Embed Size (px)
Citation preview
GARLAND INDEPDENDENT SCHOOL DISTRICT Garland, Rowlett and Sachse
972.487.4651 PO Box 469026 Garland, TX 75046–9026
Phrases in (blue) are hyperlinks used by IA to review the audit and for the reader to know from where information came. This is IA Job # 16–53.
Internal Audit Department
Steven Martin, CPA/CFF, CGFM, CFE, CGMA, CIGI November 18, 2016 Director of Internal Audit
Independent Auditor’s Report
Follow–up Report to the March 30, 2016, Internal Control Audit of the Tax Office
To: Board of Trustees
Reference is made to the Internal Control Audit of the District’s Tax Office dated March 30,
2016, which included 19 findings and one observation, listed in Appendix Two, page 12. The
Internal Audit Charter, Board Policy CFC (Local) states, “The internal audit department shall
be responsible for appropriate follow–up on audit findings and recommendations. All
significant findings shall remain in an open issues file until cleared by the internal audit
department. The internal audit department shall issue periodic status reports to the Board with
copies issued to the Superintendent.”
The administration fully accepted and enacted 11 out of 19 recommendations. The original
audit focused on Tax Office internal control, which is largely a matter of judgment, taking into
account cost versus benefit. The administration is under no obligation to enact the remaining
recommendations unless the Board directs otherwise. Consequently, pending such direction
to the administration by the Board, this will conclude follow–up audits on the original Tax
Office audit.
The original audit included three main findings:
Separating accounting and treasury functions at the Tax Office
Creating an audit trail within the Tax Office
Employing separate contractors to manage tax records and receive credit card
payments.
The Tax Office created an audit trail as described herein in Appendix Two. However,
accounting and treasury functions still take place within one administrative unit, the Tax
Office, and the same contractor continues to manage tax records and receive tax payments.
Attached are the following appendixes:
Appendix One – Management’s Current Status per Management of each finding,
page 9
Appendix Two – Current Tax Office Tax Cash Handling Procedures, page 12
2
Appendix Three – Personnel with Governmental Data Services (GDS)(property tax
software) access, page 22
Appendix Four – Findings in the Original Report, page 23
Appendix Five – Management’s Response to Original Findings, page 41
Appendix Six – IA’s letter to management requesting a response, page 45
The original findings with management’s original responses, management’s reported current
status, and results of the current audit are as follows:
Tax Office
1) Lack of Separation of Duties –Tax Office – Recommendation rejected, minor
changed enacted, no reconciliations as proposed completed
Management’s original response – “The Tax Office has removed from GDS
the access the Director of Tax Services has to be able to post payments and
access the Tax Clerk Ill has to be able to make any adjustments. The Business
Office (hereinafter use to mean the finance and accounting functions of the
District) does have the ability to review a monthly reconciliation of the Dallas
Central Appraisal District (DCAD) tax roll to the data maintained in GDS
without a significant drain on resources. This will be implemented as soon as
feasible.”
Current Status per Management – “No change but plans are being made to
review the Dallas Central Appraisal District tax roll supplements that are
received monthly. This review will be made by staff not part of the Tax
Office.”
Current Audit – The original recommendation called for a physical separation
of Tax Office accounting and treasury responsibilities. This was rejected.
Instead, the administration countered by enacting changes in GDS access (see
Appendix Three). The Director of Tax Services cannot post payments and the
second-in-charge cannot make adjustments. A review by IA of the GDS
Access documents confirms these changes.
However the change is meaningless because the Director of Tax Services and
Tax Clerk III have the ability to change GDS access at any time.
Consequently, the original finding effect stands: Tax Office personnel have
access to cash and checks and also to accounting records. Assets may be
misappropriated and accounting records altered.
Furthermore, the Tax Office Director supervises the Tax Clerk III and
remaining four Tax Clerks all of whom have the ability to record tax
payments, and in addition to the Director, two Tax Clerks also have the ability
to make adjustments and refunds. Even if Tax Office personnel lacked the
ability to make changes to GDS access, because one administrative unit has
access to accounting records as well as incoming cash and checks, the District
continues to be in violation of TEA’s Financial Accountability System
3
Resource Guide (FASRG), Financial Accounting & Reporting Section 1.5.4.4
that states:
o Segregation of the responsibilities for billing property taxes and
services from collection and accounting
o Segregation of the responsibilities for maintaining detail accounts
receivable records from collections and general ledger posting
o Segregation of collection, control and deposit of funds activities from
maintaining accounting records
o Maintenance of the property tax assessment rolls by individuals not
engaged in any accounting or collection function
o If EDP is used, maintenance of the principle of segregation of duties
within processing activities
TEA FASRG Financial Accounting & Reporting Section 1.5.2.2 states,
“Persons who have authorized access to both assets and related accounting
records may be in a position to conceal shortages of the assets in the records.
If duties are properly segregated, persons who have authorized access to assets
will not also have access to related accounting records in which they might
conceal shortages.”
The FASRG internal control requirement is tempered by Section 1.5.1.3,
which states, “The application of control activities, such as segregation of
duties, is affected to some degree by the size of the school district. In
smaller school districts, control activities will be less formal than in larger
school districts. Additionally, certain types of control activities may not be
relevant in a smaller entity.”
However, “Educating 57,000 students across 71 campuses, Garland ISD
ranks as the second–largest district in Dallas County, fourth–largest in
Dallas–Fort Worth, 13th–largest in Texas, and is among the 70–largest in
America,” (161118 from GISD website Highlights _ Garland Independent
School District). Additionally, with 2016–2017 budgeted general funds
revenues of $462,406,099, GISD can hardly be called a small district,
(161118 2016–17_approved_budget_8–24–16).
Second, the original management response stated, “The Business Office
(hereinafter use to mean the finance and accounting functions of the District)
does have the ability to review a monthly reconciliation of the DCAD tax roll
to the data maintained in GDS without a significant drain on resources. This
will be implemented as soon as feasible.” However, pursuant to
management’s reported Current Status per Management, such reviews have
not yet been started.
Furthermore, although it is stated that the Business Office has the ability to
review monthly reconciliations of the DCAD tax roll to data maintained in
4
GDS, it is seen that no one in the Business Office has access to GDS (see
Appendix Three). The original report was issued in April 2016 and this
review is being conducted in November 2016. It appears in the last six
months no steps have been implemented to review said monthly
reconciliations.
2) Lack of Separation of Duties – GDS, contractor – Recommendation rejected, risk
accepted
Management’s original response – “The District has before used another
vendor for credit card and e-check services. PCI (Payment Card Industry)
compliance issues caused the District to switch back services to GDS. The Tax
Office contacted GDS to request a copy of the audit performed under
Statement on Standards for Attestation Engagements (SSAE) No. 16,
Reporting on Controls at a Service Organization. GDS has indicated that the
District's data resides on our servers and not in their hosted solution like most
of their clients. Some additional research will likely be necessary to determine
if we can rely on the controls in place at GDS and not split the services.”
Current Status per Management – “No change.”
Current Audit – GDS provided the District with an SSAE report on one of its
service organizations, not an SSAE report on itself as a service organization.
Subsequently, the District’s Chief Financial Officer provided the following
statement, “Per your request I had Denise Holmes calculate the percentage of
tax revenue received through GDS’s credit card and e–check services. For the
time period 9/1/2015 through 8/31/2016 the amount of tax collections from
GDS were $10,438,477. For the same time period the levy was $190,379,645.
This represents just over 5%. I believe the risk to the District is minimal given
the small percentage that GDS collects via their system. However, should that
amount increase I will certainly weigh the cost against the benefit of having a
third-party service engaged to collect credit card and e-check payments of
taxes.”
3) Lack of Testing and Reconciling of Taxes Receivable in GDS at the Beginning of the
Year and from One Month to the Next – Recommendation Accepted but not
Enacted After Six Months
Management’s original response – “The Tax Office, Business Office and
Budget Department will work on developing a way to randomly test data
received by the Dallas Central Appraisal District. Any reconciliation
performed will be reviewed by the Deputy Superintendent of Business.”
Current Status per Management – “A process is being developed whereby
data received from the DCAD and imported into the tax office software will
be reviewed by Budget and the CFO.”
Current Audit – The recommendation is process of being enacted but to date,
six months later, Business Office personnel still lack access to GDS, the
District’s tax software.
5
4) Lack of Clearly Defined Audit Trail – Recommendation Enacted
Management’s original response – “The Tax Office will implement a Cashier
Reconciling Report, a cash summary deposit reconciliation and a daily deposit
reconciliation. The Business Office will randomly select reconciliations for
review.”
Current Status per Management – “This recommendation has been enacted.”
Current Audit – A Cashier Reconciling report, a cash summary deposit
reconciliation, and a daily deposit reconciliation (entitled Activity Fund
Deposit Ticket) were provided (Appendix Two, page 12). The daily deposit
reconciliation ties to a deposit slip and cash bag tear off record, both provided.
These also tie to a GDS Distribution report, the Tax Office depository bag log,
and Gardaworld log, also provided. The audit trail appears complete.
Additionally, both the cashiers and deposit clerk initial the reconciling pages
indicating a clear transfer of cash.
5) Lack of Accountability when Assets are Transferred Between Employee s– Cashiers
and Deposit Clerk – Recommendation Enacted
Management’s original response– “The Tax Office will implement a system
where the cashier and deposit clerk count the cashier's drawer together and
both will initial the cashier reconciling report.”
Current Status per Management – “This recommendation has been enacted.”
Current Audit – See 4 above.
6) No Receipts Between Employees – Deposit Clerk, Tax Clerk II and Tax Clerk III –
Recommendation Enacted
Management’s original response – “The Deposit Clerk and the Tax Clerk II
will count the cash together and initial they are in agreement as to the amount.
The Tax Clerk II will then post the payments while the Deposit Clerk prepares
the cash deposit. The Tax Clerk Ill will be removed from this transaction.”
Current Status per Management – “This recommendation has been enacted.”
Current Audit – See 4 above.
7) Three Employees Counting Cash Four Times – Recommendation Partially
Enacted, Partially Rejected
Management’s original response
i. “The Tax Office will implement a Cashier Reconciliation Report and
Summary Deposit Report which will require one less person (Tax
Clerk Ill) to count cash.” Recommendation Enacted – See Appendix
Two
ii. “Regarding the recommendation that the GL Accountant reconcile
daily total property tax revenue and refunds with a daily GDS report,
this is currently not feasible given the current staffing levels in the
Business Office.” Recommendation Rejected
iii. “However, like in the response to Finding 4, the Business Office will
randomly select a sample to review”. Recommendation Not Enacted
6
Current Status per Management – “The requested change has been enacted.”
Current Audit – Despite a request (161114 to CFO for requested items re
Follow up response) for reconciliations completed by the Business Office for
IA to review, none were provided, despite management’s original response
being made six months ago. Accordingly, it appears this part of the
recommendation, reconciling daily total property revenue and refunds with a
daily GDS report, will not be enacted, either daily or on an interim basis.
8) Tax Collector’s Bond to be approved by the Board – Recommendation Enacted
Management’s original response – “GISD Board Policy CG (Legal) reads
"The tax collector for the District shall be bonded in accordance with the law."
The District has a crime policy with National Union Fire Insurance Company
of Pittsburgh, Pa. (AIG). The policy provides $1,000,000 of employee theft
coverage subject to a $5,000 deductible. The Board approves the purchase of
insurance. However, we will ask General Counsel if the approval of the policy
meets the requirement of board policy and Tax Code §6.29 and make changes
as necessary.”
Current Status per Management – “The requested change has been made.”
Current Audit – Internal Audit witnessed the Board voting to approve the Tax
Director’s bond on June 28, 2016.
9) Cash Deposit Bags not used in Numerical Order – Recommendation Enacted
This was corrected during the original audit
10) No Point of Sale Receipt from either the Cash Registers or GDS – Recommendation
Enacted
Management’s original response– “The Tax Office has started printing a
duplicate register receipt to give to the taxpayer for the cash payments
received. Checks are posted to the taxpayer's account and a receipt is issued
from GDS.”
Current Status per Management– “No change.”
Current Audit – Response satisfactory
11) Board to approve $500 Refunds, not Give Notice for $2,500 Refunds –
Recommendation Enacted
Management’s original response – “The Tax Office will begin immediately to
present to the Board of Trustees all tax refunds in excess of $500.”
Current Status per Management – “No change.”
Current Audit – A review of the refunds submitted for Board approval on
November 7, 2016, showed several from $500 to $2,500. Additionally, a
review of the video of this meeting showed the Board approving the refunds.
12) No Support Provided to the Business Office for Adjustments in Oracle of Levy
Adjustments – Recommendation agreed to but not enacted
7
Management’s original response – “The Tax Office will begin sending a
change in levy list to both the Deputy Superintendent of Business and Director
of Budget. This list will show all accounts that have been adjusted. A random
sample of each list will (be) selected to be reconciled to the data received from
the DCAD.”
Current Status per Management – “A plan has been developed to work with
GDS, the tax software used by the Tax Office, to obtain read–only rights to data
imported into GDS from DCAD, to reconcile to any changes made by the Tax
Office staff.”
Current Audit – On November 11, 2016, one of the samples as mentioned in
management’s original response was requested for IA to review. None were
provided.
13) Failure to Conduct a Risk Assessment – Recommendation not enacted
Management’s original response – “The District will consider having an
outside group perform a risk assessment of the Tax Office in the fiscal year
2016–17.”
Current Status per Management – “No change. As of the date of this memo I
(CFO) have not done, or requested to be done, a risk analysis of the tax office.
However, that is part of my SMART goals for 2016–2017. As soon as I have
completed the risk assessment I will forward to your office a copy.”
Current Audit – Recommendation not enacted.
Business Department
14) Lack of Management Monitoring – Recommendation not enacted
Management’s original response – “The recommendations provided by IA on
this finding are exhaustive and currently outside the level of personnel in the
Business Office. Having a dedicated accountant to perform all the
reconciliation between DCAD, GDS, tax refunds, levy adjustments, and others
is one way to achieve many of the recommendations in the IA report. If
funding is available, and if the benefit outweighs the cost, this will be
considered.”
Current Status per Management – “No change.”
Current Audit – Recommendation not enacted.
15) Not Using a Source Document with which to Reconcile – Recommendation enacted
This was corrected during the original audit
16) Lack of Bank Reconciliations – Recommendation enacted
This was corrected during the audit and confirmed by an IA performance audit
dated August 22, 2016
17) No DCAD Appraisal Review Board Monitoring and Challenges – Recommendation
not enacted
9
Appendix One– Management’s Current Status per Management of Each
Finding
10
11
12
Appendix Two – Current Tax Office Tax Cash Handling Procedures
13
14
15
16
17
18
19
20
21
22
Appendix Three – Personnel with GDS Access
161115 GDS Tax User Listing from Denise Holmes
GDS Access Director Tax Clerk
III Deposit
Clerk Cashier 1 Cashier 2 Cashier 3
Property Records Y Y Y Y Y Y
Tax Records Y Y Y Y Y Y
Property Notes Y Y Y Y Y Y
Tax Payments/ Quick Pay N Y Y Y Y Y
Adjustments and Refunds Y N Y N N Y
Mortgage Records Y Y Y Y Y Y
Entity Records Y Y Y N N Y
Owner, Group, and Agent Records Y Y Y N N N
Distribution Tables Y Y N N N N
Exemption, Value and Other Codes Y Y N N N N
User Records Y Y N N N N
Batch Account Records N Y Y Y Y Y
Printer Records Y Y Y N N Y
Print Tax Rolls/ Statements Y Y Y Y Y Y
Mobile Home Tax Lien Info Y Y N N N N
Print Distribution Reports Y Y Y Y Y Y
Print Reports/ Listing Y Y Y Y Y Y
Run Main Menu Y Y Y Y Y Y
Print Tax Certificates Y Y Y Y Y Y
Run Tape Transfer Routine Y Y N N N N
23
Appendix Four – Findings in the Original Report
Tax Office
Lack of Separation of Duties – Tax Office
1) Criteria (Financial Accounting & Reporting, pdf page 529 & 547)
TEA FASRG Financial Accounting & Reporting Section 1.5.2.2 states, “Persons who
have authorized access to both assets and related accounting records may be in a
position to conceal shortages of the assets in the records. If duties are properly
segregated, persons who have authorized access to assets will not also have access to
related accounting records in which they might conceal shortages.”
Financial Accounting & Reporting Section 1.5.4.4 also states:
a. Segregation of the responsibilities for billing property taxes and services from
collection and accounting
b. Segregation of the responsibilities for maintaining detail accounts receivable
records from collections and general ledger posting
c. Segregation of collection, control and deposit of funds activities from
maintaining accounting records
d. Maintenance of the property tax assessment rolls by individuals not engaged
in any accounting or collection function
e. If EDP is used, maintenance of the principle of segregation of duties within
processing activities
Condition
Property taxes due the District are similar to a District bank account. The
management of District bank accounts involve a separation of duties in which one
person receives and deposits funds into the account, another writes the checks or
makes wire transfers, another records such receipts and payments in the District’s
books, and yet one more reconciles the bank account.
Yet such separation of duties are lacking at the Property Tax Office, where four
employees have access to make adjustments and issue refunds in GDS and have
access to cash and checks. The Director of Property Tax Services supervises the
issuances of tax bills, the receipt of cash and checks, the recording in the District’s tax
books (GDS software) as to what has been received, the write–offs of property taxes
due, and the write–down of property values.
The same cashiers that receive cash and check payments post such receipts to the Tax
Office’s accounting system of taxpayer accounts, GDS. Furthermore, the Director of
Tax Services, Tax Clerk III, and three Tax Clerks II have the ability to post
adjustments to individual taxpayer property valuations, upon which the tax due is
based, as well as to post refunds. The Director of Tax Services and the Tax Clerk III
supervise all four cashiers.
24
Per Gummelt, GDS Senior Programmer, adjustments to property values and tax due
can be made through GDS. The software also has the capability to track who makes
such entries (160302 email from Gummelt). The Director of Tax Services stated that
if unauthorized adjustments were made, there would be no red flags (160301 Denise
Holmes interview).
Effect
Tax Office personnel have access to cash and checks and also to accounting records.
Assets may be misappropriated and accounting records altered.
Cause
The same employees have access to cash, checks, and accounting records.
Recommendation
It is recommended that the accounting and treasury functions be functionally and
physically separated. One supervisor would supervise the receipt of cash and checks
while another would reconcile GDS to DCAD reports, provide such reconciliations
with supporting documentation to the Business Department for oversight, and
supervise property tax accounting and billing.
The supervisor of tax receipts and cashiers would not have the ability to make
adjustments in GDS but have read–only access in order to look up account
information. The supervisor of tax accounting and billing and related personnel could
make adjustments in GDS but not have access to cash and checks.
The current Tax Clerks would be separated between the accounting and treasury
functions. This separation of duties is not as efficient as having six people in one
office with overlapping duties, but it affords considerable more internal control. It is
probable additional personnel would need to be hired or more temporary personnel
used during the busy season.
2) Lack of Separation of Duties – GDS, contractor
Criteria (Financial Accounting & Reporting, pdf page 547)
TEA FASRG Financial Accounting & Reporting Section 1.5.4.4:
a. Segregation of the responsibilities for billing property taxes and services from
collection and accounting
b. Segregation of the responsibilities for maintaining detail accounts receivable
records from collections and general ledger posting
c. Segregation of collection, control and deposit of funds activities from
maintaining accounting records
d. Maintenance of the property tax assessment rolls by individuals not engaged
in any accounting or collection function
e. If EDP is used, maintenance of the principle of segregation of duties within
processing activities
25
Condition
GDS provides the annual tax roll data it downloads from the DCAD. It also provides
monthly tax data updates called “supplementals” (160201 Denise Holmes Interview).
GDS also processes credit and debit card payments, and electronic funds transfer
payments, on behalf of the District (GDS credit debit card agreement).
Effect
GDS has access to the District’s tax records, both the value of real estate and tax due,
and also to e–checks and credit card payments made to the District.
Cause
One vendor has access to both the District’s property tax records and property tax
payments.
Recommendation
Use a separate contractor from GDS, who provides original and monthly updated
accounting data, to collect credit card and e–check funds.
3) Lack of Testing and Reconciling of Taxes Receivable in GDS at the Beginning of the
Year and from One Month to the Next
Criteria (Financial Accounting and Reporting, pdf page 530)
TEA FASRG Financial & Accounting Reporting Section 1.5.2.3, Reconciliations and
Comparison of Assets with Records states, “The purpose of reconciliations and
comparisons of assets with records is to ensure that independent checks cover the
output of a system, either by maintenance of a separate independent control record
with which the processed data are reconciled or by direct comparison of the output
with the related assets. Monitoring is usually accomplished by reviewing
reconciliations or by participating in comparisons of assets. Examples of
reconciliations of assets with records are reconciliation of physical inventory to
accounting records and reconciliation of bank balance to general ledger balance.”
Financial & Accounting Resources Section 1.5.2.4, Analytical Review states, “The
purpose of analytical reviews is to evaluate summary information, usually resulting
from a series of transactions or processes, by comparing it with expected results.”
Condition
The certified property tax roll is provided by DCAD each July 25. The Tax Office
prints a PDF copy of such roll and monthly updates, but does not use this data for
either its tax calculations or invoicing. Instead, GDS also obtains such DCAD data
and downloads calculated taxpayer account data to the District’s servers, from which
invoices are mailed, payments recorded, and adjustments made. GDS also uploads to
the District monthly adjustments calculated from monthly DCAD updates. GDS is
not audited by an outside firm (160324 Gummelt regarding audit). The Tax Office
does not do analytical work or account testing to confirm the accuracy of GDS’s
26
calculation of taxes due, either at the beginning of or during the year (160330 Denise
Holmes).
Effect
The District is blindly relying on GDS to provide correct information. Although
DCAD is audited once every three years by the State Auditor, a similar audit is not
conducted on GDS. Accordingly, the property tax levies, either at the beginning of the
year or provided in monthly updates, could be incorrect or subject to fraud.
Cause:
The District does not in any way confirm or test that the data received each year and
then in monthly updates from GDS is correct.
Recommendation
GDS data received at the beginning of each school year should be sample tested for
correct tax levies. Additionally, analytical work should be conducted comparing taxes
due per GDS to an estimate by the Tax Office based on DCAD taxable amounts
multiplied by the District’s tax rate. Levy totals then on should be reconciled with
each monthly update supported by individual taxpayer account data including
payments, exemptions, overpayments, interest, and penalties. Such reconciliations
should be approved by either or both management outside of the Tax Office and the
Board.
4) Lack of Clearly Defined Audit Trail
Criteria (Financial Accounting & Reporting pdf page 14)
TEA FASRG Financial Accounting & Reporting, 1.1.3, Accounting Principles and
Policies, states, “The state board of education intent in prescribing these rules is to
cause the budgeting and financial accounting and reporting system of independent
school districts to conform with generally accepted accounting principles (GAAP)
established by the Governmental Accounting Standards Board (GASB) and the
Financial Accounting Standards Board (FASB) for accounting treatments not
specified in GASB pronouncements.”
Furthermore, Standards for Internal Control in the Federal Government, Appropriate
documentation of transactions and internal control, states, “Management clearly
documents internal control and all transactions and other significant events in a
manner that allows the documentation to be readily available for examination.”
GAAP and the Standards for Internal Control require what is commonly referred to as
an “audit trail,” in which supporting documents are clearly marked to indicate from
where they came.
27
Condition
The Tax Office’s deposit records for cash, checks, electronic checks, credit cards,
Remit system reports, and GDS reports saved for audits are not clearly marked.
Adding machine tapes are relied upon for reconciling without clearly detailing what is
being reconciled.
Effect
An auditor is unable to audit supporting documentation to GDS and Oracle entries
without explanation from Tax Office personnel.
Cause
Failure to clearly mark supporting documentation and their relation to each other,
journal entries, and deposits.
Recommendation
It is recommended that 1) cashier reconciling reports be used with clearly supported
supporting documents (Z–reports, bottom portion of tax bills, and a listing by
denomination of cash to deposit and remaining in the cash register drawer) and 2)
daily deposit summary reconciling reports be compiled with supporting documents
including the cashier reconciling reports, GDS Distribution reports, E–check and
Credit Card reports from the company GDS, Remit reports, copies of deposit slips, the
bottom portion of taxpayer bills, and Oracle screen shots.
The supporting documents filed in the vault should include a daily GDS reconciliation
with all supporting documents, and daily Cashier reconciliations, with all supporting
documents.
5) Lack of Accountability when Assets are Transferred Between Employees– Cashiers and
Deposit Clerk
Criteria (Financial Accounting & Reporting pdf page 540)
TEA FASRG Financial Accounting & Reporting, Section 1.5.4.2 Cash, Procedural
Controls, states, “Controls over the collection, timely deposit and recording of
collections in the accounting records in each collection location.”
Condition
Related to the lack of marking on Tax Office records, there is a lack of accountability
as assets, cash and checks, are transferred from one employee to another. When
Cashier drawers are taken to be counted, there is no receipt given to the Cashier.
Effect
Because there is no written agreement between the providing and receiving employees
when cash is transferred from one to another, there is a distinct lack of an audit trail as
to when responsibility is transferred, and if funds are missing, who should be held
responsible.
28
Cause
Lack of internal control and documentation regarding the transfer of an asset, cash and
checks.
Recommendation
A Cashier and the Deposit Clerk should count the Cashier’s drawer together,
reconciling on one page the Z–Report, tax bills, and cash/check count. When these
three items are reconciled and both the Cashier and Deposit Clerk agree, then both
should sign or initial the reconciliation page indicating agreement and that the Z–
Report, tax bills, and cash/checks have been relinquished from the Cashier to the
Deposit Clerk.
6) No Receipts Between Employees – Deposit Clerk and Tax Clerk II and then Tax Clerk
III
Criteria (Financial Accounting & Reporting pdf page 540)
TEA FASRG Financial Accounting & Reporting, Section 1.5.4.2 Cash, Procedurals
Controls, states, “Controls over the collection, timely deposit and recording of
collections in the accounting records in each collection location.”
Condition
When the Deposit Clerk leaves cash and checks for first a Tax Clerk II to count and
then a Tax Clerk III to count, there are no receipts documenting the asset transfer nor
do two parties count the cash and checks together.
Effect
There is a break in the audit trail and subsequently a break in the transfer of
responsibility between employees. Accordingly, if cash or checks come up missing,
there is no audit trail to assign responsibility.
Cause
Lack of internal control and documentation regarding the transfer of an asset, cash and
checks.
Recommendation
When the Deposit Clerk transfers cash and checks to another employee, both should
count the funds together and sign one form indicating the transfer is complete and
agreed to by both.
7) Three Employees Counting Cash Four Times
Criteria
District policy DFBB, (Local), states a reason for a term contract nonrenewal is “3)
Incompetency or inefficiency in the performance of duties.”
29
Condition
As documented in Appendix Five, Tax Office Work Flow, three Tax Office
employees count the same cash and checks four times.
Effect
Counting cash and checks four times wastes time and makes the cash and checks more
susceptible to loss by being exposed more than is necessary.
Cause
Three employees count the same cash and checks four times.
Recommendation
There is no need for three Tax Office employees to count cash. When cash was stolen
last summer from Tax Office receipts, it occurred after the last count, which could still
happen regardless of how many people count the cash. Each Cashier should count his
drawer with the Deposit Clerk, reconciling the Z–Report, cash and checks, and tax
bills, with each signing the Cashier Reconciliation Sheet. The Deposit Clerk should
then summarize the three Cashier Reconciliation Sheets on a Summary Deposit
Reconciliation Sheet which would also include checks and tax bills mailed in. The
total then would be reconciled to the cash and check deposit slips. These
reconciliation sheets, deposit slips, and tax bills would then be forwarded to the
Accounting side of the Treasury Office for posting to GDS, as well as to the Business
Office official who performs the daily GDS reconciliation as described below.
The Summary Deposit Reconciliation Sheet total would then be included in a Total
Property Tax Reconciliation Sheet which would also include payments made by e–
check and credit cards and refunds as evidenced by Blue Slips. The total funds
received would be reconciled to GDS Distribution Statements and print screen shots of
the funds being recorded in Oracle. The three reconciliation sheets would be filed at
the Treasury and Accounting divisions of the Tax Office, and with the General Ledger
Accountant. The GL Accountant would reconcile daily total property tax revenue and
refunds with a daily GDS report indicating how much in property taxes was due the
District (beginning balance, adjustments due to property value change, less payments,
add refunds, ending balance). This reconciliation would also take into account and
document adjustments made by the Tax Services Director to specific taxpayer
accounts including adjustments to property valuation due to supplemental reports and
the writing off of past due property taxes.
8) Tax Collector’s Bond to be approved by the Board
Criteria
Pursuant to District policy CG (Legal), “The tax collector for the District shall be
bonded in accordance with law. Tax Code 6.29,” (CG (Legal) Bonded Employees
and Officers). Tax Code 6.29 states, “the bond must be made payable to and must be
approved by the governing body of the unit in an amount determined by the governing
body,” (Tax Code Chapter 6 pdf page 38).
30
Condition
The tax collector for the District, Denise Holmes, has a $50,000 bond for the 2014–
2015 school year (Tax Collector's bond); however, Holmes stated that the Board
approved neither the bond nor the amount. The tax collector is in violation of District
policy and State law.
Cause
Failure to obtain Board approval of the bond and its amount.
Recommendation
The Director of Tax Services should at each annual renewal of her bond, obtain Board
approval of it and the amount. Such approval should be recorded in Board minutes.
9) Cash Deposit Bags not used in Numerical Order
Criteria (Financial Accounting & Reporting pdf page 543)
TEA FASRG Financial Accounting & Reporting, Section 1.5.4.2 Cash, Procedural
Controls, #31includes, “Controls and physical safeguards surrounding working (petty
cash) funds.” Additionally, Section 1.5.3, Exhibit 46, the Internal Control Checklist,
includes the use of prenumbered forms for receiving reports, purchase orders, and
payroll checks. Section 1.5.4.2 includes the use of prenumbered receipts for the
receipt of cash. The use of prenumbered cash bags, as with various forms, is a time–
tested addition to internal control, alerting accounting personnel and management if
sensitive forms or cash bags are missing or duplicated, indicating either error, fraud, or
theft.
Condition
Prior to the theft of $20,774 from the Tax Office that occurred from November 2014
to May 2015, Tax Office personnel did not use numbered cash deposit bags in
consecutive order (151019 interview of Cooper, Figueroa, Santos, Powers).
Effect
By not using consecutive cash bags and thus accounting in a log for all cash bags, it
would not be noticed if a particular cash bag was missing. For example, it would be
possible for a taxpayer to pay $2,000 in property taxes, and then for that amount to be
placed into a cash bag, yet that particular bag not given to the courier service. Then
the taxpayer’s account could be adjusted to show that no cash was due. Later a Tax
Office employee could secrete the bag out of the office. Because the bag numbers
listed in the courier logbook kept in the Tax Office were not in consecutive order, a
missing bag would not be noticed. Accordingly, not using cash bags in consecutive
order decreases internal control.
Cause
Failure to implement internal control provided by the cash bag manufacturer.
31
Recommendation
As can be seen in Appendix II – Interim Tax Office Recommendations – Internal
Audit previously made recommendations including the use of cash bags in numerical
order. It was seen on February 8, 2016, by reviewing the last three Garda log book
pages, that the cash bags are now being used in order (160208 received from Powers
pdf pages 5–7).
10) No Point of Sale Receipt from either the Cash Registers or GDS
Criteria (Financial Accounting and Reporting, pdf page 542)
TEA FASRG Financial Accounting & Reporting Section 1.5.4.2, states “Receipts
controlled by cash register, prenumbered receipts or other equivalent means if
payments are made in person (over the counter).”
Condition
As documented in Appendix Five – Tax Office Work Flow, no point of sale receipt
from the cash registers is provided to taxpayers.
Effect
A person making payment to an organization is an integral part of the internal control.
By receiving a receipt issued by the cash register, management has some assurance
that the total amount indicated on the cash registers reports are the sum of the cash
register receipts provided to taxpayers. If a taxpayer receives an incorrect receipt, he
or she is likely to notify District management.
Cause
Cash register receipts are not issued to taxpayers. Instead, when cash payments are
received, each cashier has his or her own receipt book from which a receipt is given to
a taxpayer. The amounts from the receipt books are not recorded in any journal for
comparison to cash register totals. When checks are received over the counter, the
cash register is not rang up. “Paid” is stamped on the taxpayer’s bill. There is no
journal entry to record the immediate receipt of checks. Instead, checks are laid aside
for entry into GDS, but this may not happen until much later after the check has been
received.
Recommendation
Cash register receipts should be issued to taxpayers for the receipt of cash and checks.
Although taxpayers are currently given handwritten receipts for cash, such receipts are
not included in any daily journal and, accordingly, are not included in any daily
reconciliation. Additionally, no receipt is currently given for checks and,
consequently, no immediate record is kept of such receipt. Instead, tax bills are
stamped “paid.” Furthermore, even if handwritten or spreadsheet journals of cash and
checks were maintained, they would not automatically tie to the cash registers as are
cash register receipts.
32
11) Board to approve $500 Refunds, not Given Notice for $2,500 Refunds
Criteria (TX Property Tax Code 2015 Edition, Section 31.11)
Texas Property Tax Code states, “If a taxpayer applies to the tax collector of a taxing
unit for a refund of an overpayment or erroneous payment of taxes, the collector for
the unit determines that the payment was erroneous or excessive, and the auditor for
the unit agrees with the collector’s determination, the collector shall refund the amount
of the excessive or erroneous payment from available current tax collections or from
funds appropriated by the unit for making refunds. However, the collector may not
make the refund unless:
a) in the case of a collector who collects taxes for one taxing unit, the governing
body of the taxing unit also determines that the payment was erroneous or
excessive and approves the refund if the amount of the refund exceeds:
i. $5,000 for a refund to be paid by a county with a population of two
million or more; or
ii. $500 for a refund to be paid by any other taxing unit;
b) in the case of a collector who collects taxes for more than one taxing unit, the
governing body of the taxing unit that employs the collector also determines
that the payment was erroneous or excessive and approves the refund if the
amount of the refund exceeds:
i. $5,000 for a refund to be paid by a county with a population of two
million or more; or
ii. $2,500 for a refund to be paid by any other taxing unit
TEA FASRG Financial Accounting & Reporting, Section 1.5.4.4, #41, includes as a
Procedural Control “Formally approved write–offs or other reductions of receivables
by senior officials not involved in the collection function.”
Condition
The Director of Tax Services stated that per Board policy, the Board is notified when
refunds are $2,500 or more (160201 Denise Holmes Interview). When asked to
provide the policy, Holmes emailed, “I can’t find a policy about refunds of $2,500
either. The property tax code, Sec. 31.11, speaks of refunds of $500 for collectors that
collect for one taxing unit needing approval. It is my understanding that we use to take
refunds of $500 or more to the Board years ago, but there started to be so many that
the dollar amount was increased to $2,500 when Jerry Jones was tax assessor. We
have continued with that amount since that time. Mr. Jones was two assessors before
me and retired in 2005” (160301email from Denise Holmes re Board Refunds).
Effect
State law has been violated for over ten years providing insufficient information to the
Board of Trustees to enact their duties.
Cause
Failure to abide by State law.
33
Recommendation
Follow State law and obtain Board of Trustees approval, not just notification, for
refunds of $500 or more.
12) No Support Provided to the Business Office for Adjustments in Oracle of Levy
Adjustments
Criteria (Financial Accounting and Reporting, pdf page 551)
Financial Accounting & Reporting Section 1.5.4.4, Revenues and Receivables,
Procedural Controls, Billing Remittance Verification, Property Taxes, Accounts
Receivable Recordkeeping, #44, states, “Reconciling the aggregate collections on
accounts receivable against postings to individual receivable accounts.”
Condition
The General Ledger Accountant monthly adjusts the amount due from property taxes
based upon an unsupported number provided by the Tax Office (Barron).
Effect
Changes may be made by either GDS or Tax Office personnel to taxpayer accounts
without oversight or reconciliation by the Business Office.
Cause
No support is provided by the Tax Office to the Business Office to support such
changes to taxpayer accounts.
Recommendation
A list of taxpayer accounts adjusted should be provided to the Business Office so that
they can sample test the changes with DCAD data.
13) Failure to Conduct a Risk Assessment
Criteria (Financial Accounting and Reporting, pdf page 524)
Financial Accounting & Reporting Section 1.5.1, Internal Control – Defined, includes
Risk Assessment as one of five interrelated components. Section 1.5.2 includes the
following definition:
Risk assessment is defined as the “entity’s identification, analysis, and management of
risks” relevant to the preparation of GAAP financial statements.
Risks can arise or change as a result of the following factors:
• Changes in operating environment
• New personnel
• New or revamped information systems
• Rapid growth
• New technology
34
New grant activities, building projects and other activities
• Organizational restructuring
• Accounting pronouncements
• Federal regulations
• School finance statutes
Condition
No Risk Assessment has been done by the Tax Office (160330 Denise Holmes).
Effect
A credible Risk Assessment leads to the design and use of credible Control Activities.
Cause
The Tax office is not following guidance per the Texas Education Agency’s Financial
Accountability System Resource Guide.
Recommendation
Conduct a Risk Assessment for approval by the Business Department, with
corresponding Control Activities, Information and Communications Systems, and
Business Department monitoring.
Business Department
14) Lack of Management Monitoring
Criteria (Financial Accounting and Reporting, pdf page 530–551)
TEA FASRG Financial Accounting & Reporting Section 1.5.2.3, Reconciliations and
Comparison of Assets with Records, states, “The purpose of reconciliations and
comparisons of assets with records is to ensure that independent checks cover the
output of a system, either by maintenance of a separate independent control record
with which the processed data are reconciled or by direct comparison of the output
with the related assets. Monitoring is usually accomplished by reviewing
reconciliations or by participating in comparisons of assets. Examples of
reconciliations of assets with records are reconciliation of physical inventory to
accounting records and reconciliation of bank balance to general ledger balance.”
Section 1.5.4.2, #39, includes as a Procedural Control, “Review and approval of all
reconciliations and investigation of unusual reconciling items by an official who is not
responsible for receipts and disbursements, including recording evidence of the review
and approval by signing the reconciliation.”
Furthermore, Section 1.5.4.4, #39, Revenues and Receivables, also includes as a
Procedural Control, “Monitoring taxes and fees collected by another unit of
government to assure timely receipt and subjecting amounts received to reviews for
reasonableness,” and #44, “Reconciling the aggregate collections on accounts
receivable against postings to individual receivable accounts.”
35
Condition
Nobody at the Business Office has access to GDS. Although daily GDS reports are
sent to the General Leger Accountant and an Accounting Specialist (who does the Tax
Office bank reconciliation) weekly, when asked if they do anything with them, the
reply was, “Not really, they get and keep them,” (Barron & Pate). The Accounting
Specialist said the daily GDS reports are “helpful to balance the Tax Office bank
account,” (160223 Alsabrook). At the beginning of the school year, the general and
debt service funds, Current Property Tax Levy accounts are debited and the related
Deferred Revenue Taxes Accounts credited ( Oracle beginning tax receivable entry).
No supporting documentation for Deferred Revenue Taxes is maintained; it is only a
balancing account.
At each month’s end, the General Ledger Accountant makes a forced entry in Oracle
to adjust the General and Debt Funds Property Taxes Current and Delinquent Funds to
the amounts shown on the monthly Tax Office Report provided to the Tax Office, as
supported by GDS (T account analysis of Jan 16 Tax Office entries sheet one). The
focus is on ensuring that the property tax receivable accounts, for both the general and
debt funds, current and delinquent accounts, ties to the GDS amounts. The offsetting
entries are to the related Deferred Revenue Taxes accounts (160321 pm Barron).
There are no supporting documents for the Deferred Revenue Taxes accounts (160321
Barron interview). The monthly adjustments to the Current and Delinquent Tax Levy
as shown in the monthly Tax Collection Reports presented to the Board are not
reviewed by the Business Office (160321 pm Baron interview pdf page 6). The
General Ledger Accountant stated that the Business Office does not monitor GDS
(160223 Barron).
The Tax Office monthly provides a spreadsheet including the certified taxable
valuation in July, and then supplemental valuations each month thereafter to the
Deputy Superintendent of Business. However, the reasons for increases and decreases
in such valuations are not reviewed (160330 Denise Holmes).
Effect
The Tax Office has no oversight by the Business Department.
Cause
The Business Department does not monitor taxes receivable, write–offs, payments,
and valuation changes.
Recommendation
No one was found to monitor the adjustments made by the Director of Tax Services or
the Tax Clerk III, both of whom have said they are able to make any adjustments to
taxpayer accounts. While write–offs of past due accounts of $500 were to have been
approved by the Board of Trustees, there is no administration monitoring that this
actually occurs (160223 Baron). In fact, the Director of Tax Services has only been
submitting write–offs of past due accounts of $2,500 or more in violation of State law.
36
Additionally, there is no monitoring of the necessity of any adjustments. Finally, no
evidence was seen that taxpayer accounts are reconciled monthly, with the total from
the beginning of month “A” compared to the beginning of month “B,” with revenue
totals as evidenced by deposits added, and decreases owed because of supplementary
reports, including “ceilings” and added exemptions included. Put simply, it is possible
for the Director of Tax Services or Tax Clerk III to write–down taxpayer account
balances without any oversight or knowledge of the administration. The Business
Department should exert oversight of the Tax Office.
15) Not Using a Source Document with which to Reconcile
Criteria (AU–00326 Audit Evidence)
“Appropriateness is the measure of the quality of audit evidence, that is, its relevance
and its reliability in providing support for, or detecting misstatements in, the classes of
transactions, account balances, and disclosures and related assertions. The auditor
should consider the sufficiency and appropriateness of audit evidence to be obtained
when assessing risks and designing further audit procedures. The quantity of audit
evidence needed is affected by the risk of misstatement (the greater the risk, the more
audit evidence is likely to be required) and also by the quality of such audit evidence
(the higher the quality, the less the audit evidence that may be required). Accordingly,
the sufficiency and appropriateness of audit evidence are interrelated.”
Condition
The Business Office’s General Ledger Accountant monthly reconciled Oracle entries
provided by the Tax Office to a Tax Office generated spreadsheet of taxes collected.
Although the General Ledger Accountant was not actively monitoring or auditing the
Tax Office, even the act of reconciling Oracle, the District’s books, should involve
using the best and most relevant evidence available, which in this instance is the Tax
Office’s software records, GDS, and not rely entirely on a Tax Office generated
spreadsheet.
Effect
Although the General Ledger Accountant had access to GDS reports and could have
reconciled to them, he reconciled to evidence that was not as relevant, a report
prepared by the Director of Tax Services. This meant that if the Tax Office report was
in error or fraudulently prepared, the General Ledger Accountant would have
perpetuated the error or fraud.
Cause
Failure to reconcile using the best and most relevant evidence available.
Recommendation
The recommendation by IA was made during the audit that the General Ledger
Accountant reconcile Oracle to GDS reports and not rely entirely on the Tax Office
37
spreadsheet. The General Ledger Accountant made this change during the audit.
(Barron)
16) Lack of Bank Reconciliations
Criteria (Financial Accounting and Reporting, pdf page 530–551)
TEA FASRG Financial Accounting & Reporting Section 1.5.2.3, Reconciliations and
Comparison of Assets with Records, states, “The purpose of reconciliations and
comparisons of assets with records is to ensure that independent checks cover the
output of a system, either by maintenance of a separate independent control record
with which the processed data are reconciled or by direct comparison of the output
with the related assets. Monitoring is usually accomplished by reviewing
reconciliations or by participating in comparisons of assets. Examples of
reconciliations of assets with records are reconciliation of physical inventory to
accounting records and reconciliation of bank balance to general ledger balance.”
Condition
The Bank of America account used by the District’s Tax Office was not reconciled
from November 2014 until July 2015 (Alsabrook interview). During this time, eight
Tax Office bank deposits were short of cash totaling $20,774 (people who participated
in deposits).
Effect
The first theft was followed by seven more, occurring over nine months, without
detection by the Business Department because the bank reconciliations were not
completed.
Cause
Bank accounts were not timely reconciled by the Business Department.
Recommendation
Bank reconciliations should be prepared in a timely manner. Per the Director of
Finance, this has been corrected, and bank reconciliations are being timely done.
Additionally, per the Board’s direction, IA is conducting quarterly performance audits
in 2016 regarding bank reconciliations.
17) No DCAD Appraisal Review Board Monitoring and Challenges
Criteria (TX Property Tax Code pdf page 248)
Texas Property Tax Code Section 41.03, Challenge by Taxing Unit states:
(a) A taxing unit is entitled to challenge before the appraisal review board:
(1) the level of appraisals of any category of property in the district or in any
territory in the district, but not the appraised value of a single taxpayer’s
property;
(2) an exclusion of property from the appraisal records;
(3) a grant in whole or in part of a partial exemption;
38
(4) a determination that land qualifies for appraisal as provided by Subchapter C,
D, E, or H, Chapter 23; or
(5) failure to identify the taxing unit as one in which a particular property is
taxable.
(b) If a taxing unit challenges a determination that land qualifies for appraisal under
Subchapter H, Chapter 23, on the ground that the land is not located in an aesthetic
management zone, critical wildlife habitat zone, or streamside management zone, the
taxing unit must first seek a determination letter from the director of the Texas Forest
Service.
Additionally, the fifth component of TEA mandated Internal Control activities is
Monitoring Activities (Appendix Thirteen, page 55).
Condition
No Business Department or Tax Department employee was found to monitor DCAD
Appraisal Review Board decisions as they relate to the District. Additionally, the
Director of Tax Services does not recall the District ever challenging a decision of the
DCAD Appraisal Review Board (60301 Denise Holmes interview).
Effect
Such ARB decisions may adversely affect the District’s tax base.
Cause
Lack of active monitoring.
Recommendation
A Business Department employee should be assigned the task of monitoring ARB
decisions and periodically reporting on same to the Deputy Superintendent of
Business, the Superintendent, and the Board, so an understanding is gained as to the
affect such decisions have on the District’s tax base and, if appropriate, to mount a
challenge.
Technology Department
(Note: both of the Technology Department findings were corrected during the course
of the audit)
18) No Off–Site Backup
Criteria (Financial Accounting and Reporting, pdf page 571)
Section 1.5.4.8, Information Technology, Procedural Controls, includes “Procedures
to protect against a loss of important files, programs or equipment.”
Condition
The production servers on which the District’s taxpayers account data are maintained
are only approximately ten feet from the server on which the data was daily backed
up. The data was not being saved off site.
39
Effect
If there was a fire, flood, explosion, tornado, or earthquake at the Dr. Marvin D.
Roden Technology Center, there would have been the possibility of the District’s
taxpayer data being lost, putting at risk millions of dollars of revenue (McGuire,
Network Engineer interview).
Cause
Lack of off–site backup of taxpayer account data.
Recommendation
Internal Audit made the recommendation when the issue was discovered and it was
corrected during the course of the audit. The server on which taxpayer data is stored is
now backed up on site for 35 days and also a tape is sent off–site which includes
taxpayer accounts, which is saved for seven days (email from McGuire weekly
backups being sent offsite).
19) Lack of Friday Backup until Monday
Criteria: (Financial Accounting and Reporting, pdf page 571)
Section 1.5.4.8, Information Technology, Procedural Controls, includes “Procedures
to protect against a loss of important files, programs or equipment.”
Condition
Although a daily backup was conducted on the District’s taxpayer accounts, it was set
for Monday through Friday, at 1:30 a.m. This meant that the work done on Fridays
was no backed up until early Monday morning.
Effect
This placed Tax Office work at risk of being lost over a period of three days, instead
of one.
Cause
Friday’s backup did not occur until after Saturday and Sunday.
Recommendation
This was changed during the audit so that the daily backups would occur on Saturday
mornings as well. (McGuire, Network Engineer interview). The in–house backup is
saved for 35 days. (160204 from McGuire regarding backups).
Observation
Tax Office Employee Placed on Administrative Leave after Theft Still has Access to GDS
As can be seen in Appendix 10 (page 44), a Tax Office employee, placed on administrative
leave since late last year because he/she was the last employee to handle District tax receipts
before they went missing, as of February 18, 2016, still had access to GDS, including the
40
ability to make adjustments and record refunds (160223 GDS Tax User Listing from Denise
Holmes pdf page 9).
41
Appendix Five – Management’s Response to Original Findings
42
43
44
45
Appendix Six – Request for Management Response
