. The set-up of user identifications and passwords without the appropriate authorization increases the risk of unauthorized users. It is recommended that the ivos user listing be updated to reflect only those individuals with the appropriate authorized ivos user access authorization form. It is further recommended that no additional ivos user access be granted without the appropriate authorization form. Risk Management agrees with the recommendation and has deactivated those individuals without an ivos user access authorization form. Additionally, no user will be granted access until the appropriate ivos user access authorization form has been received. 6. All Risk Management related personnel within the Legal Department have not yet been trained on the ivos system. Failure to train Risk Management related personnel within the Legal Department to utilize the ivos system decreases the efficiency, timeliness, and effectiveness of the system. It is recommended that all Risk Management related personnel within the Legal Department be trained on the ivos system. The City Attorney's Office and Risk recommendation. Training has been provided to all support personnel. Support staff provides all data entry and report generation for each file on the attorney's behalf. In addition, three attorneys have been given access to ivos; however, only one has been trained. The City Attorney's Office anticipates that the remainder of the staff will be trained by November 30, 2012. August 29, 2012 7
Claims/Litigation 7. File numbers are currently manually assigned to each case. Based upon testwork performed, it was noted that three numbers out of a range of 367 (0.8%) could not be located within either the ivos or FileMaker Pro system for fiscal year 2011 files. Additionally, as of March 13, 2012, 13 of 235 (5.5%) of the file numbers could not be located within ivos for the fiscal year 2012 files. Lack of a procedure to assign a numerically sequenced file number and enter all claims and/or lawsuits into the ivos system upon receipt increases the risk that claim and/or lawsuits are not properly recorded and/or tracked and increases the risk that the potential liability to the City is incorrectly stated. It is recommended that each case be automatically assigned a file number upon receipt. City Attorney's Office and Risk recommendation and began utilizing the ivos automatic numbering system effective July 1, 2012. August 29, 2012 8
8. Based upon detailed testwork performed on a sample of cases included within ivos, we noted that it is taking an average of 11 working days (excluding weekends and the seven lawsuits from the previous fiscal year) to establish claims, lawsuits, and tendered cases within the ivos system. Failure to enter claims, lawsuits, and tendered cases within the ivos system increases the risk of incomplete liability information being made available for review by City staff and management. It is recommended that a procedure be established and implemented to specify the timeframe for which a claim, lawsuit, and/or tendered case should be entered into the ivos system. It is further recommended that a report be created to enable management to easily review the timeliness of the entries. The City Attorney's Office and Risk recommendation. A procedure will be established to specify that all claims and/or litigation files should be set up within 48 business hours of receipt from the City Clerk's office. Additionally, Risk Management has developed a report which reflects all new files opened during the prior week and a report to show files that were closed during the prior week. Risk Management will also work with ivos to establish a date field to record the date for which the claim or litigation was received by the City Attorney's Office and the date the item was received by the City Clerk. This will enable us to determine the timeliness of entry into the ivos system is maintained. The anticipated completion date is September 30, 2012. August 29, 2012 9
9. Based upon reserve testwork performed, we noted the following: - 39 of 40 (97.5%) files did not have a reserve established within two days of the claims receipt. - 10 of 40 (25%) files did not have any internal time invoiced to the case. - No spreadsheet to document how a reserve estimate was determined is currently maintained. Failure to establish a reserve estimate in a timely and accurate manner increases the risk of incorrectly reporting the City's potential liabilities. Failure to record staff time spent on cases increases the potential risk that the City does not fully recover all expenses associated with a covered event. Documentation of the reserve estimate calculation within the file would provide an explanation of the claim numbers that were included and the reasons that certain claimed amounts were excluded. The estimate for the internal defense reserve should also include an estimated number of hours to process the case. It is recommended that management ensure that the methodology for the reserve estimates are documented and entered into ivos in a timely manner and that the documentation is included within the ivos system. Additionally, it is recommended that management ensure that all staff time is properly invoiced and recorded within the applicable file. City Attorney's Office and Risk recommendation and will work collaboratively to establish a policy and procedure to specify that all reserve calculations be documented and entered into ivos within 48 hours of receipt of the claim/lawsuit by the City Attorney's Office. Additionally, a procedure will be created to document that each file handled by internal staff must have the appropriate staff time invoiced and recorded to the case. The anticipated completion date is September 30, 2012. August 29, 2012 10
10. Claim/litigation status cannot be identified within ivos. Lack of a procedure to track claim and/or litigation status within the ivos system decreases the efficiency and effectiveness of the automated claims/litigation tracking system. It is recommended that the Legal Department determine the feasibility of tracking claim and/or litigation status within the ivos system by implementing ivos system generated standard form letters. This process will make the generation of form letters more efficient while also making them available within ivos for all users to identify the general statuses such as whether a letter has been mailed to a claimant requesting additional information, the information from the claimant has been received, a letter has been sent to the department involved requesting claim related details, and/or the department memo has been received. The City Attorney s Office and Risk recommendation and will implement standardized system generated correspondence within ivos by October 31, 2012. August 29, 2012 11
11. Internal staff time is being maintained outside of the ivos system and manually entered into the ivos system to track litigation attorney expenses only. Other claim/litigation related staff time expenses related to claims and/or litigation are not captured within the ivos system. Lack of a complete and/or accurate time reporting increases the risk that the claim/litigation costs are understated. The proper and accurate recording of staff time related to specific cases will also increase the likelihood that the City may be able to obtain coverage that would allow the in-house legal and other risk management staff expenses to be applied to the Self Insured Retention (SIR) and to be reimbursed for actual staff time expended for all FEMA related claims. Additionally, the implementation of time tracking within the ivos system will decrease the duplicate entry and risk of input errors. It is recommended that the Legal Department and the Risk Management Section implement a procedure whereby all staff time, including the time of the Executive Analyst, be captured within the ivos system and appropriately billed to the case. It is further recommended that upon implementation of the time tracking methodology, the City request the insurance broker to solicit bids for a policy that would allow the City to apply internal staff time to towards the insurance deductible. The City Attorney's Office and Risk recommendation. The City Attorney's Office has been tracking the attorney's time, will begin recording and tracking the Executive Analyst's time, and will work with the insurance broker to establish a methodology for a blended rate acceptable to the insurance carriers to capture other administrative staff time within ivos. Although the City Attorney's Office currently has the ability to input time directly into ivos, the City Attorney s Office will not utilize this feature until the report necessary to generate hours worked for a specified timeframe to create an invoice to be entered into ivos as a paper transaction to properly reduce the case's reserve amount becomes available. The anticipated completion date to complete the report necessary to invoice time and to implement the time reporting within ivos is March 31 2013. August 29, 2012 12
12. Hourly rates utilized to calculate staff costs related to cases needs to be reviewed and updated on a periodic basis. It is recommended that a procedure be established and implemented for the periodic review of the hourly salary and benefits charges being utilized in the billing calculation. It is recommended that a procedure be established and implemented for the periodic review of the hourly salary and benefits charges being utilized in the billing calculation. The City Attorney's Office and Risk recommendation. An interface between the City s HR System (GEMS) and ivos has been set-up to automatically update each employee s loaded hourly rate on a quarterly basis. In the event that a blended rate is utilized, the hourly rate would need to be manually updated. The anticipated completion date is March 31, 2013. 13. New vendors set-up within the PeopleSoft system are not interfaced into the ivos system. Lack of an interface between PeopleSoft and ivos results in duplicate entry which decreases efficiency and increases the chance of data entry errors. It is recommended that Risk Management follow-up with ivos to ensure that this new vendor interface is established between PeopleSoft and ivos. Risk Management agrees with the recommendation and will work with ivos to ensure that the new vendor interface between PeopleSoft and ivos is established. The anticipated completion date is January 31, 2013. August 29, 2012 13
14. Electronic documents are printed to be scanned into FileNet and/or ivos. The lack of a procedure to attach, rather than print and scan, electronic documents unnecessarily increases the volume of documents requiring scanning and potentially decreases the timeliness that documents could be made available with FileNet and/or IVOS. It is recommended that electronic documents be attached directly to FileNet and/or ivos upon receipt. The City Attorney's Office and Risk recommendation. The Risk Management Division has been electronically attaching documents directly to ivos and will work with the City Attorney's office to implement software to secure the information being emailed through encryption to enable the City Attorney s Office to electronically upload documents. The anticipated completion date is June 30, 2013. 15. A procedure needs to be established to specify the fields that require input for each type of claim and/or litigation included within ivos and to ensure that any renamed fields are appropriately flowing accurate information into the report templates. Failure to properly customize ivos fields to be utilized by the City and/or failure to ensure that the information entered into the renamed fields properly flows through to the report increases the risk of inaccurate data and/or reports. It is recommended that the City Attorney s Office and Risk Management identify each of the required data fields, hide any unnecessary data fields, determine the necessary customizations, and ensure that any renamed fields properly flow through to the ivos reports. The City Attorney's Office and Risk recommendation and will work together to ensure that the information entered into the renamed fields is properly flowing through to the ivos reports. The anticipated completion date for identified customization is March 31, 2013. August 29, 2012 14
City Procured Insurance 16. Observations noted in property risk assessment reports issued by underwriters to the City of Glendale are not currently tracked and followedup on in a consistent manner. Failure to properly track the status of observations made by the underwriters in their written reports may increase the City's liability and may result in higher premiums to the City for identified risks. It is recommended that a spreadsheet of all underwriter property risk assessments be maintained and that the resolution for each item be documented. Additionally, it is recommended that follow-up be performed on a quarterly basis. Risk Management agrees with the recommendation and has implemented a procedure that utilizes the Asset Tab in ivos to track each of these assessments/compliance audits. We will utilize the standard ivos functionality to track findings, issue follow up correspondence and to clear each of these audits. This procedure is anticipated to be implemented by September 30, 2012. August 29, 2012 15