Memrandum CITY OF DALLAS DATE: August 7, 2018 TO: SUBJECT: Hnrable Mayr and Members f the City Cuncil Office f the City Auditr Audit, Attestatin and Investigative Services Update: Fiscal Year 2018 Furth Quarter The Audit, Attestatin and Investigative Services Update: Fiscal Year 2018 Furth Quarter (Update) is presented t prvide current infrmatin abut the results and status f audit, attestatin, and investigative service prjects f the City f Dallas (City) Office f the City Auditr. Three audit reprts were issued in the third quarter f Fiscal Year (FY) 2018, including: Cntinuity f Operatins Audit Fllw-Up Multiple Departments Recrds Management System Dallas Plice Department Fiscal Year 2018 Audit Fllw-Up f Prir Audit Recmmendatins Multiple Departments The key pints frm these reprts are included in Sectin II f the Update. The prject bjectives fr reprts scheduled t be released, and fr prjects currently in prgress r expected t be started in the furth quarter f FY 2018, are included in Sectins III thrugh V f the Update. In additin, Investigative Services pened 34 new cases during the third quarter resulting frm cmplaints received thrugh the Fraud, Waste and Abuse Htline. Examples f allegatins received include cnflicts f interest, discriminatin, theft f time and misuse f City services. Twenty-six cases were clsed during the perid resulting in five substantiated cmplaints related t emplyee relatins, emplyee pay and imprper ntificatin f a vehicle accident. The substantiated cmplaints led t accuntability actins including an emplyee resignatin as well as emplyee cunseling, training and an apprved salary adjustment. Apprved Audit Plans allw the City Auditr t make additins t, deletins frm, r ther changes t the plan(s) when deemed necessary upn written ntificatin t the City Cuncil. The Dallas Fire-Rescue (DFR) Occupatinal Safety and Health Prgram audit is hereby deleted frm the FY 2018 plan. This change is necessary given the Our Prduct is Service Empathy Ethics Excellence Equity
Hnrable Mayr and Members f the City Cuncil August 7, 2018 Page 2 f 2 recent rerganizatin within DFR impacting this prgram. The prject will be included in the FY 2019 prpsed audit plan presented t the City Cuncil. Mving this prject t next year s audit plan will allw time fr DFR t achieve a steady state f peratin befre the audit is cnducted. Shuld yu have questins r if we can be f assistance, please als cntact Carl A. Smith, First Assistant City Auditr at 214-670-4517 and by e-mail at carl.smith@dallascityhall.cm. Sincerely, Craig D. Kintn City Auditr fr Attachment C: T.C. Bradnax, City Manager Larry Cast, City Attrney Bilierae Jhnsn, City Secretary Our Prduct is Service Empathy Ethics Excellence Equity
City f Dallas Office f the City Auditr Audit, Attestatin, and Investigative Services Update Fiscal Year 2018 Furth Quarter
Table f Cntents Audit and Attestatin Services Fiscal Year 2018 Page Sectin I: Summary f Audit and Attestatin Services 1 Sectin II: Reprts Issued Third Quarter April 1 t June 30 4 Sectin III: Anticipated Reprt Releases Furth Quarter July 1 t September 30 10 Sectin IV: Prjects in Prgress Furth Quarter July 1 t September 30 12 Sectin V: Anticipated Prject Starts Furth Quarter July 1 t September 30 14
SECTION I Summary f Audit and Attestatin Services Audit Reprts that prvide bjective analysis t assist management and thse charged with gvernance and versight in using the infrmatin t imprve prgram perfrmance and peratins, reduce csts, facilitate decisin-making by parties with respnsibility t versee r initiate crrective actin, and cntribute t public accuntability Attestatin Reprts that cver a brad range f financial r nn-financial bjectives; results in an examinatin, a review, r an agreed-upn prcedures reprt n a subject matter r an assertin abut a subject matter that is the respnsibility f anther party Investigative Reprts prviding evaluatins and results f substantiated allegatins f fraud, waste and abuse Fiscal Year 2018 Reprts Issued Third Quarter April 1 t June 30 Nte: See Sectin II fr details Audit Services Cntinuity f Operatins Audit Fllw-Up Multiple Departments Recrds Management System Dallas Plice Department Fiscal Year 2018 Audit Fllw-Up f Prir Audit Recmmendatins Multiple Departments Attestatin Services N Attestatin Services reprts issued in the Third Quarter Investigative Services** N Investigative Services reprts issued in the Third Quarter All audit and attestatin services are cnducted under authrity f the City Charter, Chapter IX, Sectin 3, and in accrdance with the Annual Audit Plan apprved by the City Cuncil. We cnduct ur wrk in accrdance with generally accepted gvernment auditing standards. Thse standards require that we plan and perfrm ur wrk t btain sufficient and apprpriate evidence t prvide a reasnable basis fr ur findings and cnclusins based n ur bjective(s). Fraud investigatins are cnducted in accrdance with Quality Standards fr Inspectin and Evaluatin issued by the Cuncil f the Inspectrs General n Integrity and Efficiency. ** Nte: N Investigative reprts have been issued t date in Fiscal Year 2018. A brief update pertaining t the wrk cmpleted in the third quarter by Investigative Services is prvided in the memrandum. 1
Anticipated Reprt Releases Furth Quarter July 1 t September 30 Nte: See Sectin III fr details Audit Services Business Partner Oversight Park and Recreatin Miscellaneus Permit Fee Revenues Dallas Water Utilities Off-Duty Emplyment Administratin Dallas Plice Department Attestatin Services Agreed-Upn Prcedures fr Petitin Prcessing by the City Secretary s Office Prjects in Prgress Furth Quarter July 1 t September 30 Nte: See Sectin IV fr details Audit Services Dallas Cnventin & Visitrs Bureau (VisitDallas) Cnventin and Event Services Open Recrds Request Prcess City Secretary s Office Perfrmance Measurement Prcess Multiple Departments Surveillance Camera Oversight Multiple Departments Water Quality and Safety, Testing, and Mnitring Dallas Water Utilities Security and Safety Prtcls fr Large Public Venues Owned r Managed by the City Multiple Departments Franchise Fees Review thrugh Third-Party Vendr (Onging) Sales/Use Tax Cmpliance Review thrugh Third-Party Vendr (Onging) 2
Anticipated Prject Starts Furth Quarter July 1 t September 30 Nte: See Sectin V fr details Audit Services Dallas Plice Department s Cmplaint Prcess Ecnmic Develpment Prgrams and Incentives Office f Ecnmic Develpment Management f the City s Surplus Real Prperties Department f Sustainable Develpment and Cnstructin Revenue Estimates Office f Budget 3
SECTION II Reprts Issued Third Quarter April 1 t June 30 Audit Services Audit Fllw-Up f Prir Audit Recmmendatins - Audit f the Design f the City f Dallas' Pandemic Influenza Cntinuity f Operatins Basic Plan (June 15, 2018) Between Fiscal Year (FY) 2013 and FY 2017, the Office f Emergency Management (OEM), with the assistance f a cnsulting firm and certain department directrs, identified and priritized City f Dallas (City) missin essential functins and updated the City s Cntinuity f Operatins (COOP) Basic Plan and department specific annexes This updated infrmatin was used by the Department f Cmmunicatin and Infrmatin Services (CIS) t develp a framewrk fr a cmprehensive Disaster Recvery Plan (DRP) Althugh annual updates are required, in FY 2017 mst f the departments annexes were nt updated Despite measurable prgress by OEM and CIS, the fllwing three recmmendatins which were included in the riginal audit, Audit f the Design f the City f Dallas Pandemic Influenza Cntinuity f Operatins Basic Plan, Reprt N. A13-009, September 13, 2013, were nt fully implemented: The City Manager and/r designated cntinuity persnnel develp and implement the ten Cntinuity Management Functins f the COOP Plan The City Manager and/r designated cntinuity persnnel prvide peridic updates t the City Cuncil n the prject t ensure transparency The City Manager and the Directr f CIS develp a DRP using the infrmatin frm the ten Cntinuity Management Functins f the COOP Plan Full recmmendatin implementatin required City management t: Address 50 critical characteristics identified in the riginal audit as missing cmpnents frm the ten Cntinuity Management Functins Cmmunicate with City Cuncil Develp a cmprehensive DRP 4
Audit Recmmendatin We recmmend the City Manager in crdinatin with the Directrs f OEM and CIS: Respnsible Department Agreement Status Implementatin Date Develp an administrative directive that establishes the City s plicy regarding business cntinuity planning and the COOP Basic Plan at bth a citywide and departmental level Establish an rganizatinal structure that clearly defines rles, respnsibilities, and accuntability related t business cntinuity planning and the COOP Basic Plan Dedicate cntinuity f peratins persnnel with the apprpriate authrity and resurces Obtain departmental cmmitment t ensure: (1) the City s COOP Basic Plan and the departments annexes are cmplete, including adequate infrmatin technlgy (IT) resurces and ther supplies necessary t restre and maintain essential functins fr 30 days; (2) regularly updated (at least annually); and, (3) prperly tested OEM Agree Octber 1, 2019 Develp r btain IT systems t dcument the departments annexes and mnitr annual updates Reach a cnsensus amng departments regarding which IT systems must be restred 5
Audit Recmmendatin We recmmend the City Manager in crdinatin with the Directr f CIS: Respnsible Department Agreement Status Implementatin Date Octber 1, 2018 1 Develp a cmprehensive DRP by establishing a frmal plan that includes measurable milestnes t demnstrate prgress CIS Agree December 31, 2018 2 Onging 3 Audit Recmmendatin We recmmend the City Manager peridically briefs the City Cuncil n the City s business cntinuity Nte: Per management s respnse, OEM and CIS will prvide peridic updates t City Cuncil Respnsible Department Agreement Status Implementatin Date City Manager Agree Onging 4 Audit f the Dallas Plice Department s Recrds Management System (June 22, 2018) Fr the audit perid, (June 1, 2014 thrugh June 30, 2017), the Dallas Plice Department (DPD) had adequate internal cntrls t ensure that all crime related data were prcessed efficiently and effectively. The DPD reprted cmplete, crrectly classified, and accurate cunts f serius crime incidents and arrests t the Texas Department f Public Safety (TX DPS). As a result, the citizens f Dallas, the TX DPS, and the United States Federal Bureau f Investigatin (FBI) can rely n the crime statistics reprted by DPD. The DPD s internal cntrls related t the Recrds Management System (RMS), hwever, are nt sufficient t: Prevent and detect unauthrized deletins r alteratins f RMS data Ensure nly users wh need access t RMS t perfrm their jb respnsibilities have access 1 Refine Requirements 2 Update frmal plan 3 Demnstrate prgress prvide annual updates t Internal Audit 4 Upn cmpletin f each milestne 6
Audit Recmmendatin We recmmend the Chief f Plice: Respnsible Department Agreement Status Implementatin Date Implements frmal plicies and prcedures t ensure: Any legitimate alteratin and expungement f data frm RMS is frmally requested, authrized, and dcumented by DPD management DPD Agree Nvember 30, 2018 Crime data audit lgs are preserved, and regularly reviewed fr indicatins f inapprpriate r unusual activity Develps a matrix f user access privileges in RMS that wuld ensure segregatin f incmpatible duties and the assignment f least privileges t each user that are essential t perfrm the user s assigned duties Uses the matrix f user access privileges in RMS t reassign user access based n the principles f segregatin f incmpatible duties and the assignment f least privileges t each user that are essential t perfrm the user s intended duties Implements frmal plicies and prcedures t perfrm an annual cmparisn f user access privileges in RMS t the matrix f user access privileges Deactivates RMS user accunts f users wh are n lnger emplyed by the City DPD Agree Nvember 30, 2018 DPD Agree Nvember 30, 2018 DPD Agree Nvember 30, 2018 DPD Agree Nvember 30, 2018 7
(cntinued ) Audit Recmmendatin Respnsible Department Agreement Status Implementatin Date Ensures DPD cmplies with the City s Enterprise Infrmatin Security Standard (EISS), specifically: Assigns a unique persnal user accunt t every RMS user Limits temprary access t an elevated privilege, such as an administratr, t seven days Disables and lcks RMS users accunts when the individual has nt accessed RMS fr any cnsecutive 90-day perid DPD Agree Nvember 30, 2018 Deactivates/disables vendr accunts if the accunts have nt been used in any cnsecutive 90-day perid Revkes user access t RMS immediately upn terminatin f emplyment Lgs the activities f all elevated accunts and reviews the lgs regularly t ensure that inapprpriate activities are identified early and reslved Audit Recmmendatin We recmmend the Directr f CIS: Respnsible Department Agreement Status Implementatin Date Octber 31, 2018 5 Perfrms security reviews and security assessments f RMS in accrdance with the EISS CIS Agree December 31, 2018 6 January 1 2019 December 31, 2020 7 Fiscal Year 2018 Audit Fllw-Up f Prir Audit Recmmendatins (June 22, 2018) The Fiscal Year 2018 Audit Fllw-Up f Prir Audit Recmmendatins cvered 43 recmmendatins that were included in five audit reprts issued in Fiscal Year (FY) 2016 and FY 2017. The Office f the City Auditr s verificatin results shwed City management implemented 19 f the 43 recmmendatins, r 44 percent. 5 Develp requirements 6 Refine schedule 7 Demnstratin f sustainability 8
While City management made cncerted effrts, recmmendatins were nt cnsidered fully implemented if the underlying risks identified in the prir audits were nt sufficiently mitigated. The Office f the City Auditr identified pprtunities t imprve the fllwing: Plicies and prcedures necessary t establish an internal cntrl framewrk Mnitring f the timeliness, effectiveness, and cnsistency f the established internal cntrls Prper and cnsistent dcumentatin f transactins, internal cntrls, and rganizatinal events Apprpriate design and implementatin f infrmatin systems N recmmendatins assciated with this reprt. Attestatin Services N Attestatin Services reprts issued in the Third Quarter. Investigative Services N Investigative Services reprts issued in the Third Quarter. 9
SECTION III Anticipated Reprt Releases Furth Quarter July 1 t September 30 Audit Services Business Partner Oversight Park and Recreatin Anticipated Reprt Date: August 2018 Prject Objective(s): Evaluate the financial, peratinal, and ther risks fr majr business partners perating City wned facilities under the versight f the Department f Park and Recreatin and the City's versight and mnitring cntrls (may include the Dallas Z, the Dallas Arbretum, and/r Bahama Beach; will exclude Fair Park facilities which were audited in Fiscal Year 2016) Miscellaneus Permit Fee Revenues Dallas Water Utilities Anticipated Reprt Date: August 2018 Prject Objective(s): T determine whether cntrls are adequate/effective t ensure permit fee revenues are cllected frm business entities required t btain a permit t perate a business in the City Off-Duty Emplyment Administratin Dallas Plice Department Anticipated Reprt Date: August 2018 Prject Objective(s): T evaluate (1) the Dallas Plice Department s (DPD) internal cntrls ver ff-duty emplyment; and, (2) whether DPD fficers adhere t DPD plicies related t ff-duty emplyment 10
Attestatin Services Agreed-Upn Prcedures fr Petitin Prcessing by the City Secretary s Office Anticipated Reprt Date: July 2018 Prject Objective(s): Assist the City Cuncil in evaluating the City Secretary s Office s cmpliance with the Texas Electin Cde, the Texas Lcal Gvernment Cde, and the Charter f the City f Dallas, Texas as specified in City Secretary's Office Prcedures Prcess fr Checking Petitin(s) fr an Initiative, Referendum, Lcal Optin, Charter Amendment, Cuncil Recall 11
SECTION IV Prjects in Prgress Furth Quarter July 1 t September 30 Audit Services Dallas Cnventin & Visitrs Bureau (VisitDallas) Cnventin and Event Services Anticipated Reprt Date: First Quarter Fiscal Year 2019 Prject Objective(s): T evaluate the effectiveness f services prvided by the Dallas Cnventin and Visitrs Bureau (VisitDallas), which may include: (1) assessing the reliability and reprting f perfrmance measures; and, (2) determining whether Turism Public Imprvement District Incentive funds were used prperly Open Recrds Request Prcess City Secretary s Office Anticipated Reprt Date: First Quarter Fiscal Year 2019 Prject Objective(s): T evaluate the effectiveness f the City Secretary s Office cmpliance with State law and whether there are cst-saving pprtunities Perfrmance Measurement Prcess Multiple Departments Anticipated Reprt Date: First Quarter Fiscal Year 2019 Prject Objective(s): T cnduct an audit f the perfrmance measures included in the City s 365 website t evaluate whether perfrmance data are meaningful, accurate, supprtable, reliable and valid Surveillance Camera Oversight Multiple Departments Anticipated Reprt Date: First Quarter Fiscal Year 2019 Prject Objective(s): T determine whether the City adequately/effectively manages and maintains its netwrk f surveillance cameras 12
Water Quality and Safety, Testing, and Mnitring Dallas Water Utilities Anticipated Reprt Date: First Quarter Fiscal Year 2019 Prject Objective(s): T determine whether the Department f Dallas Water Utilities has: (1) adequate plicies and prcedures in place fr nging accuracy testing and mnitring f City water quality and safety; and, (2) effective means f cmmunicating with City residents regular testing and mnitring results Security and Safety Prtcls fr Large Public Venues Owned r Managed by the City Multiple Departments Anticipated Reprt Date: Secnd Quarter Fiscal Year 2019 Prject Objective(s): T evaluate the adequacy f the security and safety prtcls in place fr large public venues wned r managed by the City Franchise Fees Review thrugh Third-Party Vendr (Onging) Anticipated Reprt Date: Peridic, as warranted Prject Objective(s): T verify that franchise fees (which may include utilities, cable, and telephne) identified by a third-party vendr are received by the City Sales/Use Tax Cmpliance Review thrugh Third-Party Vendr (Onging) Anticipated Reprt Date: Peridic, as warranted Prject Objective(s): T identify and cllect new and misreprted tax revenue identified thrugh a third-party vendr which will cnduct Sales and Use Tax Cmpliance Review and Recvery Services 13
SECTION V Anticipated Prject Starts Furth Quarter July 1 t September 30 Audit Services Dallas Plice Department s Cmplaint Prcess Prject Objective(s): T determine if: (1) the Dallas Plice Department s cmplaint prcess is accessible; (2) internal and external cmplaints are prcessed cnsistently; and, (3) apprpriate and cnsistent crrective actins are taken Ecnmic Develpment Prgrams and Incentives Office f Ecnmic Develpment Prject Objective(s): T evaluate whether selected ecnmic develpment prgrams are prducing expected results and whether mnitring cntrls are effective Management f the City s Surplus Real Prperties Department f Sustainable Develpment and Cnstructin Prject Objective(s): T evaluate the City s prcesses fr identifying, managing, and dispsing r surplus real prperty Revenue Estimates Office f Budget Prject Objective(s): T determine whether the City has effective prcesses t ensure reasnable revenue estimates are included in the Manager s prpsed perating budget. 14