Internal Audit Follow-Up Report Accounts Payable TxDOT Internal Audit Division

Accounts Payable

TxDOT Internal Audit Division – MAP Follow-Up

Objective Assess the status of corrective actions for high risk Management Action Plans (MAPs) previously communicated in the Accounts Payable audit report issued March 11, 2013 and the MAP Follow-Up engagement issued August 22, 2013.

Summary Results Testing included an evaluation of 2 MAPs to determine if corrective actions were implemented as agreed. MAP Status 2 Closed

Comments Corrective actions have been completed.

Scope The engagement fieldwork was conducted with the Financial Management Division (formerly Finance Division) - Payments Management Section and included payments made in October and November 2015. In addition, auditors reviewed Fiscal Year (FY) 2015 Sample Audit Key Controls along with voucher sampling from October and November 2015. The engagement was performed by Albert T. Bourque, Tim Owen, and Jill Emery (Engagement Lead). The engagement was conducted during the period from December 9, 2015 to January 29, 2016.

Methodology The methodology used to complete the objectives of this engagement includes: • Reviewed the Finance Audit Plan that covered FY15 to determine the roles and responsibilities of the Quality Assurance (QA) section • Obtained a QA checklist used in the voucher review process to determine which areas were reviewed • Selected a sample of 10 vouchers from October and November 2015 that were reviewed by the QA section to determine if the QA results were accurate • Reviewed audit work and results from the Post Implementation Review PeopleSoft – Accounts Payable audit conducted in the first quarter of FY16 by Internal Audit to determine if the testing conducted for duplicate payments sufficiently addressed the risk identified in the original Accounts Payable audit in 2013

Background This report is prepared for the Texas Transportation Commission and for the Administration and Management of TxDOT. The report presents the results of the Accounts Payable MAP Follow-Up engagement which was conducted as part of the Fiscal Year 2016 Audit Plan. The Financial Management Division (formerly Finance Division) - Payments Management Section is responsible for payment of all department obligations to contractors, vendors, and employees. The Accounts Payable audit and Management Action Plan Follow-Up engagement from 2013 were conducted when all invoices were batched into vouchers in TxDOT’s Financial Information Management System (FIMS), which was used to record obligations and payments to individuals or entities. FIMS was retired in 2014 and replaced

August 2016

2

Accounts Payable TxDOT Internal Audit Division – MAP Follow-Up by Oracle® PeopleSoft. Although PeopleSoft replaced FIMS, the need to identify duplicate payments and monitoring of payment still remained. We conducted this follow-up engagement in accordance with Generally Accepted Government Auditing Standards and in conformance with the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the engagement to obtain sufficient, appropriate evidence to provide a reasonable basis for our conclusions based on our engagement objective. Recommendations to mitigate risks identified were previously provided to management during the original engagement to assist in the formulation of the management action plans referenced in this report. The Internal Audit Division uses the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework version 2013.

August 2016

3

Accounts Payable

TxDOT Internal Audit Division – MAP Follow-Up

Detailed MAP Follow-Up Status MAP Status: Closed Corrective actions have been completed. Original Audit Finding Number 2: Utilization of the Sample Audit Key Control MAP Owners: Lanny Wadle, Director, Financial Management Division Paul Campbell, Payments Management Section Director, Financial Management Division MAP 2.1 – The control activity was suspended during a period of employee turnover due to retirement and constrained resources, approximately August 31, 2011. A new employee was hired in October 2012 and is assigned the primary task of performing a Quality Control review of randomly selected vouchers submitted for payment. The employee will retain the list of vouchers that are randomly selected for review and incorporate the information into a spreadsheet. This employee will contact the applicable voucher processors with questions, suggestions, or for any other purpose arising from their review. Documentation of notable findings or necessary changes are recorded on an excel spreadsheet and saved on the network drive with password protection. Management will review quarterly for performance management, training and improvement purposes. Future staffing plans include hiring a second employee to this renamed Quality Control unit to increase the value of our review effort even further. We will also re-evaluate key controls in this area to reflect best practices as considered appropriate by management within its tolerable level of risk. Original Completion Date: April 15, 2013 Revised Completion Date: November 15, 2013 Original Audit Finding Number 4: Duplicate Payments MAP Owners: Lanny Wadle, Director, Financial Management Division Paul Campbell, Payments Management Section Director, Financial Management Division MAP 4.1 – We will train voucher processors on documenting steps to follow when a system warning is observed and on resubmittal process and practices. We will coordinate with General Services Division (GSD) for effective communication to 3rd parties and management of 3rd party performance under agreements, particularly, when duplicate payments are routine and display a consistent pattern of occurrence. We will develop procedures to document in the voucher deck any time systems controls are disregarded including the reason the system warning is disregarded and the supervisor’s approval of the adequate explanation provided by the voucher processor for the decision to disregard. We will develop written procedures to document the review process of the report for “potential duplicate payments” including definition of the process, procedures to research and document final disposition for items on report. Further, we will establish accountability

August 2016

4

Accounts Payable TxDOT Internal Audit Division – MAP Follow-Up for reporting and collections, to include TxDOT’s debt collection procedures and timing as necessary, if items are determined to be a duplicate. We will establish a process to perform root cause analysis for items that are determined to be a duplicate payment. We will re-evaluate key controls in this area to reflect best practices as considered appropriate by management within its tolerable level of risk and adjust documentation and processes accordingly. Original Completion Date: April 15, 2013 Revised Completion Date: November 15, 2013

Closing Comments The results of this MAP Follow-Up engagement were discussed with the Deputy Director, Financial Management Division (now Director, Financial Management Division), and Payments Management Section Director of Financial Management Division on March 14, 2016. The Internal Audit team appreciates the cooperation and assistance received from the Financial Management Division during this engagement.

August 2016

5