Internal Audit Report Revenue Accounting TxDOT Office of Internal Audit

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

Objective To evaluate revenue accounting activities including the tracking, depositing, and reconciliation of department revenue.

Opinion Based on the audit scope areas reviewed, control mechanisms are effective and substantially address risk factors and exposures considered significant relative to impacting reporting reliability, operational execution, and compliance. The organization's system of internal controls provides reasonable assurance that key goals and objectives will be achieved despite control gap corrections and improvement opportunities identified. Control gap corrections and improvement opportunities identified have the potential to negatively impact the achievement of the organization's business/control objectives. Overall Engagement Assessment

Satisfactory

Findings Title

Finding 1

Adherence to Revenue Accounting Policies

Control Design

Operating Effectiveness

Rating

x

x

Needs Improvement

Management concurs with the above finding and prepared management action plans to address deficiencies.

Control Environment Finance Division (FIN) develops Revenue Accounting policies to be followed by District/Division/Office (DDO) personnel accepting and handling revenue generating receipts, such as checks, warrants, wires, cash and payments by credit card. FIN also provides communication regarding updates and changes in policies as well as periodic communication about scheduling for fiscal year-end activities. The DDOs are responsible for practices and procedures that adhere to the policies established by FIN and to ensure funds received are protected, reported, and properly deposited. There are over 200 revenue loggers statewide who use the Revenue Logging System (RLS) to capture and report receipts. The control structure is dispersed across 25 districts and 16 divisions and offices, who have assigned loggers. Statewide processes are primarily manual.

August 22, 2014

2

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

Summary Results Finding

Scope Area

Evidence

6 Districts and Divisions (DDs) tested demonstrated practices or procedures that were not consistent with those designed by FIN and evidence could not be provided for the approval of the variance.

1

Revenue: Handling

Through testing of 36 revenue items (e.g., check receipts) totaling $993,174 at 12 DDs, it was determined that:  35 of 36 (97%) items received totaling $973,174 did not show evidence of a required process for 2 people to open the mail where there is an expectation of a receipt of funds  In testing these 36 items for proper security measures based on policy, the following was noted: o 19 items were noted to be deposited the same day and required no security measures o 17 items totaling $513,074 were secured overnight but did not comply with policy regarding a list to identify those documents held in the secured location Through testing of processes at 12 DDs, it was determined that:  5 of 12 (42%) DDs did not adequately separate the duties of the logger and depositor or had no evidence these duties were performed separately  4 of 12 (33%) DDs had no evidence that a monthly reconciliation (or equivalent procedure) was performed comparing activity from the RLS to the general ledger 

Audit Scope The audit focused on the process of handling, recording, and verification of revenues through check/wire receipts that came in through the DDOs, and capturing them into RLS for the first two quarters of Fiscal Year (FY) 2014. The audit was performed by Jaime Resendez, Omar Elsaad, Bill Urbina, and Sonya Ayers (Engagement Lead). The audit was conducted during the period from June 11, 2014 to August 11, 2014.

Methodology The methodology used to complete the objectives of this audit included:  Reviewing applicable federal and state laws and regulations

August 22, 2014

3

Revenue Accounting    

TxDOT Office of Internal Audit – Full Scope

Reviewing accounting manuals, organization charts, and the most recent Annual Financial Report for FY2013, including relevant revenue footnotes and disclosures Interviewing key personnel, including Finance (FIN) personnel in Revenue Accounting and various District, Division, and Office personnel with roles in handling, recording, and verification of revenue Reviewing prior audit reports for applicable findings, including the State Auditor’s Office and the Office of Internal Audit Reviewing current reporting from the Revenue Logging System

These procedures were applied as necessary to perform the audit fieldwork. Transactions received at the DDOs consisted of 5,095 items received in the first two quarters of FY2014. These receipts represented $77 million collected statewide as indicated in the table below:

Type Metro Urban Urban Rural Rural

Receipts at DDO $$ 1,960,465 1,171,784 477,383 1,121,173 189,481

Check Count 751 75 122 29 98

ROW TRV SSD AVN TRF FIN-W FIN

1,435,401 1,105,011 464,376 434,057 106,273 1,003,951 15,463,231

19 387 31 25 723 492 651

1.9% 1.4% 0.6% 0.6% 0.1% 1.3% 20.2%

0.4% 7.6% 0.6% 0.5% 14.2% 9.6% 12.8%

Part of Test

24,932,586

3,403

32.5%

66.8%

Other DDOs Total Receipts at DDO

51,690,239 76,622,825

1,692 5,095

67.5% 100.0%

33.2% 100.0%

Districts San Antonio Waco Bryan Amarillo Brownwood Divisions Right of Way Travel Support Services Aviation Traffic FIN-West Finance Division

% Total % Total $$ Count 2.6% 14.7% 1.5% 1.5% 0.6% 2.4% 1.5% 0.6% 0.2% 1.9%

* source Revenue Logging System Q1 & Q2 FY14

Testing included selecting 36 checks and 4 wires at the Districts and Divisions listed above and examining the transactions for adherence to policies for revenue handling and accurate recording of items (including wires) into the general ledger, as well as, the verification of activity at the bank to activity in the general ledger. Process observations were performed through site visits to Districts including San Antonio, Waco, and Bryan and divisions including Aviation, Travel Information, Traffic Operations, Right of Way, Support Services (formerly General Services Division), and Finance. Transactions in the Amarillo and Brownwood Districts, plus transactions received by FIN on behalf of the Districts and Divisions were also reviewed.

August 22, 2014

4

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

Background This report is prepared for the Texas Transportation Commission, TxDOT Administration, and Management. The report presents the results of the Revenue Accounting Audit which was conducted as part of the FY2014 Audit Plan. The Revenue Accounting team is part of the Finance Division (FIN) and oversees the handling, recording, and verification of TxDOT’s revenue. In FY2013, $257 million was collected through receipts presented at the various Districts, Divisions, and Offices (DDOs). This was made up of 9,678 transactions of differing amounts and sources occurring across the state with approximately 86% of the amount taking place in the Districts and received by check or warrant. The majority of receipts at the DDOs are presented via mail or by payers delivering documents which include a payment in the form of a check or warrant. Deposits are to be made by the DDO within 3 business days into a concentration account at a local bank held by the Texas Comptroller of Public Accounts (CPA). The transactions are reported to FIN using Revenue Logging System (RLS). At FIN, processors and reconcilers ensure that receipts are properly recorded at the bank and into the general ledger for financial reporting purposes. We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards and in conformance with the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Recommendations to mitigate risks identified were provided to management during the engagement to assist in the formulation of the management action plans included in this report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Office of Internal Audit transitioned to Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework version 2013 in December 2013. A defined set of control objectives was utilized to focus on reporting, operational, and compliance goals for the identified scope areas. Our audit opinion is an assessment of the health of the overall control environment based on (1) the effectiveness of the enterprise risk management activities throughout the audit period and (2) the degree to which the defined control objectives were being met. Our audit opinion is not a guarantee against reporting misstatement and reliability, operational sub-optimization, or non-compliance particularly in areas not included in the scope of this audit.

Best Practices The Right of Way Division and the Fort Worth District have adopted procedures showing adherence to TxDOT’s revenue accounting policies as follows:  Written desk procedures  Use of date stamp on receipt stub clearly showing date item was received  Dual control for mail handling including initials of all personnel performing duties

August 22, 2014

5

Revenue Accounting  

TxDOT Office of Internal Audit – Full Scope

Descriptive logs showing the date and the source of a check received, a check number and amount, the date the check is placed in the safe under dual control, and the date and initials of personnel when the check is removed Primary mail handlers, loggers, and depositors are named and specific personnel are identified as back-up for these tasks showing evidence of adequate segregation of duties

August 22, 2014

6

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

Detailed Findings and Management Action Plans (MAP) Finding No. 1: Adherence to Revenue Accounting Policies Condition The Finance Division (FIN) has no active monitoring process to verify that policies for revenue handling are implemented and followed. The Districts and Divisions (DDs) tested are not consistent in administering or do not retain documentation showing adherence to revenue handling and verification policies such as:  Dual control for mail handling  Safeguarding financial instruments, such as checks or warrants held overnight  Separating the duties of personnel assigned responsibility for logging receipts (loggers) from depositors  Monthly comparison of the Revenue Logging System (RLS) and the general ledger Effect/Potential Impact Adherence to revenue accounting policies is necessary to ensure:  Errors can be prevented or detected timely  No accidental or intentional losses occur  Financial data is reliable Criteria FIN’s current Revenue Accounting Manual includes directions for the following:  Dual control (two or more employees) for opening mail and logging any funds  Safekeeping of funds in a secure location, such as a safe, and securing items held overnight along with a log listing each item, dollar amount, and total  Establishment of logs for each safe, containing a record for each person given the combination, dates of any changes to the list, and the reason for the change  Separation of duties between employees who receive and record funds, make deposits, and reconcile deposit reports to receipt logs  Monthly reconciliations of logs and deposit records Cause DDs have a small staff assigned to mail handling and logging duties. DDs have not adopted practices or procedures in support of the policies and FIN has not monitored that policies have been implemented by the DDs. Evidence 6 Districts and Divisions (DDs) tested demonstrated practices or procedures that were not consistent with those designed by FIN and evidence could not be provided for the approval of the variance. Through testing of 36 revenue items (i.e., check receipts) totaling $993,174 at 12 DDs, it was determined that:

August 22, 2014

7

Revenue Accounting  

TxDOT Office of Internal Audit – Full Scope

35 of 36 (97%) items received totaling $973,174 did not show evidence of a required process for 2 people to open the mail where there is an expectation of a receipt of funds In testing these 36 items for proper security measures based on policy, the following was noted: o 19 items were noted to be deposited the same day and required no security measures be taken o 17 items totaling $513,074 were secured overnight but did not comply with policy regarding a list to identify those documents held in the secured location

Through testing of processes at 12 DDs, it was determined that:  5 of 12 (42%) DDs did not adequately separate the duties of the logger and depositor or had no evidence these duties were performed separately  4 of 12 (33%) DDs had no evidence that a monthly reconciliation (or equivalent procedure) was performed comparing activity from the RLS to the general ledger Management Action Plan (MAP): MAP Owner: Casey Rowe, Revenue Accounting Manager, Finance Division MAP 1.1: The Finance Division (FIN) has reviewed the related findings, and we agree that FIN will provide a required annual course covering Revenue Accounting Policies to all Division, District, and Office personnel who handle revenue. FIN is currently working with HR to develop the revenue handling course and expect to have it completed for Fiscal Year 2015 Completion Date: April 15, 2015 MAP Owner: Casey Rowe, Revenue Accounting Manager, Finance Division MAP 1.2: The Finance Division (FIN) agrees to strengthen controls over mail handling and items held in the vault by having both mail handlers sign the payment transfer signature log created in the Revenue Logging System (RLS). FIN will also create a vault log to be signed by two people for items going into and out of the vault Completion Date: October 15, 2014

August 22, 2014

8

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

MAP Owners: Don Ekval, Minor Equipment Services Supervisor, Support Service Division Debbie Follien, Travel Publications Section Business Manager, Travel Information Division MAP 1.3: The Travel and Support Services Division agree to strengthen their division’s controls over revenue handling including:  Updating desktop procedures as determined beneficial  Requiring dual control (2 persons) to open mail  Requiring logging into Revenue Logging System (RLS) and signing/dating the printed FIN log posting by the logger and the mail handler(s)  Requiring the non-logging mail handler to carry the revenue item to the closest Finance Division (FIN) drop box unless items are held overnight  Printing, signing, placing, and retaining RLS reports for any financial items held overnight to show evidence of a listing of items in a secured cabinet  Other practices, such as modification of correspondence to notify that payments should be sent to the TxDOT P.O. Box  Monthly reconciliation of the RLS to the general ledger Completion Date: October 15, 2014 MAP Owners: Elizabeth Hogeda-Romo, Business Services Coordinator, San Antonio District Cassidy Bruce, Business Services Coordinator, Waco District Susan Neumann, Business Services Coordinator, Bryan District MAP 1.4: The Districts including, San Antonio (SAT), Waco (WAC) and Bryan (BRY) concur with the recommendations to provide annual reviews, improve documentation, and to engage the Finance Division (FIN) when considering the adoption of operational procedures. The districts have taken immediate steps to address and cover deficiencies noted in the audit findings including:  Mail operations will be handled with dual control  Separation of duties for personnel assigned to log receipts against depositors  Implementation of a paper log system showing evidence of dual control and separation of duties  Monthly reconciliation to the Revenue Logging System to the general ledger  Use of a vault log to enhanced vault controls and ensure that financial instruments held overnight are secured  Development of desk-top procedures to provide users with written policies and procedures including but not limited to the Finance Division, Revenue Accounting Manual, Chapters 1-4.  Periodical reviews/briefings with staff on policy changes and other pertinent updates Completion Date: October 15, 2014

August 22, 2014

9

Revenue Accounting

TxDOT Office of Internal Audit – Full Scope

Summary Results Based on Enterprise Risk Management Framework

Closing Comments The results of this audit were discussed with Finance Division and District representatives on August 13, 2014. We appreciate the assistance and cooperation received from the Finance Division and other Divisions and Districts contacted during this audit.

August 22, 2014

10