Loading...
HomeMy WebLinkAbout2016-01 Performance Audit Report: Cash Handling at County of Hawai'i's Department of Parks and RecreationCash Handling at County of HawaiTs Department of Parks and Recreation Report No. 2016-01 June 30, 2016 Office of the Legislative Auditor County of Hawaii Dru Mamo Kanuha Chair & Presiding Officer Council District 7 June 30, 2016 JNt'�'oF' .,q O . • ,9 grF�nc'na.P %LAIUUN of Pabial"i Bonnie S. Nims, CGAP Legislative Auditor Business Address 1266 Kamehameha Avenue Suite A-8 Hilo, Hawai `i 96720 OFFICE OF THE LEGISLATIVE AUDITOR 25 Aupuni Street Hilo, Hawaii 96720 * (808) 961-8386 * Fax (808) 961-8905 website: hup://HawaVicounty.Qov e-mail: publiclao(aco.Hawai'i.hi.us The Honorable Dru Kanuha, Council Chairperson and Members of the Hawaii County Council Hawaii County Council 25 Aupuni Street Hilo, Hawaii 96720 Dear Chair Kanuha and Council Members, In accordance with Hawaii County Charter Section 3-18(d)(2), attached is the Office of the Legislative Auditor's report of our audit of cash handling of facility use permits at the Department of Parks and Recreation (P&R) Administration. The purpose of the audit was to determine whether P&R implemented internal controls over facility use permits to prevent, detect, and deter fraudulent transactions. We evaluated if these internal controls followed best practices. In addition, we determined if P&R's facility -use permits cash receipts were deposited timely and intact. The County's P&R facility use permits cash handling process lacks significant internal controls including adequate segregation of incompatible duties, independent review and monitoring, complete and accurate written policies and procedures, and adequate safeguarding of cash receipts. Due to these internal control weaknesses, as well as individual errors in the processing of transactions, our audit could not determine if all cash received was deposited. If you need any further information, please let me know. We would like to thank the Department of Parks and Recreation staff for their assistance and cooperation during this audit. We greatly appreciate all of their valuable time and efforts spent on providing us information. Respectfully, Bonnie S. Nims, CGAP Legislative Auditor cc: William P. Kenoi, Mayor Stewart Maeda, County Clerk Randy Kurohara, Managing Director Clayton Honma, Director of Parks and Recreation Deanna Sako, Finance Director In Brief Background 7 The County of Hawaii Department of Parks and Recreation's (P&R) maintains facilities throughout the island for events such as parties, luaus, reunions, graduations, concerts, etc. The public can rent these facilities for a security deposit and a user fee. Three offices maintain the reservation books including the Kona Permit Office, Hilo Main Office Administration, and the Recreation Division. In fiscal year 2014-2015, facility use permit revenue totaled $176,000 for the Hilo Administration, Kona Permit Office, and the Recreation Division. We reviewed 138 facility use permits from July through September 2015 at the Hilo and Kona locations. The Kona Imin facility was closed during this time for accessibility improvements; we therefore expanded our initial audit testing of the Kona facility use permits to include an additional nine transactions totaling $3,675 from June 2015. Why we did this audit This performance audit was undertaken to evaluate if the program's internal controls were adequate to reduce the risk of fraud and mishandling of facility use permit revenue and to identify potential areas for improvement. The audit also looked at facility use permit transactions to see if receipts were deposited timely and intact. We initiated the audit, as we believe cash receipts are an inherently high-risk process. What we found The County of Hawai`i's Department of Parks and Recreation's (P&R) facility use permits cash handling process lacks significant internal controls including adequate segregation of incompatible duties, independent review and monitoring, complete and accurate written policies and procedures, and adequate safeguarding of cash receipts. Due to these internal control weaknesses, as well as individual errors in the processing of transactions, our audit could not determine if all cash received was deposited. Management has generally agreed with the comments and recommendations in this report. Their complete response to this audit can be found on page 20: Management Comments. What we recommended The recommendations identify improvements for management to increase internal controls for facility use permits cash handling. Our audit report offers recommendations designed to address these issues through: • Segregate incompatible duties among those who perform accounting procedures or control activities and those who handle cash. • Implementing adequate ongoing monitoring of the design and operating effectiveness of the internal control system over cash receipting activities to ensure that revenue is complete. • Updating, strengthening, and enforcing cash handling policies and procedures according to best practices; and • Providing initial and on-going cash handling and internal controls training for all employees who handle revenue. These recommendations should be considered for all cash receipting locations. This page intentionally left blank. Table of Contents Introduction...............................................................................................................................1 Background...............................................................................................................................2 AuditObjectives........................................................................................................................4 AuditScope and Methodology.................................................................................................4 Commendations & Noteworthy Accomplishments.................................................................5 AuditResults.............................................................................................................................6 Internal controls over facility use cash receipts are inadequate to prevent, detect, or deter fraudulent transactions...................................................................................6 Segregation of duties is inadequate.....................................................................7 Independent monitoring is insufficient..................................................................8 Written policies and procedures are incomplete, insufficiently detailed, and not consistently followed............................................................................................9 Inadequate safeguarding of cash receipts at the Hilo Main Office......................13 We were unable to determine if revenue is complete...............................................14 Numerous miscellaneous errors were identified.................................................14 Deposits were not always made or posted timely...............................................16 Pre -numbered facility use permits were not used...............................................16 Cash over/short was not recorded.....................................................................17 Recommendations..................................................................................................................18 Management's Comments......................................................................................................20 AppendixA — Audit Criteria....................................................................................................22 This page intentionally left blank. Introduction The Office of the Legislative Auditor conducted this performance audit of County of Hawai`i's Department of Parks and Recreation's (P&R) cash handling process pursuant to Section 3-18 of the Hawaii County Charter, which outlines the Office of the Legislative Auditor's primary duties. Performance audits typically examine the effectiveness, economy, or efficiency of a government program. They can include analyzing the services of an entire department or activity, identifying possible cost savings, identifying the outcomes achieved by a program, or comparing actual department practices against the practices called for in law or policy. Our objective in performance auditing is to improve public services provided by county government. We do this by recommending specific actions that will address the issues we raise and by providing valuable information to the public, the administration, program leadership, the Hawai'i County Council, and the Mayor. A performance audit of the P&R's cash handling process was included in the fiscal year 2015- 2016 annual audit plan based on the results of our countywide risk assessment. There are inherent risks associated with the implementation of the cash handling processes. If no internal controls exist, or if they exist but are not enforced, the risks related to the process increases, thereby increasing the risk exposure to the County. On a national level, employee misappropriation of cash is the most common fraud. According to the Association of Certified Fraud Examiners' (ACFE) 2014 Report to the Nations on Occupational Fraud and Abuse, organizations lose five percent of revenues to fraud each year.' "The most common employee occupational frauds of misappropriation of cash include: check tampering, revenue skimming, fraudulent disbursements by fake invoicing, payroll schemes, and billing scams."' The Office of the Legislative Auditor determined that a thorough examination of facility use permits cash handling policies, procedures, and processes was warranted. 1 The Cost of FRAUD (Association of Certified Fraud Examiners, Inc., 2014) https://www.acfe.com/rttn/images/cost-of-fraud-infographic.pdf Z Guarding Against Internal Frauds Committed by Employees (BizFilings, Business Owner's Toolkit, Deterring Fraud) http://www.bizfilings.com/toolkit/sbg/run-a-business/fraud/guarding-against-internal-frauds-by-employees.aspx Cash Handling for Facility Use Permits: Introduction I 1 Background What is a facility use permit? The County maintains facilities throughout the island for events such as parties, luaus, reunions, graduations, concerts, etc. The public can rent these facilities for a security deposit and a user fee. Permit fees may be waived for some events such as for other government agencies, student sports activities, and events open to the public. Reservations can either be made over the counter or mailed in advance along with payment if they are not able to come into the office. However, mailed payments will not guarantee a reservation until the payment is received and availability is confirmed. If structures, tents, or canopies are used then a temporary structure permit is required. No internet reservation system is currently available for facility use permits. Methods of payment include cash, money order or cashier's check, or personal checks. Personal checks are only accepted if payment is made at least 14 days prior to the reservation date and payable to the County Director of Finance. Credit cards are now accepted for facility use permits at both the Hilo office (May 2016) and Kona office (June 2016). How much is a facility use permit? Permit cost varies by location. Security deposits range from $200 to $1,000. Facility's rental fees are: Location Fee Per Day Bay front $50-$400 Park $50-$400 Gymnasium $50-$1,000 Bandstand $100-$400 Community Centers $100 - $1,000 Kailua Park Runways South $100 - $500 Kailua Park Runways North $200 - $1,000 Where are facility use permits collected? There are three offices that maintain reservation books and collect fees for facility use permits including the Hilo Main Office Administration, the Kona Permit Office, and the Recreation Division. The Recreation Division maintains the reservations for all the gyms and parks located throughout the island. The Hilo Main Office and Kona Permit Office maintain reservations as follows: Cash Handling for Facility Use Permits : Audit Background 12 Hilo Main Office Administration • Bayfront Parking Lot 1 & 2 • Bayfront Canoe Area • Coconut Island • Honolii • Issac Hale Kona Permit Office • Kona Imin Center • Old Kona Airport Runway North and South • Kalakaua Park • Liliuokalani Gardens/Isles • Mooheau Park Bandstand • Mooheau Concession Area How much money did the Department of Parks and Recreation receive last fiscal year for facility use permits? In fiscal year 2014-2015, facility use permit revenue totaled approximately $176,000. Total revenue for the Department of Parks and Recreation was approximately $1,325,000 (excluding golf green fees). Cash Handling for Facility Use Permits : Audit Background 13 Audit Objectives The Office of the Legislative Auditor's fiscal year 2015-2016 annual audit plan included a performance audit of the County of Hawai`i's Department of Parks and Recreation (P&R) cash handling process. The objectives of the audit were to evaluate if internal controls over facilities use permits at the Hilo Main Office Administration and the Kona Permit Office are preventing, detecting and deterring fraudulent transactions, whether these internal controls are following best practices, and if receipts are deposited timely and intact. Audit Scope and Methodology To accomplish our objectives, we: • Developed an understanding of the policies, procedures, processes, and document flows • Compared Hilo and Kona office's facility use permit cash handling procedures, practices, and performance measures with recommended industry best practices; • Assessed compliance with P&R's facility use permit policies and procedures, County of Hawai'i Code, County of Hawai'i Charter and State of Hawai'i Revised Statues; • Analyzed facility use permit data by comparing data extracted from the County of Hawai`i's Eden FRESH accounting system with Hilo and Kona's facility use permit supporting documents; • Corroborated information through interviews with appropriate personnel, reviewing documentation and performing test of documentation and controls; and • Reviewed additional documentation (i.e., user fee bookings, daily deposit records, courier service tickets, treasury receipts, etc.) as needed. During the course of our audit, we reviewed current internal controls procedures as well as facility use permits for the Hilo and Kona offices from July 2015 through September 2015; the Recreation Office was not included in our audit scope. The Kona Imin facility was closed due to accessibility improvements from August 3 through November 30, 2015; we therefore expanded testing at the Kona office to include June 2015. We conducted this audit in accordance with Generally Accepted Government Auditing Standards (GAGAS), except for the standard requiring an external peer review be obtained every three years. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Our conclusions on the effectiveness of these controls are detailed within this report. Cash Handling for Facility Use Permits : Audit Objectives, Scope & Methodology 14 We thank the Department of Parks and Recreation staff for their assistance and cooperation during this audit. Management generally agreed with the comments and recommendations in this report. Their complete response to this audit can be found on page 20: Management Comments. Commendations & Noteworthy Accomplishments We are pleased to report that the Department of Parks and Recreation (P&R) has taken a proactive role in strengthening certain controls we identified as weaknesses during the course of the audit. Additionally, we appreciate the cooperation exhibited by P&R and its willingness to implement many of our recommendations. For instance, P&R has asserted they have already: • established procedures to include a more proactive supervisory review process; • improved timeliness of check endorsement and revenue reconciliations; • conducted surprise cash counts; and • developed and implemented a daily log database to help improve timeliness, accuracy and oversight of cash handling. We will follow up at the appropriate time to determine whether and to what extent all recommendations have been implemented. Cash Handling for Facility Use Permits : Audit Objectives, Scope & Methodology 15 Audit Results Internal controls over facility use cash receipts are inadequate to prevent, detect, or deter fraudulent transactions. Internal controls are broadly defined as a process effected by management. They are designed to provide reasonable assurance on the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. Internal controls can help achieve performance targets and prevent loss of resources. An organization's internal control structure over cash handling operations should include the following elements: • Segregation of Incompatible Duties. Duties should be segregated amongst employees so that errors and irregularities made by one employee are difficult to conceal. • Independent Review and Monitoring. Management should document their review and approval of critical tasks performed by employees. They should not review and approve their own work. • Written Policies and Procedures. Policies & procedures should be approved by management, cover all aspects of operations, be sufficiently detailed, and be distributed to staff. In addition, ongoing monitoring is necessary to ensure policies and procedures, and internal control, remain effective and efficient as operations change. • Physical Safeguarding of Assets. Assets should be physically protected from loss and unauthorized use. The Department of Finance's Accounting Manual requires each County department to establish internal controls to ensure cash is safeguarded, accounted for, and properly recorded. Our audit evaluated these internal controls of Department of Parks and Recreation's (P&R) facilities cash receipts. We found that these internal controls are generally inadequate and not operating according to best practice to prevent, detect, or deter fraudulent transactions. (Figure 1) As a result, errors and irregularities may go undetected by employees performing their normal assigned duties. Summary of Internal Controls by Location Best Practice Kona Hilo Segregation of Duties No No Independent Monitoring No No Written Policies and Procedures No No Safeguarding Assets: Physical security of cash receipts Yes Timely deposits/reporting No Figure 1 Cash Handling for Facility Use Permits : Audit Results 16 Segregation of duties is inadequate Segregation of duties is a key internal control and its primary objective is to minimize the risk or occurrence of errors or fraud by ensuring that no one employee has the ability to both commit and/or conceal errors or fraud in the normal course of their duties. Generally, the primary incompatible duties that should be segregated are: • Authorization or approval • Custody of assets • Recording transactions • Reconciliation/Control Activity To achieve the highest level of internal control over the cash handling process, a different person should be involved in billing/recording, collecting, authorization or approval, and reconciling functions. Some examples of incompatible duties are: • An employee who opens the mail and endorses checks should not handle cash receipts. • An employee who prepares a document should not approve that same document. • An employee who handles cash receipts should not maintain the change fund and receive deposit slips or corrections from the bank (returned checks). • An employee who prepares bank deposits/treasury receipts should not receive deposit slips or corrections from the bank/treasury, verify cash receipts, maintain the change fund, and perform the audit function. Incompatible duties should be segregated so no one employee has complete control over the cash handling process. When duties cannot be sufficiently segregated due to the small size of a department or division, it is important that mitigating controls, such as a detailed supervisory review and monitoring of the activities be put in place to reduce risks. We examined the cash receipt handling processes at both the Hilo Main Office (Hilo) and the Kona Permit Office (Kona) and found that proper segregation of duties for cash handling and processing was not in place. Currently, the Clerk is responsible for the entire cash handling process from start to finish, with little or no review by management. Specifically, the Clerk accepts payments, creates and issues permits (receipts), enters transactions into the daily deposit record, prepares deposit slips, and makes deposits for the facility use permits. In addition, the Clerk reconciles the deposit to the treasury receipt. Management has not established or performed any compensating controls to help mitigate this risk. Cash Handling for Facility Use Permits: Audit Results 17 This situation has resulted from supervisors not receiving training to identify incompatible duties or to implement compensating controls. As a result, inadequate segregation of duties could make fraud detection difficult and management may not timely detect and correct errors and irregularities during the normal course of business. Independent monitoring is insufficient When processing a facility use permit, the Clerk performs all the cash receipting functions from start to finish and has access to the cash receipts. (See above for more detail on segregation of duties.) When duties cannot be segregated, compensating controls should be considered. Compensating controls can be preventative, detective, or monitoring activities. An independent, supervisory -level employee who does not have custody, record keeping, authorization, or reconciliation responsibilities for the process should perform these duties. Because of insufficient training, there were many problems that went undetected and therefore, work was not reviewed for completeness and accuracy. Specifically, we observed the following: Management at the Department of Parks and Recreation should perform additional monitoring of cash handling to ensure all revenue is complete and timely. • Cash receipts are not reviewed or monitored by an independent person. Since duties are not adequately segregated, this review is imperative to ensure all revenue is collected and deposited in a timely manner. • There is no review or approval of voided or waived permit transactions. The Clerks review their own work and revise any errors before printing out the permits. No justification or independent approval was provided for voids or waived fees. • Surprise cash counts are not performed at the Hilo office. The Clerk was the only person performing the initial and end of day cash count to reconcile to the $100 authorized balance. At Kona, non -surprise cash counts were performed before and after the clerk goes on vacation and some unannounced counts are performed. • There is no independent review of the general ledger revenue reconciliations performed by the accountant at Hilo. Currently, the accountant is the only employee that reconciles and reviews revenue posted on the treasury receipts to the accounting system. As a result, errors may not be detected timely. The supervisor was unaware that the accountant was reconciling the current month's entries one to two months after closing. If adjustments were needed; they would not be posted in the current period, if at all. • The accountant at Hilo does not perform a complete reconciliation of the revenue general ledger. Only Hilo's and Kona's revenue are reconciled. Entries posted to the account by the Recreation Division are not included in the reconciliation. As a result, the Recreation Division's accounts were included in the facility use permit revenue account. Cash Handling for Facility Use Permits: Audit Results 18 At the time of our audit, the Hilo office was taking corrective measures with the Department of Finance to create a separate general ledger account to move Hilo's facility use permit revenue to a separate account. • There is no review for consecutiveness or completeness of permit numbers. The Clerks at both Hilo and Kona use a computer template to complete the permit and assign a permit number. Controlling and reviewing pre -numbered and carbon copied receipts helps deter and detect potential theft of cash receipts. Monitoring is an integral component of internal controls; unmonitored controls tend to deteriorate over time. When monitoring is designed and implemented appropriately, organizations are more likely to identify and correct problems on a timely basis. Ongoing monitoring can occur in the course of daily operations including regular management and supervisory activities including comparisons, reconciliations, and other routine actions. There should always be another level of review and approval performed by a knowledgeable person independent of the process. A thorough review of the processes will help with accuracy, completeness, and timeliness. The reviewer should be someone who is knowledgeable in daily operations, has the authority to make decisions, someone who does not perform the process and document evidence of review by a signature or initials and date. Written policies and procedures are incomplete, insufficiently detailed, and not consistently followed The Government Finance Officers Association (GFOA) establishes best practices including written policies and procedures that are reviewed on an annual basis. The development of written departmental policies and procedures are an effective way to maintain a strong system of internal controls. Policies and procedures should clearly delineate the control activities performed throughout various business processes. This will aid in the orientation of new employees, help ensure business continuity in the event of turnover, and help ensure compliance with applicable laws and regulations. At the County of Hawaii, each department and agency is responsible for creating and maintaining their own policies and procedures by using the Department of Finance's Accounting Manual as a basis for establishing an adequate system of internal controls. The Department of Parks and Recreation created cash receipting policies and procedures in 2002 and then updated them on August 13, 2015. However, P&R management did not Department policies and procedures should be clarified so employees are not subject to risk. have on-going and continuous monitoring of their policies and procedures in order to remain effective and efficient as operations change. As a result, the current cash receipting policies and procedures do not provide adequate guidance to P&R staff. Cash Handling for Facility Use Permits: Audit Results 19 We compared P&R's cash receipting policies and procedures, as well as current practices, to expected control procedures and found several deficiencies. (Figure 2) Comparison of industry best practices to the Department of Park and Recreation's policies and procedures Were Policies & Actual Practice Expected Practice Procedures Complete? Performed? Hilo Kona Hilo Kona Independent review and monitoring Segregation of duties Timely deposit of receipts (within 24 Insufficient hours of receipt) Timely reconciliation to applicable ledgers Physical security procedures Insufficient Insufficient Permit numbers being consecutive Insufficient Insufficient and pre -numbered (including voids) Account for cash as it is received Insufficient Insufficient (Timely recognition of revenue) Checks endorsed immediately Insufficient Reconciliation of total checks and Insufficient Insufficient cash Fraud reporting Figure 2 Policies were incomplete We compared the P&R written policies and procedures to industry best practices and identified several deficiencies: Independent review and monitoring. Existing procedures do not require any independent review during the cash handling process. Policies and procedures should require a thorough review performed by an independent person to ensure accuracy, completeness, and timeliness. Segregation of duties. Existing procedures do not address separating any of the cash collection, depositing, or cash reconciliation functions. Policies and procedures should require that a different person be involved in recording, collecting, authorization, and reconciling functions. Cash Handling for Facility Use Permits: Audit Results 110 • Timely deposit of receipts. In Hilo, there are no written procedures that address timely deposits, or even how to perform a deposit. Two of the eight deposits tested (25%), were deposited two days after the revenue was receipted. As discussed below, Kona's procedures are insufficient and not followed. Policies and procedures should require that all funds be deposited within 24 hours of receipt. • Timely reconciliation to applicable ledgers. Existing procedures do not address timely reconciliation of revenue to the general ledger. Policies and procedures should require that reconciliations performed timely to ensure proper adjustments are made in the correct period. • Checks endorsed immediately. Kona's procedures require restrictive endorsement of checks at the end of day. Hilo's policies do not address restrictive endorsement of checks. Policies and procedures should require check endorsement immediately upon receipt. • Fraud reporting procedures. Existing procedures do not address fraud reporting. Policies and procedures should require a fraud reporting process to aid in the detection and prevention of fraud. By providing fraud reporting procedures, everyone within the organization will be aware of the fraud risk policy including types of fraud and the consequences associated with them. Those who are planning to commit fraud will know that management is watching and may be deterred by this. Honest employees who are not tempted to commit fraud will also be made aware of possible signs of fraud or theft and how to report any concerns. Policies were insufficient and not consistently followed We also identified policies and procedures that were not sufficiently detailed and not followed: • Timely deposit of receipts. In Kona, end of day procedures state that the deposit is taken to the bank during banking hours or a night deposit. Procedures should be updated to the current practice of using a courier and require that all funds be deposited within 24 hours of receipt. Physical security procedures. Kona's end of day procedures requires locking up cash. The cash is locked in a desk drawer and the permits are locked in a separate file cabinet. The procedures should be clarified to ensure cash is secured at all times, not only at the end of the day. Hilo's procedures state: "(c)lip payment to our permit copy, place in purple folder, and lock in drawer." The Clerk puts both the payments and the permits in the same unlocked drawer. The procedures should require that the payments and permits be locked and adequately secured in separate drawers. Permit numbers being consecutive and pre -numbered, including voids. Current policy at both Hilo and Kona requires the completion of a facility use permit and require permit numbers to be consecutive including voids. However, neither policy Cash Handling for Facility Use Permits: Audit Results 111 indicates that the permit must be the pre -numbered carbon copy permit distributed by the Department of Finance. Currently, the Clerks at Hilo and Kona create a manual permit using a computer template, assigns the permit a number, and then prints out copies for all parties. As a result, in Hilo, there was an error of 90 "missing" waived inter -departmental permits. These permits were listed on the deposit record but no documentation to verify that the permits existed, were waived, or were voids To ensure that all funds received were receipted and deposited, procedures should require using pre -numbered receipts and an independent review of consecutiveness. Account for cash as it is received. Both Hilo and Kona's current policy require logging permit information and totaling the amount collected in the daily deposit and at the end of day. In Hilo, there were two instances where permits were completed and checks were collected, but they were not recorded or deposited until the next day. Procedures should require accounting for cash upon receipt to eliminate the risk of errors or theft. Reconciliation of total checks and cash. Both Hilo and Kona's current policy require reconciliation of cash and check totals. In Hilo, check and cash breakdown is not verified, only the total from the deposit is reconciled with the treasury receipt total. In Kona, cash and check composition is not verified and copies of checks are not sent to the Hilo office with the permit documents to verify that the cash and check composition is accurate. Procedures should clarify the process of reconciling the cash and check composition on the log to the actual deposit/bank processed deposit slip. There were 10 instances at Kona where check copies were not provided. We were unable to determine when the check was written, the cash and check composition, and if the check was written to the County Director of Finance. Verifying cash and check composition is important to complete the deposit reconciliation and detect fraud. By identifying gaps in policies and procedures, management can identify where effective controls needed to be placed, where to provide sufficient detail for new and existing procedures and to clarify unclear procedures so that they were easier to follow. Cash Handling for Facility Use Permits: Audit Results 112 Inadequate safeguarding of cash receipts at the Hilo Main Office As mentioned above, the Government Finance Officers Association (GFOA) establishes best practices for general revenue controls. These best practices include physical security procedures, which is especially important for funds not deposited the day of All cash should be adequately receipt. secured and only one employee should be Hilo's cash is kept in an unlocked drawer behind the front accountable to an individual counter where customers are served during the day. This cash drawer. drawer is unmonitored by either an appointed �1 responsible employee or cameras. At night, the Clerk takes the money to the Department of Motor Vehicles where it is locked in a safe. The Clerk then picks up the money the next business morning. In addition, more than one employee uses the cash drawer (three employees and two supervisors). As a result, it would be impossible to hold any one person accountable if cash were missing. This situation has resulted in part from management not sufficiently updating their procedures according to best practices. The Department of Parks and Recreation's policies and procedures were initially created in 2002. However, they submitted a partially updated policy and procedures on August 13, 2015. Physically securing cash and assigning accountability to a responsible employee reduces the risk of loss or theft. All employees accepting payments should have a secured, lockable cash drawer and only the employee collecting the payments should have access. If there is more than one person receiving payments at the same time, each person should have their own cash drawer. In addition, it is good practice to maintain cash records in a separate location from the cash itself. If fraud or theft does occur, the records cannot easily be taken, destroyed, or modified. Separation of cash records and cash is a simple cash security practice that can discourage theft, or at least allow the timely discovery of theft. Cash Handling for Facility Use Permits: Audit Results 113 We were unable to determine if revenue is complete. In fiscal year 2014 - 2015, Hilo Main Office, Kona Permit Office and the Recreation Division, issued 1,297 permits and recorded approximately $176,000 in revenue from facility use permits. We initially reviewed 138 transactions totaling $12,410 from July through September 2015 for the Hilo Main Office and the Kona Permit Office. The Kona Imin facility was closed from August 3 — November 30, 2015 for accessibility improvements; we therefore expanded our initial audit testing of the Kona facility use permits to include an additional four transactions totaling $1,618 from June 2015; as well as an additional five transactions totaling $2,057 from Transactions should be adequately reviewed and monitored, so that individual errors will decrease. the June 2015 reservation calendar. Of these transactions, most reconciled to supporting documents; however, we were unable to determine if revenue was complete since: • Numerous miscellaneous errors were identified, • Deposits were not always made or posted timely, • Pre -numbered facility use permits were not used, and • Cash over/short was not recorded Numerous miscellaneous errors were identified Since the Clerk was the only person processing cash receipts including assigning a permit number, charging a fee, recording the permit information in the daily deposit record and depositing the funds, many errors were not detected. (Figure 3) Cash Handling for Facility Use Permits: Audit Results 114 Summary of errors found at both Hilo and Kona Error Identified: # of Errors Identified Hilo Kona The waived permit use date was not posted on the County website and/or not recorded on the reservation log. 2 2 The reservation log user fee does not match the actual user fee charged. 1 2 The treasury receipt was incorrectly coded to pavilion revenue instead of facility use revenue. 1 0 A check was written two weeks prior to being processed as a permit and deposited or we were unable to determine when the check was written. 1 9 The payment type was not listed on the general fund daily deposit record to reconcile to the user permit. 1 10 The check was written to the Dept. of Parks & Rec and County of Hawai'i instead of the County Director of Finance. 3 9 The user permit sequence (date) did not correspond with the treasury (date) receipt sequence. 0 2 Figure 3 Individually errors or irregularities may not be significant. However, when combined, they demonstrate that policies and procedures are not adequately followed, or understood, as well as a lack of monitoring by management. Undetected errors may result in: • financial misstatements, • inaccurate or incomplete information, • uninformed operational decisions, and • the inability to detect irregularities including theft or misappropriation. For instance, while reviewing transactions at Kona, we identified blocks of business days where daily deposits were not logged (four days in June, three days in July, three days in August, and four days in September 2015). Facilities in Kona are typically fully rented, especially during the summer months. In our opinion, based on the routine frequencies of daily deposits during these four months of peak usage, it is unusual that there were multiple days where no deposit or revenue was recorded. Due to the lack of monitoring and adherence to policies and procedures, we cannot determine if these breaks in revenue are correct or accurate. In Hilo, revenue was logged daily with no breaks in deposits. Cash Handling for Facility Use Permits: Audit Results 115 If transactions are adequately reviewed and monitored, procedures are improved and followed; then individual errors and potential risk should decrease. Deposits were not always made or posted timely Of the 16 transactions tested at the Kona Permit Office, we identified five transactions that were not deposited and posted timely. Deposits ranged from two to three business days from the time the payment was made to the time the courier picked up the revenue. We also identified an additional ten transactions that were posted to the accounting system between three and nine business days after the revenue was received. The Hilo office deposited all funds within 24 hours of receipt except for two instances. The Clerk completed permits and collected checks on one day, but the deposits were not recorded until the next day and not deposited with Treasury for two days. Deposits should be made as often as possible, preferably daily. Failing to make timely deposits increases the risk of errors, loss, or theft of funds. In addition, by not making frequent deposits, the County may miss interest that could be earned if the deposits were made in a timely fashion. Whenever possible, recording check and cash receipts to the general ledger should occur the same day as the deposit. This reduces the risk of lost or stolen cash receipts and incorrect recording. Pre -numbered facility use permits were not used Of the 131 transactions we reviewed at the Hilo Office, we identified 90 instances of missing permit numbers. Instead of using the pre -numbered facility use permits provided by the Department of Finance, the Clerk uses a computer template to assign permit numbers and complete permit information. The permit numbers were logged as a range of numbers instead of being listed separately. Since the permit numbers were manually assigned, there was an error in documenting the correct permit numbers on the log. Therefore, the permit numbers were not consecutive and we could not determine if all money received was deposited. At the Kona Office, the Clerk also uses a computer template to assign permit numbers. We did not identify any issues of sequentially. However, since the permit numbers are assigned by the Clerk, we cannot determine if duplicate permit numbers were used and the deposit was complete. Sequential permit numbers are essential to ensure that all payments are documented and revenue collected. By using pre -numbered permits, and reviewing the sequentially of these permits, receipts cannot be easily duplicated or voided. An independent person should review the deposit reconciliation by matching up permits (receipts) to records and check/cash composition to deposit totals, as well as ensuring the integrity of permit numbers. Cash Handling for Facility Use Permits: Audit Results 116 Cash over/short was not recorded Best practices for cash handling state that when an overage or shortage is identified, a supervisor should recount the deposit. If it is a valid overage or shortage, an accounting entry should be made immediately to document the difference in the general ledger. Neither Hilo or Kona record cash overages or shortages. Hilo uses an envelope stored in the cash drawer to keep the overages. If cash was short at closing, the Clerk uses this money to balance the deposit. Kona's Clerk stated that they do not have any overages or shortages. Any significant balance in this account is an indication to management that cash is not handled carefully enough. Never having any overages or shortages is also a red flag. Because of our audit, Department of Park and Recreation took immediate corrective action by disposing of the envelope and requiring clerks use treasury receipts to account for any cash over/shorts in revenue. Cash Handling for Facility Use Permits: Audit Results 117 Audit Recommendations The County of Hawai'i Department of Parks and Recreation's facility use permit cash handling process inadequately addresses internal controls, leaving gaps in existing policy including management oversight. The audit recommends that the Department immediately address the internal control weaknesses revealed through our site visits and develop a more proactive cash handling oversight program. Furthermore, these recommendations should be considered for all cash receipting locations within the Department. The following recommendations address each of these areas. Segregation of Duties We recommend that incompatible duties be adequately segregated at the Department of Parks and Recreation. If duties cannot be sufficiently segregated, mitigating controls, such as a detailed supervisory review and monitoring of the activities should be implemented to reduce risks. Implementing Monitoring and Oversight We recommend the Department of Parks and Recreation perform ongoing monitoring of the design and operating effectiveness of the internal control system as part of the normal course of operations. Ongoing monitoring includes regular management and supervisory activities, comparisons, reconciliations, and other routine actions. We further recommend that the Department of Parks and Recreation implement an independent verification process by deploying a two- person team (an employee and a supervisor) in the cash handling process by separating custodial duties and daily reconciliation from reconciliation review and timely deposits. Update and Enforce Policies and Procedures We recommend the Department of Parks and Recreation clarify and enforce internal controls in County policy and procedures to ensure consistency throughout the department and with industry best practices including but not limited to: • Provide clear guidance on independent review and monitoring procedures. These procedures may include: ✓ Perform and document surprise cash counts Purchasing Card Program : Audit Recommendations 118 ✓ Add independent review/verification by supervisors including review of voided and waived transactions, adjustments to account for cash over/short, daily deposits, and reconciliations, date sequence of deposit record, and numeric integrity of permits ✓ Approval of all voided and waived transactions • Provide guidance and clarification on individual job duties to ensure adequate segregation of duties exists. • Clarify or add policies regarding: ✓ timeliness of deposits; ✓ adequate safeguarding of cash receipts; ✓ utilizing the three-part carbon pre -numbered permits; ✓ endorsing checks immediately upon receipt; ✓ procedures for handling cash overages and shortages; ✓ timeliness of recording revenue, reconciling cash and check composition, reconciling revenue ledger accounts; and ✓ fraud reporting guidance Provide Training We recommend the Department of Parks and Recreation provide on-going cash handling and internal controls training for all employees who handle revenue. Cash Handling for Facility Use Permits: Audit Recommendations 119 Management's Comments Wiliam P. Hanoi 1rfanr June 29, 2016 Qtoiiiitp of babnifi DEPARTMIENT OF PAS AND RECREATION 1011 Noah! Strev4 Suite G ■ Fll1q, Hawaii 972* (808) 0414311 * F*x (806)941-8411 Ms. Somme S. Niu , Legislative Audilor County of Hawaii Olfioe of the Legislative Auditor 1266 lea Menne. Suite A-8 Hila, Hawaii 96720 Clayton S. Honma Dlreetor James M. Kwn Depsr Director Sub pct: Perfbrnamee Audit — Cash Handling at County of Hawaii's Departmumt of Pars Recreation Dear Ms. Nims. Thank you for the opportunity to provide our response to the audit recommendations. endations. 1Recofi njendution; Segregation of Duties — We recommend that incompatible duties be adequately segregated at the Department of Parks & Et eercation_ if duties cannot be sufficiently segregated, mitigating controls, such as a detailed supervisory review arra monitoring ofthe activities should he implemented to reduce risks. R.e.ypor ; The Department of Parks & Recreation has minimal staff to accomplish all-inclusive segregation ofduties. However, we have inr rpotated mitigating oontrtis to our policies and procedures. Reor)iamendaharr implementing Monitoring and Oversight — e recommend the Department of Narks & Recreation perform ongoing monitoring of the design and operating effectiveness ofthc )ate al control system as part of the normal course ofoperations_ Ongoing monitoring includes regular management andsupervisnry activities, comparisons, reconciliations, and other routine actions. We further recommend that the Department of Parks & Recreation implement an independent verification process by deploying a two -person Learn (an employee and a supervisor) in the crash handling process by separating ouatodiol duties & daily recancilialion from reconciliation review and deposits. Response: The Department elf Parks & Reeltatikn has initialed supervisory oversight and monitoring to =ignite and eorrect discrepancies arks improve accuracy, c,mnpletcness and timeliness. Comte of Howe! is nor Equal Opperriori yPrev4dermeF.ployer. Cash Handling for Facility Use Permits: Management's Comments 120 Recommendation: Update and Enfamce Policies and Procedures — We recommend the Department of Parks & Recreation clarify and enforce internal controls in County policy and procedures to =bare consistency tlu'oughout the department and with industry best prac:lices including by not limited to; ✓ Provide clear guidance on independent review and monitoring procedures, 'these poceedures may include: 1 Perform and document surprise cash counts *1 Add independent review verification by supervisors including review of voided and waived transactions, itdjU 1rnenls to accnunt for cash over/short, daily deposits, and reconciliations, date sequence of deposit record. arrd numeric integrity of permits 1 Approval of all voided and waived trans,actiQns • Provide guidance and clarification on individual job duties L enatrre adequate segregation of duties +=rats. ▪ Clarity or add policies regarding: ▪ Timeliness of deposits; v.. Adequate safeguarding of cash receipts; Utilizing the three-part carbon pre -numbered permits; • Endorsing checks immediately upon receipt; v. Procedures for handling cash overages and shortages; • `dere] inns of recording revenue reconciling cash and cheek oo ip[rsi1iort, reconciling revenue ledger accounts; and Fraud repcariing guidance Respoyor The Department of Parks &. Recreation has already integrated additional internal con1rols to our policy and procedures_ We will continue to work on providing more clarity and enforcement to policy and procedures_ Recopy /mm.10. . Provide Training — We recommend the Dept -Uncoil of Parks & Recreation panicle on-gning cash handling and internal controls training for all employees who handle revenue. Response: We currently provide training, but will increase our focus in this arca, Sincerely, Clayton Honma Director C un.iy Ha/mil is ch. 5quol Oppartuiltyr Fi 1e' ;? rw �oyM.•, Cash Handling for Facility Use Permits: Management's Comments 121 Appendix A: Audit Criteria Government Finance Officers Association (GFOA) provides best practices for documenting accounting policies and procedures: Communication is an essential component of a comprehensive framework of internal controls. One method of communication that is particularly effective for controls over accounting and financial reporting is the formal documentation of accounting policies and procedures. A well-designed and properly maintained system of documenting accounting policies and procedures enhances both accountability and consistency. The resulting documentation can also serve as a useful training tool for staff. Recommendation: Every government should document its accounting policies and procedures. Traditionally, such documentation has taken the form of an accounting policies and procedures manual. Thanks to advances in technology, even more effective methods are now also available for this purpose. An appropriate level of management to emphasize their importance and authority should promulgate accounting policies and procedures. The documentation of accounting policies and procedures should be evaluated annually and updated periodically, no less than once every three years, according to a predetermined schedule. Changes in policies and procedures that occur between these periodic reviews should be updated in the documentation promptly as they occur. A specific employee should be assigned the duty of overseeing this process. Management is responsible for ensuring that this duty is performed consistently. The documentation of accounting policies and procedures should be readily available to all employees who need it. It should delineate the authority and responsibility of all employees, especially the authority to authorize transactions and the responsibility for the safekeeping of assets and records. Likewise, the documentation of accounting policies and procedures should indicate which employees are to perform which procedures. Procedures should be described as they are actually intended to be performed rather than in some idealized form. Also, the documentation of accounting policies and procedures should explain the design and purpose of control related procedures to increase employee understanding of and support for controls. Government Finance Officers Association (GFOA) recommends governments establish a revenue control and management policy and review it on an annual basis. This policy should be customized for the size and resources of the government: The following factors should be considered in developing a general revenue control and management policy: Cash Handling for Facility Use Permits: Audit Criteria 122 a. Internal controls - Management should establish controls, and ensure they are documented and followed. All aspects of cash receipting and accounts receivables should be subject to proper internal controls including: • Segregation of duties such as initiation and authorization of transactions, execution of transactions (receipting and disbursement), recording transactions, reconcilement, and maintaining custody. • Daily processing and timely deposit of receipts. Ideally, all funds should be deposited within 24 hours of receipt. • Timely reconciliation to applicable ledgers. • Physical security procedures. This is especially important for funds not deposited day of receipt. • Fraud reporting procedures. • Use of integrated receipt and accounting systems wherever practical and cost-effective. b. Accounting practices — All receipts and receivables should be recorded in accordance with generally accepted accounting principles (GAAP). c. Billing and collection practices - Accounts receivable should be established for services provided in advance of payment and terms for collection should be established. In accordance with established procedures, bills should be initiated, recorded in an accounts receivable system, and generated within an established timely manner after initial service delivery. Effort should be made to ensure that receivables are collected in a timely fashion. d. Methods of payment — A policy outlining the acceptable methods of payment for the governments should be established. This policy should include the method of access (as well as method of payment) while promoting electronic methods of access and payment when feasible and cost-effective to reduce overall risk and increase cash flow. e. Depositing of received funds - Treasury management should serve as the primary recipient for all revenue collection sites. There should be timely recognition and depositing of revenue collected. Smaller governments that do not have a formal treasury function are encouraged to establish a formal single point of receipt or cashier function to control access to received funds. f. Due to the special nature of funds received from grants, developers, partners and other entities, governments should consider whether separate procedures should be established for recording and depositing these funds. Returned checks — Procedures for processing and collection of returned checks should be established, including the assessment of fees to offset the costs associated with the returned items. g. Cash Handling for Facility Use Permits: Audit Criteria 123 h. Accounts receivable management — All accounts receivable should be recorded in a manner that allows for aging analysis. After reviewing available collection options, governments should establish procedures that maximize collections. Collection agencies that are familiar with federal, state, and local notice requirements and regulations should be considered when their use proves cost- effective. Bad Debts — An allowance for doubtful accounts and a write-off policy should be established. Bad debt expense should be estimated based upon a documented method of calculation. An allowance for doubtful accounts should be recorded. Write-offs should be performed periodically to ensure that accounts receivable and allowance balances are not overstated. Efforts should be made to pursue the timely collection of delinquent accounts. Budgetary review responsibilities — Revenue collections and accounts receivable should be monitored in a timely manner. Both actual and budgeted or forecast revenues should be monitored. Any significant variance of actual from the forecast or budgeted revenues should be investigated thoroughly. k. Compliance - Governments should ensure their revenue control and management policy and procedures are in full compliance with any federal, state, local or other applicable laws or requirements. The United Sates Government Accountability Office (GAO) has issued standards for internal controls ("Green Book") and, in part, describes the monitoring internal control component: Overview Finally, since internal control is a dynamic process that has to be adapted continually to the risks and changes an entity faces, monitoring of the internal control system is essential in helping internal control remain aligned with changing objectives, environment, laws, resources, and risks. Internal control monitoring assesses the quality of performance over time and promptly resolves the findings of audits and other reviews. Corrective actions are a necessary complement to control activities in order to achieve objectives. Principles 16. Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. 17. Management should remediate identified internal control deficiencies on a timely basis. 16.04 Management monitors the internal control system through ongoing monitoring and separate evaluations. Ongoing monitoring is built into the entity's operations, performed continually, and responsive to change. Separate evaluations are used periodically and may provide feedback on the effectiveness of ongoing monitoring. Cash Handling for Facility Use Permits: Audit Criteria 124 16.05 Management performs ongoing monitoring of the design and operating effectiveness of the internal control system as part of the normal course of operations. Ongoing monitoring includes regular management and supervisory activities, comparisons, reconciliations, and other routine actions. Ongoing monitoring may include automated tools, which can increase objectivity and efficiency by electronically compiling evaluations of controls and transactions. 16.08 Management retains responsibility for monitoring the effectiveness of internal control over the assigned processes performed by service organizations. Management uses ongoing monitoring, separate evaluations, or a combination of the two to obtain reasonable assurance of the operating effectiveness of the service organization's internal controls over the assigned process. Monitoring activities related to service organizations may include the use of work performed by external parties, such as service auditors, and reviewed by management. The Committee of Sponsoring Organizations (COSO) provides an integrated internal control framework and guidance on monitoring internal control systems, which states in part: How Does Monitoring Benefit the Governance Process? Unmonitored controls tend to deteriorate over time. Monitoring, as defined in the COSO Framework, is implemented to help ensure "that internal control continues to operate effectively." When monitoring is designed and implemented appropriately, organizations benefit because they are more likely to: • Identify and correct internal control problems on a timely basis, • Produce more accurate and reliable information for use in decision-making, • Prepare accurate and timely financial statements, and • Be in a position to provide periodic certifications or assertions on the effectiveness of internal control. Over time effective monitoring can lead to organizational efficiencies and reduced costs associated with public reporting on internal control because problems are identified and addressed in a proactive, rather than reactive, manner. Hawai"i Revised Statutes (HRS) Title 5. State Financial Administration establishes the requirements of receipts, payments, and deposits: §40-34 Accountants may deposit in bank, when. Every public accountant other than the director of finance, receiving or disbursing money belonging to the State may deposit to the public accountant's official credit and keep all moneys received by the public accountant in such banks as may be designated therefor by the director with the Cash Handling for Facility Use Permits: Audit Criteria 125 approval of the governor until the moneys are remitted to the director as required by law, and the public accountant shall not be responsible for the moneys while so deposited. §40-40 Receipts and payments. For all moneys paid into the treasury there shall be prepared a treasury deposit receipt in the form and in the number of copies determined by the comptroller as provided in section 40-6. The receipt shall specify the information required by the comptroller and the director of finance for the proper accounting of the amount paid into the treasury... The Hawai"i County Charter, Article VI, Chapter 6, Section 6-6.3. Powers, Duties, and Functions (Department of Finance) states in part: (g) Maintain a general accounting system for the county and require all county agencies and executive agencies to report and remit all receipts to the finance director as often as the finance director deems desirable. County of Hawai"i Main Office - Hilo Facility Use Permits Basic Procedures (August 2015) states in part: BASIC PROCEDURE 1. Complete a Facility Use Permit — Special Request Form 2. Original (white) Facility Use permit - our copy Second copy (yellow) - given to the applicant Third copy (pink) - posted at the facility by Parks Maintenance staff. 6. Clip payment to our permit, place in purple folder and lock in drawer. 8. Log permit information on the GENERAL FUND DAILY DEPOSIT RECORD at the end of each day. Be sure permit numbers are consecutive, including any voided permits. The monies received for that day are reconciled with this record. Monies are taken to Motor Vehicle registration. END OF DAY PROCEDURES 5. Reconcile cash/checks with total and make sure there is $100 petty cash. 6. Money is taken to DMV before end of day. Money is picked up in the morning at 7:45am. County of Hawai"i Kona Permit Office Facility Use Permits procedures (August 2015) states in part: BASIC PROCEDURE 2. Complete a Facility Use Permit 3. Original (white) Facility Use permit shall be turned in with the deposit slip Second copy (yellow) will be given to the applicant Cash Handling for Facility Use Permits: Audit Criteria 126 Third copy (pink) shall be posted at the facility by Parks Maintenance staff. 7. Log permit information on the GENERAL FUND DAILY DEPOSIT RECORD Be sure permit numbers are consecutive, including any voided permits END OF DAY PROCEDURES 2. Reconcile cash/checks with total make sure there is $50 petty cash. 3. Stamp the back of the checks with the General Fund stamp. 7. Lock up petty cash. 8. Take deposit to Bank of Hawai"I Lanihau Center. You can either do a deposit during banking hours or a night deposit. For deposits during bank hours, be sure to get a validated deposit slip from the teller. For night deposits, keep the receipt. Cash Handling for Facility Use Permits: Audit Criteria 127