Enterprise Florida Internal Audit by McGladrey - March 15, 2012

8/12/2019 Enterprise Florida Internal Audit by McGladrey - March 15, 2012

1/28


2/28

Table of Contents

Transmittal Letter .................................................................................................................. 1

Executive Summary ......................................................................................................... 2 - 3

Background ...................................................................................................................... 4 - 6

Objectives and Approach ................................................................................................. 7 - 8

Observations and Recommendations ............................................................................ 9 - 15

Appendix:Process Maps


3/28

March 15, 2012

The Audit Committee of the Board of DirectorsEnterprise Florida, Inc.800 N. Magnolia Ave., Suite 1100

Orlando, FL 32803

Pursuant to the approved 2011/2012 internal audit plan, we hereby submit our internal audit report ofpurchases, payables and cash disbursements. We will present this report at the next regularly scheduled

Audit Committee meeting on April 10, 2012.

Our report is organized in the following sections:

Executive Summary - This provides a summary of the issues related to our review of thepurchases, payables and cash disbursements process.

Background - This provides an overview of the purchases, payables and cash disbursementsfunctions.

Objectives and Approach - The internal audit objectives and focus are expanded upon in thissection as well as a review of the various phases of our approach.

Observations and Recommendations - This section gives a description of the observations andrecommended actions.

Appendix This section includes the following documentation, as validated by management:

o Process maps depicting the flow of in-scope processes.

As described in our objectives and procedures outlined on pages 7 and 8 of this report, the findings andconclusions are based on our analysis of the processes, documents, records and information provided tous by management. If our scope were to have been expanded, including performance of additionalprocedures and/or sample sizes in the time period under review, it may have resulted in additionalfindings.

We would like to thank EFI and all those involved in assisting us in connection with the review of thepurchases, payables and cash disbursements processes.

Respectfully Submitted,

McGladrey & Pullen, LLP

McGladrey & Pullen, LLP

7351 Office Park PlaceMelbourne, Florida 32940-8229O 321-751-6200 F 321-751-1385www.mcgladrey.com


4/28

Executive Summary


5/28

Purchases, Payables and Cash Disbursements Enterprise Florida, Inc.

EXECUTIVE SUMMARY

The Risk Assessment initially prepared for Enterprise Florida, Inc. included Purchases, Payables and

Cash Disbursements as a high risk process due to the nature of the risks involved and the volume/dollaramount of transactions associated with the processes. Each internal audit that has been performed to-date has included relative controls and testing around purchases, payables for the in-scope processesincluded with that report, including Follow Up (issued June, 2008), Contract/Grant Compliance (issuedJune, 2008), International Offices Review (issued October, 2007), and the SAS 112 Readiness ControlDesign Analysis (issued September, 2007). This report expanded the scope of those previous audits toencompass all types of disbursements made by the company. Where practical, we have relied upon thedesign and effectiveness analyses performed during those audits for the purposes of this report.

We reviewed the design adequacy and operating effectiveness, including detailed testing of transactions,of the internal control structure in place over the purchases, payables and cash disbursementsprocesses. Where included in our random sample selections, we performed limited testing of payrolldisbursements and contract approval documentation. During the course of our work, we discussed thecontrol design and operating deficiencies with management. Our observations and recommendations forimproving controls are described in detail in this report, along with managements response.

We have assigned relative risk factors to each issue identified. This is the evaluation of the severity ofthe concern and the potential impact on the operations. Items rated as High are considered to be ofimmediate concern and could cause significant operational issues if not addressed in a timely manner.

Items rated as Moderate may also cause operational issues and do not require immediate attention, butshould be addressed as soon as possible. Items rated as Low could escalate into operational issues,but can be addressed through the normal course of conducting business. There are many areas of risk toconsider including financial, operational, and/or compliance as well as public perception or brand riskwhen determining the relative risk rating.

A summary of observations is provided below.

Observation SummaryRelative

Risk1. Segregation of Duties

Two employees of the Finance and Accounting team have conflicting duties over cashmanagement, purchasing and accounts payable. The company has attempted over thelast two fiscal years to reduce the impact of these conflicts. We noted compensatingcontrols in place to monitor activities under conflicting duties, including review of thefinancial statements and check registers by senior leadership.

High

2. Conflict of Interest and Related-Party Conf irmation

There is no monitoring control that requires employees to certify on a periodic (i.e.,

annual) basis that no related-party or other conflicts of interest exist. We also noted thatthe company did not have copies or complete information about whether the Boardmembers had filed the State required Full and Public Disclosure of Financial Interestsinformation with the Florida Commission on Ethics, in order to evaluate any knownrelated party interests. Due to the nature of the entitys Board as a publicly-appointedbody and the nature of Enterprise Floridas business, we expected to, and did noteknown relationships with Board members reflected in the entitys vendor listing.

Moderate


6/28

Purchases, Payables and Cash Disbursements Enterprise Florida, Inc.

EXECUTIVE SUMMARY -CONTINUED

Observation SummaryRelative

Risk4. Master Vendor Listing

We noted there is no formal, periodic review of the vendor master listing for items suchas duplicate or inactive vendors, comparison to employee addresses for unusualactivity, or a cross-check for related parties with employee names/known relationshipsor Board members. As such, we identified duplicate and idle vendors in the activevendor listing.

Moderate

5. Employee Federal Income Tax Withho lding Errors

Federal income tax withholdings for 2 of 10 employees selected for testing were

improperly calculated in the payroll system because the rate of withholding did notmatch the employees Form W-4 Employees Withholding Allowance Certificate on file.Moderate

6. Contract Review Procedures

Contract review procedures for 4 of 10 contracts tested were not completely followedand included exceptions to policy related to the date of approval (3 of 4) and therequired conflict of interest certifications by the reviewers (1 of 4). The contracts wereapproved by all required parties and we noted the approvers were part of the contractreview process prior to final execution and signoff.

Low


7/28

Background


8/28

Purchases and Cash Disbursements Enterprise Florida, Inc.

BACKGROUND

Enterprise Florida, Inc. (EFI) is considered the States economic development arm, receiving funds from

the State to perform economic development duties in accordance with an agreement with the State. Asof July 1, 2011, the Florida Department of Economic Opportunity (DEO) administers the contract with EFI.Prior to that, it was administered by the Office of Tourism, Trade and Economic Development (OTTED).

The Risk Assessment initially prepared for EFI included Purchases, Payables and Cash Disbursementsas a high risk process due to the nature of the risks involved and the volume/dollar amount oftransactions associated with the processes. Total expenditures reported in the companys auditedfinancial statements for the year ended June 30, 2011, were $19.6 million. The total expenditures for theyear ended June 30, 2010, were $22.1 million. The categories of expenditure for the years ended June30, 2011, and June 30, 2010, were as follows:

Category June 30, 2011 June 30, 2010

Payroll and related costs (including benefits) $ 6,630,436 $ 6,148,837General and administrative 5,816,148 4,909,431Grants to sub-recipients (pass-throughs) 2,988,711 8,282,323Professional fees 4,009,099 2,552,983Other (including non-cash depreciation) 160,486 245,682

Total $ 19,604,880 $ 22,139,256

Each internal audit that has been performed to-date has included relative controls and testing aroundpurchasing for the in-scope processes included with that report, including Follow Up (issued June, 2008),Contract/Grant Compliance (issued June, 2008), International Offices Review (issued October, 2007),and the SAS 112 Readiness Control Design Analysis (issued September, 2007). This report expandedthe scope of those previous audits to encompass all types of disbursements made by the company.Where practical, we have relied upon the design and effectiveness analyses performed during thoseaudits for the purposes of this report.

PurchasingEFI is not a state agency as defined by Florida Statute 287.012 and as such, is not required to followstatutory requirements for purchasing and competitive selection. EFI has developed internal policies andprocedures using statutes as a guideline where practical. The Purchasing and Cash DisbursementsPolicy requires that a competitive selection process be followed for total purchases greater than $25,000.The State has thresholds starting at $20,000. As part of their agreement with the State, EFI is required tofurnish copies of the purchasing and contract policies and procedures for the States review. EFI has notreceived notification from the State that the policies are not adequate or acceptable.

Non-Economic Development Goods and ServicesEFI prepares an annual budget that is approved by senior leadership and presented to the Finance andCompensation Committee, Executive Committee, and Board of Directors. The budget includes significantpurchases, such as planned trade shows and events or missions, as well as budgeted line items for eachdepartment. Purchase orders are initiated and prepared by business unit personnel, and approvedaccording to the Purchasing and Cash Disbursements Policy as follows:

$


9/28


10/28


BACKGROUND -CONTINUED

Statist ical Data Fiscal Year 2010/2011

The tables below show the disbursements by account, including the average and median dollar amountsper transaction and the totals. The master account has been further broken down into checks versus wiretransfers.

Fiscal 2010/2011

Disbursements Data by Account*

Checking Account Name NumberTotal Dollar

AmountAverage

DollarAmount

Median DollarAmount

Master account 1689 $ 13,176,669 $ 7,801 $ 904

Corporate / Private funds 110 $ 199,571 $ 1,814 $ 140

Employee Benefit FSA 92 $ 30,753 $ 334 $ 192

Grants and other Administered Programs 235 $ 11,761,915 $ 165,493 $ 39,854

Investments and Capital Programs 75 $ 2,079,756 $ 125,301 $ 24,067

*These amounts vary from the total audited expenditures noted on page 4 due to difference in cash and accrual basis accounting aswell as pass-through activities that are not recognized on the companys financial statements.

Master Account Information Fiscal Year 2010/2011

Number of checks written 1414

Total dollar value of checks written $5,526,016

Average dollar value of checks written $3,908

Median dollar value of checks written $693

Number of wire transfers/ACH 276

Total dollar value of wire transfers/ACH $7,650,653

Average value of wire transfer/ACH $27,720

Median value of wire transfer/ACH $14,980

Organizational Chart Finance and Accounting

Vice President,Finance & Accounting


11/28

Objectives and Approach


12/28


OBJECTIVES ANDAPPROACH

ObjectivesObjectives of the internal audit of Purchases, Payables and Cash Disbursements include the following:

Document the purchases, payables and cash disbursements processes and related internalcontrols.

Assess the risks and existing key controls against benchmark controls for similar processes. Evaluate access controls and segregation of duties within the processes. Determine if there are controls for monitoring purchases and expenditures for compliance,

authority and accuracy. Determine if there are controls for monitoring related party transactions and conflicts of interest. Determine and evaluate if records and documentation are sufficient to establish an audit trail for

all transactions involving disbursements. Evaluate compliance with applicable Florida Statutes and EFI policies & procedures. Determine the adequacy and operating effectiveness of the control structure over purchases,

payables and cash disbursements; and make recommendations when considered necessary.

ApproachOur audit approach consisted of three phases:

Phase I - Understanding and Documentation of the ProcessDuring the first phase of our approach, we met with those involved with the purchases, payables and

cash disbursements processes to discuss the scope and objectives of the processes and obtainpreliminary data. In order to obtain an understanding of the process and identify related controls, weconducted interviews, obtained detailed documentation and documented the processes. We reviewedFlorida Statues and EFI policies and procedures related to purchases, payables and cash disbursements.We also reviewed our previously issued internal audit reports for relevant processes and controls relatedto those functions.

Phase II - Detailed TestingThe purpose of this phase was the execution of applicable tests of compliance and controls around thepurchases, payables and cash disbursements processes. Each internal audit that has been performedto-date has included relative controls and testing around purchasing for the in-scope processes includedwith that report, including Follow Up (issued June, 2008), Contract/Grant Compliance (issued June,2008), International Offices Review (issued October, 2007), and the SAS 112 Readiness Control Design

Analysis (issued September, 2007). Where practical, we have relied upon the design and effectivenessanalyses performed during those audits for the purposes of this report.

We performed sampling techniques on disbursements made between July 2010 and December 2011.We utilized sampling and other auditing techniques as follows to meet our audit objectives outlined aboveand performed the following:

We utilized computer assisted audit techniques to perform the following:o Reviewed vendor master listing to active employee listing.o Reviewed vendor master listing for duplicate names and addresses.o Reviewed purchase order listing for sequence and duplicated purchase orders.

We reviewed segregation of duties over user access within Great Plains. We selected a sample of disbursements and verified the following:

o Bid/quote procedures were followed where applicable under policy.


13/28


OBJECTIVES ANDAPPROACH -CONTINUED

Approach - cont inued

Phase II - Detailed Testing

We selected a sample of expense reimbursement disbursements and verified the following:o Disbursements were properly authorized according to policy.o Authorization form was on file and properly signed by employee and approved by a

supervisor according to policy.o Expenditures presented for reimbursement were properly supported with documentation.

We reviewed the controls over cash disbursements, including wire transfers. We reviewed a sample of the monthly accounts payable reconciliations to general ledger. We reviewed a sample of the monthly bank reconciliations. We reviewed the aged accounts payable detail listing for vendors with debit balances. We verified financial reports were presented to the Finance and Compensation Committee and

Executive Committee. We selected a sample of contracts and verified the following:

o Grantee selection process was properly documented on ranking sheets.o Executive Committee pre-approved and/or reviewed contracts where required by policy.o Conflict of interest statements were obtained from proposal evaluators and contract

approvers.o Contract review sheet was signed by contract approvers prior to execution of the

contract. We selected a sample of employee pay disbursements and performed the following testing

relating to the payroll and human resource functions:o Tested payroll for accuracy by verifying the time reported and pay rate to properly

approved supporting documentation.o Verified accuracy of tax and benefit withholdings.o Verified that personnel information was properly input into the human resource and

payroll systems.o Verified that the employees offer letter was properly approved and the personnel file was

organized.o For terminated employees, verified that the termination date was input accurately,

employee did not receive a paycheck after their termination date and access to systemsand corporate credit card usage was properly removed.

o Reviewed overall organization of sampled employee file. We verified that a completed State required financial disclosure and conflict of interest

information was on file for all board members.

Phase III - Reporting

At the conclusion of our audit, we summarized our observations related to the purchases, payables andcash disbursements processes for EFI. We conducted an exit conference with management anddiscussed the details of the report with them. Managements responses to our observations andrecommendations are included with this report.


14/28

Observations and Recommendations


15/28

OBSERVATIONS ANDRECOMMENDATIONS

Page 9

Rating Observation Recommendation Management Response

High 1. Segregation of Duties

Two employees of the Finance and Accountingteam have conflicting duties over cashmanagement, purchasing and accounts payable.

The company has attempted over the last twofiscal years to reduce the impact of theseconflicts; however the schedule on the followingpage shows the conflicts which remain.

We noted compensating controls in place tomonitor activities under conflicting duties,including review of the financial statement andcheck registers by senior leadership outside of the

Accounting and Finance department. The bankused for wire transfers also has built in controlsrequiring dual users on every transaction.

During our fieldwork, it was also noted thatAccounting was actively interviewing for a staffposition, and the new Chief Operating Officer had

just been brought on board. These additions tothe organizational structure should allowmanagement to more fully segregate and/orexpand monitoring related to the risks of lack ofsegregation of duties.

Due to staffing limitations in the Finance andAccounting department, access cannot be fullysegregated. With the expansion of personnel, werecommend the duties be segregated as follows: The Senior Accountant should setup vendors

(upon approval See Issue #3) and processapproved invoices.

The Senior Accountant should initiate wires, andprepare cash and G/L account reconciliations fortheir respective areas.

The VP of Finance and Accounting shouldapprove checks/wires, review reconciliations, andprepare financial statements with analysis forreview and approval by the leadership team andBoard. Ideally, the VP of Finance and

Accounting should have read-only access to theGreat Plains system. If this is not practical,manual segregation of duties should be strictlyfollowed.

Journal entries should not be prepared andposted by the same individual. Managementshould consider batch-posting journal entries sothat one person can enter and another personreview and post the entries.

We also recommend that management review thetransaction limits within the online banking systemand set them appropriately for what is needed givenexpected activity after the proposed banking servicecontract is awarded.

Response: During the period of timeunder audit, the Finance and

Accounting team consisted of threepeople: Vice President, Finance and

Accounting; Senior Accountant, andAccounts Payable Clerk. Propersegregation of duties was not possibledue to the limited resources. Anadditional accountant has recentlybeen added and we are working tocross-train her among the variousfunctions.

Management has evaluated theserecommendations and is willing toaccept these risks as we believeadequate compensating controls arealready in place.

Any changes to the online bankingsystem will be made after the bankingservices contract has been awarded.

ECD: June 30, 2012

Responsible Person:Pamela Murphy,

VP of Finance and Accounting


16/28


Page 10

Segregation of Duties Matrix:

A B C D

Custody

Access to enter wire transfers with SunTrust * X X X

Access to release wire transfers with SunTrust * X X

Recording

Access to maintain/modify vendor master file X X X

Access to enter and post vendor invoice X X X

Access to enter and post credit memo X X X

Access to post disbursement to vendor account X X X

Access to post journal entries X X X

Reconciliation

Perform accounts payable reconciliation XPerform cash account reconciliations X

Aut horizat ion

Approve accounts payable reconciliation X

Approve cash account reconciliations X

Invoice or purchase approval X

Vendor approval X

Access to modify general ledger X X X

Investments (Capital Programs)

Perform investment bank account reconciliations X X

Signature authority on investment account checks/wires X X

Approve investment bank account reconciliations X

A = Vice President, Finance and Accounting

B= Manager, Capital Programs

C= Senior AccountantD= Accountant

*Note: SunTrust user controls require a personal identification number (PIN), and the same PIN cannot be used for initiating andreleasing the same transaction.


17/28


Page 11


Moderate 2. Conflict of Interest and Related Party Confirm ation

We noted the Company Ethics policy (located inthe Employee Handbook) includes a section onConflicts of Interest and states that they shouldbe avoided, even in appearance. There is nomonitoring control that requires employees certifyon a periodic (i.e., annual) basis that no suchconflicts exist.

Further, we noted that the company routinelyfollows IRS guidelines for family and businessrelationships as required when filing their annualtax return. These guidelines suggest thattransactions that occur in the ordinary course ofbusiness and at an arms length are not required tobe disclosed. However, we noted the company

was unaware of whether the Board members hadfiled the State required Full and Public Disclosureof Financial Interests information with the FloridaCommission on Ethics. We were able to verify withthe State that these were up-to-date throughDecember 31, 2010 reporting requirements, whichwere due by July 1, 2011. The December 31, 2011disclosures are not due yet. Due to the nature ofthe entitys Board as a publicly-appointed body ofinfluential business executives, and the nature ofEnterprise Floridas business, we expected to see,and did note known relationships with Board

members reflected in the entitys vendor listing.These relationships should be compiled andpresented annually to the full Board fortransparency and full disclosure.

The existence of conflicts or related party interestsis common in business. Without a formal protocolfor disclosure and evaluation of the relationshipsboth internally and by the Board, the risk ofnegative public perception related to the improperuse of funds increases.

In addition to the recommendations in observation #3for a formalized vendor approval process, HumanResources should administer an annual certification toemployees via email or internet survey stating thatthere are no conflicts of interest with any of thevendors in the active vendor listing, including pass-through agencies.

Further, management should obtain copies of the Fulland Public Disclosure of Financial Interestsstatements filed by Board members each year.Known relationships should be compiled andcompared against the active vendor listing for possibleconflicts or related-party transactions.

Any existing and/or newly identified relationships mustbe disclosed and appropriate steps taken, includingbut not limited to further disclosure to seniorleadership, the Board or the State; properdocumentation and evaluation of the relationship; andpossibly refraining from doing business with therelated person or entity.

Response: Rather than annuallypoll all employees to disclose if aconflict of interest exits,management would like to know if aconflict exists prior to executing acontract or processing a payment toa vendor. The contract policiesalready include required disclosuresfor key personnel involved inexecuting a contract, and will beextended to include the contractscoordinator and contract manager.This disclosure will be added to allpurchase orders and requestsformats in the future.

Management will request copies ofthe Full and Public Disclosure ofFinancial Interests statements in thefuture and forward to accounting toverify against the vendor list.

Relationships within the normalcourse of business and conducted atarms length with the same terms asoffered to the general public neednot be disclosed.

ECD: June 30, 2012

Responsibl e Person:Pamela Murphy,VP of Finance and Accounting


18/28


Page 12


Moderate 3. Vendor Setup and Approval

The organization has several operational triggersfor new vendor relationships. Contract review

sheets, grant applications, purchase orders, checkrequests, vendor invoices and otherdocumentation are used to set up a vendor in theGreat Plains system. This can occur after thepurchase has already been completed. TheFinance and Accounting department obtains aForm W-9 Request for Taxpayer IdentificationNumber and Certification in order to track whetherto issue certain tax forms to vendors at the end ofthe calendar year.

We noted the following in relation to vendor setup:

There is no formal vendor approval processand policy. We reviewed the processsurrounding the setup of new vendors anddetermined there is an informal procedure inplace, but it is not consistently applied.

During our testing, we noted there was no W-9or adequate substitute (with propercertifications from the vendor on the validity ofthe information) available for 10 of 35 vendorsselected for testing. For 1 of these, we alsonoted the taxpayer identification number wasnot captured in the Great Plains system.

Without formal vendor approval, the risk ofunauthorized, duplicated, or related-party vendorsincreases. Coupled with observation #2 forvendor master file review, the risk is moresignificant. Without adequate documentation ofvendors certification of their taxpayer status (i.e.,individual, corporation, etc.), required IRS taxforms may not be filed appropriately.

We recommend that management develop a formalvendor approval process which includes approval of

vendors before purchases are made and a vendorform, including completion of a W-9 form for all newU.S.-based vendors.

Steps of the approval and verification process shouldinclude: If a Florida corporation, validate the vendor's

status as an active corporation on theDepartment of States website atwww.sunbiz.org.

Compare the vendor name/address to existingvendor names/addresses.

If the above is performed during the vendor set upprocess, the risk of setting up fictitious and/orduplicate vendors is reduced.

In addition to the above, periodic review of thevendor master file (see observation #4) and annualcertification of conflicts of interest or related parties(see observation #2) will help to ensure vendors arereal and appropriately classified for tax reportingpurposes, and purchases are occurring at arms-length.

Response: With recent proposedchanges by the IRS to 1099 reporting

over the past two years accountinghas already implemented morevigorous procedures requiring W-9sfor all new US based vendors prior toprocessing payments. All new W-9sare matched to the IRS tax payeridentification system. All contractsrequire that all new vendors submit aW-9 with their contract.

In addition to the above, accountingwill implement a new procedure to

verify if a Florida corporation is activeon the Department of CorporationWebsite prior to processing payment.

The vendor master file is alreadyreviewed prior to processing everypayment to verify addresses.

ECD: June 30, 2012

Responsible Person:Pamela Murphy,

VP of Finance and Accounting
http://www.sunbiz.org/http://www.sunbiz.org/http://www.sunbiz.org/


19/28


Page 13


Moderate 4. Master Vendor Listing

We noted there is no formal, periodic review of thevendor master listing for items such as duplicate orinactive vendors, comparison to employeeaddresses for unusual activity, or a cross-check forrelated parties with employee names/knownrelationships or Board members.

We performed computer assisted audit techniquesto identify potential duplicate and inactive vendorsas of 12/31/2011. The total population of activevendors was 3,012. We noted the following withrespect to the vendor master file in Great Plains:

Duplicate Vendors:

Similar vendor name and sameaddress 25

Same vendor name and similaraddress

19

Inactive Vendors:

Vendors with no disbursementssince 2009 that have not beeninactivated

2,570

Vendors with no disbursements thathave not been inactivated 196

Duplicate and inactive vendors in the master filecould lead to inefficiencies, possible delay inpayment of invoices, and increase the likelihood ofduplicate payments or mismanagement. Note wedid not find any duplicate payments orinappropriate expenditures in our testing ofdisbursements. Delays in processing could lead tofinance charges on purchases.

As recommended in Issue # 3, controls should beimplemented over vendor setup to reduce thelikelihood of creating duplicate vendors in the systemin error. An annual review of the vendor master fileshould also be conducted to identify potentialduplicate vendors for inactivation. This reviewshould include a review for unusual patterns, such asnames that may be similar, but not identical to thenames of approved vendors and vendors withmultiple addresses and other irregularities.

Also, vendor master file activity should beperiodically reviewed to identify vendors forinactivation. Vendors without a recent history ofpurchases, or who are no longer approved for use,

should be inactivated.

See also observation #4 for related-party checks.

Response: Although Accountingmakes every effort to reduceduplicate vendors, Duplicatevendors may often need to be createdor retained as a means to separatepayments. For example, anemployee who leaves the companybut is later retained as anindependent contractor would besetup as a vendor-employee classfor all expense reimbursements, thena new vendor-1099 class for allpayments made as an independentcontractor for IRS reporting purposes.Multiple vendors may also be setup

based on the types of payments (e.g.,Defense grant or regular vendorpayment for services).

Review for the over 4,000 vendorsperiodically for inactivation is a verytime consuming task which thedepartment has not had the resourcesto complete. Management will assessthe need to devote current resourcesor obtain additional resources incompleting this task.

ECD: TBD

Responsible Person:Pamela Murphy,VP of Finance and Accounting

Teresa Buckley,Senior Accountant


20/28


Page 14


Moderate 5. Employee Federal Income Tax Withholding Errors

Federal income tax withholdings for 2 of 10employees selected for testing were improperlycalculated in the payroll system. Both errors werecaused when information from the employee-completed IRS Form W-4 Employees Withholding

Allowance Certificate was incorrectly input into thepayroll system. In both instances, excess Federalincome taxes were withheld from each paycheck,thus impacting the employees personal tax return.

These employees were notified of the errors duringour audit and the Payroll department is obtainingupdated Form W-4's from the employees todocument their current withholding allowances andmarital status and update, if needed. We notedthese errors occurred prior to a change inpersonnel and processes in the payroll department.Updated controls would have likely detected theerrors if the employee had submitted an updatedW-4.

Employees expect that their income taxwithholdings are based on the information theyreport on their Form W-4 and can therefore faceunder or over-payment situations when incorrectamounts are withheld. It is the employer'sresponsibility to ensure that taxes are withheld

using the employee-reported information forallowances and status.

IRS Publication 15, "Employers Tax Guide, statesthat employers are responsible for annually remindingemployees to submit a new Form W-4 if they need tochange their withholdings. The IRS recommends thatbefore December 1, employers remind employees tosubmit a new Form W-4 if their marital status orwithholding allowances have changed or will changefor the next year. This will reduce the risk ofwithholding income tax based on outdated W-4information. As a general practice, W-4s should bereplaced periodically even when preferences haventchanged.

We recommend W-4 forms should be updated at leastannually, or a company-wide email or intranetreminder should be sent to the employees to checktheir withholdings and submit an updated form by apre-specified date in accordance with IRS guidelines.

Further, periodic checks of employee income taxwithholdings and other personnel file documentation(such as I-9 forms, benefit selections, etc.) should beperformed for a sample of employees (e.g., 10employees per month) to ensure withholdings arebeing calculated based on the most recentinformation. Appropriate follow up should beperformed to correct identified errors within the

system and notify the employee for their tax planningpurposes.

Response: HR already sends anemail annually reminding staff tosubmit a new W-4 form inDecember.

All employee changes including W-4s are reviewed and verified withevery payroll by either the VPFinance and Accounting or theSenior Accountant which was not thecase previously.

Since the auditors identified thesediscrepancies the current HRDirector and Payroll Assistant havereviewed every active personnel fileand verified the W-4 status on thepages form completed by theemployee agrees to the status in

ADP.

ECD: Completed

Responsibl e Person:Pamela Murphy,VP of Finance and Accounting

Sharon Blake,Director of Human Resources andOffice Services


21/28


22/28


23/28

Vendor Setup Enterprise Florida, Inc. 1

Staff

Accountant

VPFinance&

Acco

unting

BusinessU

nit

GapControlProcess

Step

Legend:

Annually: Reviewvendor master file forduplicate and inactive

vendors and ensurecompleteness of files

Enter vendorinformation into

Great PlainsEnd

Start

Receive vendorsetup form

along with copyof W-9

Review vendorinformation and

assign vendornumber

Prepare vendorsetup form


24/28

Purchase Initiation Enterprise Florida, Inc. 2

Vend

ors/

Service

Providers

Contrac

ts

Complian

ce

B

usinessUnit

Provide assistance

in obtaining bids/quotes and

selecting vendor/provider

Start

Purchase requiresmultiple bids or

sole sourcejustification.

Purchases >$25,000 in afiscal year?

Yes

Submit proposalsfor bids and formal

quotations basedon advertisements

No

Summary of bid/quotes or cost

comparisons mustbe kept in a file

and available foraudit

Purchases >$100,000 in afiscal year?

Procurement isreported to the

ExecutiveCommittee

PO required underPurchasing policy?

No bids/quotes arerequired.

Purchase isapproved

according to theapproval matrix.

No

Procurement ispre-approved by

the ExecutiveCommittee

Purchase inAnnual Approved

Budget?Yes No

Yes

POYes

Goods/Services

No

ControlLegend:

ProcessStep

Gap


25/28

Purchase Order Enterprise Florida, Inc. 3

BusinessU

nit

Accounting

Department

VPFinance&

Acco

unting

GapControlProcess

Step

Legend:

(1) Approval Limits

0 - $1,000 = Director$1,001 - $2,500 = Senior Director or Vice President$2,501 - $5,000 = Senior Vice President, SVP-Administration/COO, or President/CEO$5,001 - $99,999 = Joint signature of the Division Senior Vice President, and either SVP-Administration/COO or President/CEO$100,000 + = Executive Committee

Enter PO informationin an Excel log formaintenance of

outstanding balanceand other details

Obtain and filecopy of PO

Verify purchaseorder details(amounts,

available funds,etc.)

Assign asequential PO

number fromAccess database

Prepare purchaseorder (non-

recurring items)

Obtain original POand place order

Obtain properapproval per

approval limit (1)

PO

Review PurchaseOrder Excel log for

open POsannually

Goods/Services


26/28


27/28

Cash Disbursements Enterprise Florida, Inc. 5

President/

CEO

VPFinance

&

Accounting

Manager,

Capital

Programs

SVPof

Admin.

/

COO

Senior

Ac

countant

Staff

Account

ant

EndGoods/Services Check/ wiretransfer?

Process

Step

Control Gap

Wire Transfer

Release wire transfervia secure pin

number**

Provide checks and

supportingdocumentation to VP

Finance andAccounting.

Prepare checkregister (weekly and

monthly)


number**


number**

Checks

Review and signchecks. Two

signatures needed ifcheck is over $5,000.

Review and signchecks. Twosignatures needed ifcheck is over $5,000.

Review and signchecks. Two

signatures needed ifcheck is over $5,000.

Review checkregister weekly andsign Check RegisterApproval Memo.

Copy checks and

mail. Copy wiretransfers and filewith approved wire

transfer requestform.

Legend:


number**

SunTrust system willnot allow the releaseof wire transfers bythe same user that

entered the wire.

Review checks and supportingdocumentation for approvals,proper coding, and accuracy.

Enter into PO Log.

* All invoices submitted and properly authorized/matched by Friday are included for payment the next week.** The following individuals have access to release wire transfers: Senior Accountant, VP Finance and accounting, SVP of Administration, and Manager, Capital Programs. TheManager, Capital Programs, has access to release wires***The CEO, SVP Administration, and COO have signing authority on all accounts. The VP Finance & Accounting and Manager, Capital Programs, have signing authority only for theinvestment related accounts. The SVP Strategic Partnerships has signing authority only over the non-investment related accounts.

Travel expenses related to budgeted events are pre-approved through the annual budget approval. For disbursement approval, they must also be supported by expense reports andsupporting documentation, authorized by the employees supervisor. The total expense report amount must be approved in accordance with the purchase approval limits.

Review WireTransfer Request

Form and approve.

Generate checks weeklyand review batch.

Enter wire information inSunTrust On-Line Treasury

Manager system.

Approve and signwire transfer request

form.

Approve and signwire transfer request

form.


28/28

Monthly Enterprise Florida, Inc. 6

VPofF

inance

&Acco

unting

Manager,

Capital

Programs

Executiveand

Finance

Committees

SVPof

Adm

inistration/

COO

Senior

Accountan

t

Prepare monthlybank

reconciliations.

End

Review monthlyactivity with VP of

Finance andAccounting

Start

Annually:Payables are

recorded throughcut-off date.

GapProcess

Step

Legend:Control

Review financialstatus and reports

at periodicmeetings.

Approve financialstatements.

Review andapprove

investment bankaccount

reconciliations.

Review and

approve bankreconciliations.

Prepares quarterlyinvestment bank

accountreconciliations.

Print and reviewbalance sheet,

profit & lossstatement and

detail trial balance

Prepare monthlyaccounts payable

reconciliations.

Review andapprove accounts

payablereconciliations.

Documents

Enterprise Florida Internal Audit by McGladrey - March 15, 2012