FINAL REPORT
City of Cupertino
FISCAL POLICY INVENTORY AND GAP ANALYSIS
May 5, 2022
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Fiscal Policy Inventory and Gap Analysis
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Table of Contents
Background, Scope, and Methodology 1
A. Background 1
B. Scope and Methodology 1
Overall Results 3
Prioritized P&P Work Plan 4
Summary of Recommendations 5
Fiscal Policy Inventory and Gap Analysis | 1
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
BACKGROUND, SCOPE, AND METHODOLOGY
The City of Cupertino (the City) requested that Moss Adams LLP (Moss Adams), as the City’s internal auditor, perform an inventory of all City fiscal policies and procedures (P&Ps) and a gap analysis to determine what gaps in coverage exist, and develop a prioritized P&P work plan to support the City in addressing identified gaps. The objectives of this project were to:
Determine which fiscal areas are adequately covered by comprehensive current P&Ps. Identify policy gaps, including areas where no policies to support fiscal functions are documented, existing policies are outdated or in need of minor updates or additions, and current internal control or gap coverage are missing key components.
Prioritize policy gaps based on overall risk, and develop an implementation plan to provide the City with recommendations for prioritizing and addressing the identified policy gaps.
This engagement was performed in accordance with Standards for Consulting Services established by the American Institute of Certified Public Accountants. Accordingly, we provide no opinion, attestation, or other form of assurance with respect to our work or the information upon which our work is based. This report was developed based on our assessment of the City’s fiscal P&Ps as of October 2021. The procedures we performed do not constitute an examination in accordance with generally accepted auditing standards or attestation standards.
This project was limited in scope to the City’s finance and accounting (fiscal) functional areas. All fiscal P&Ps available as of October 2021 were provided to Moss Adams to assess as part of this project. Other P&P documents, informal process documentation, or guideline documents that are not approved formal P&Ps at the City level may exist; however, they were not included in this analysis and are therefore not included in the results presented in this report.
The procedures performed included:
Fiscal P&P Inventory – We worked with City management to develop a full listing of finance and accounting policy areas that were applicable to the City and that would be included in the scope of this project. For each area, we performed the following:
○ Obtained all supporting/related P&P documents available ○ Documented a full inventory of the current existing P&P documents, including a summary of the coverage areas of each.
○ Discussed the full inventory of results with management to ensure that all P&P documents were provided and included in the inventory.
P&P Gap Analysis – We assessed the inventory results and performed a full gap analysis, including:
○ Assessed the current content of each area to identify potential gaps in coverage.
Fiscal Policy Inventory and Gap Analysis | 2
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
○ Assessed existing P&P documents for opportunities to improve the overall content and flow/structure, incorporate best practices, and improve internal controls, where possible, to provide for effective resources for employees.
○ Summarized the gaps identified for each P&P area.
○ Categorized the significance and extent of the identified gaps as follows: full gaps, major gaps, or minor gaps. We also noted areas only in need of an update. Prioritized P&P Work Plan Development – Based on the results of the P&P inventory and gap analysis performed, we developed detailed recommendations, by area, for the City to use as a road map for developing, amending, or updating P&Ps. We assigned a risk level (high, medium, or low), as described in the table below, and a recommended priority order by phase based on the risk level. We discussed the prioritized P&P work plan with management, gathered input on the work plan, and made updates, as appropriate.
Gaps identified during the analysis were categorized as follows:
Full Gap – Documented policies and procedures do not exist for the area. Major Gap – Some P&P documentation exists; however, there are major gaps in overall coverage.
Minor Gap – P&Ps cover most of the key areas but require some updating or additional coverage.
Update Needed – The P&P needs to be reviewed for potential updates.
The assessed risk level, category descriptions, and recommended phases/timing for addressing the gaps and related recommendations are described in the table below. The risk levels were assigned based on our understanding of the City, insights gained from management, the inherent risk in each area, and the level and significance of gaps identified.
Assessed
Risk Level Category Description Recommended
Phase/Timing
High Risk
● Area is inherently high risk
● Gaps identified were either full gaps (i.e., no P&P coverage) or major gaps
● Area is a high priority for the City’s operations and structure Phase One
(within 12 months)
Medium Risk
● Area is inherently high or medium risk; however, a lack of documented P&Ps may only represent a medium risk to the City ● Gaps identified were either full gaps or major gaps
● Area is a high priority for the City’s operations and structure Phase Two
(within 18 months)
Low Risk
● Area is inherently low risk
● Gaps identified were either minor in significance or magnitude, or the area only needed review or updating
● Area is a low priority for the City’s operations and structure Phase Three
(within 24 months)
Fiscal Policy Inventory and Gap Analysis | 3
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
OVERALL RESULTS
Throughout the P&P inventory and gap analysis, we found that the City has a variety of P&P documents; however, they are not consistently utilized, structured, or based on standard templates.
Although the City appears to have consistent practices established and has approvals/process flows setup within the enterprise resource planning (ERP) system, the City does not have a defined P&P framework and as a result, in many cases it was unclear what level of policy a document fell under.
Some of the City’s documents identified as “policies” included administrative procedures. In some areas, the City uses the notes included in their financial statements as “policies”, as well as Council Resolutions, memos, or email to communicate requirements. The City does not have a standard template/format and there does not appear to be a structure for ensuring all policies are supported by underlying procedures. Additionally, there is no consistent means of identifying when policies are approved and effective. The effective date on most policies is not complete.
Utilizing a defined P&P framework with standard templates will help streamline the City’s P&P resources. This framework can be used to define responsibilities at both the City Council and management level.
The City can utilize the Prioritized P&P Work Plan presented on the following page to carry out their efforts to develop and update their fiscal P&Ps. In addition to following summary table, we have provided management with a detailed Prioritized P&P Work Plan, which includes all results from the inventory and gap analysis performed and detailed recommendations by area.
Fiscal Policy Inventory and Gap Analysis | 4
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
PRIORITIZED P&P WORK PLAN
Policy Area Type of Gap Associated
Risk
Recommended
Priority Level
Accounting and Financial Reporting Major Gaps High 1
Accounts Payable Full Gap High 1
Budgeting Major Gaps High 1
Capital Assets Major Gaps High 1
Cash Management Major Gaps High 1
Payroll and Timekeeping Full Gap High 1
Procurement Major Gaps High 1
Revenue and Accounts Receivable Full Gap High 1
Debt Management/Tax Bond Compliance Major Gaps Medium 2 Gifts and Donations Major Gaps Medium 2
Grant Management Full Gap Medium 2
Investment Management Minor Gaps Medium 2
Credit Cards Minor Gaps Low 3
Inventory Full Gap Low 3
Travel and Expense Reimbursement Minor Gaps Low 3
Fiscal Policy Inventory and Gap Analysis | 5
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
SUMMARY OF RECOMMENDATIONS
The following table summarizes the recommendations related to high-risk policy areas. A detailed listing of full recommendations was provided separately to management.
Policy Area Summary of Recommendations
Accounting
and
Financial
Reporting
Expand and develop full Accounting and Financial Reporting P&Ps that address, at a minimum, the following key areas:
● Chart of account maintenance, setup, and structure.
● Fund structures, including the definition and use of each City fund, and required fund reconciliations. Information on this topic that is currently presented in the Financial Policies can be used as a starting point and expanded upon. ● Journal entry preparation, approval, and posting.
● Month-end and year-end close procedures, including timing, responsibilities for performing each procedure, review/approval responsibilities, and monitoring. ● Financial Reporting: which reports will be prepared and on what basis (monthly, quarterly, etc.), who will be responsible for their review and approval, which reports will be presented to the City Council and/or Committees, and how frequently. ● Audit requirements and auditor selection.
● Significant Accounting Policies and Procedures: The City can utilize notes to audited financial statements as a starting point to accumulate significant accounting policies, then expand to address detailed procedures that will be applied to ensure compliance.
● Account Reconciliations: Which balance sheet accounts are reviewed monthly; responsibility for preparation, review and approval; and procedures on performing reconciliations and addressing variances.
● Monitoring controls including financial trend analysis (year to year, budget to actual, monthly fluctuations) and key performance indicators.
● Unclaimed property handling, including any rules on forfeiture of property to the State Controller’s Office.
Accounts
Payable
Develop full, comprehensive AP P&Ps that include all significant areas within the AP function including, but not limited to, the following:
● Vendor Management: New vendor setup and vendor changes, including required supporting documentation, approvals, and segregation of duties, vendor master list controls and annual reviews, and dormant vendors. In general, vendor management should be controlled by individuals independent of the AP process. ● Invoice receipt, approval, and routing (manual or electronically) to AP for payment processing.
● Reconciliation between invoice and purchase requisition (PR)/purchase order (PO), receiving documentation, etc. and documentation required to support this three-way match process.
● Invoice coding and system entry.
● A/P processing including required reviews/approvals, invoice tie-out, and pre- and post-check register reviews/approvals.
● Check printing, signature, and check stock maintenance controls. ● ACH payment processing and related controls.
● Check mailing and support filing.
Fiscal Policy Inventory and Gap Analysis | 6
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Policy Area Summary of Recommendations
● Monitoring controls over the disbursement function, such as vendor file changes/addition reviews and trend analysis (i.e., total payments by vendor). ● Record retention requirements to support the AP process/function. ● Other key controls and internal procedures over the disbursement function.
Budgeting
Expand and develop full, comprehensive Budget Management P&Ps that include all significant areas within the budget function including, but not limited to, the following key areas:
● Budget Preparation Process: How individual departments/programs should prepare their budgets, what data/historical and upcoming information should be used, and resources available to employees responsible for aspects of the budget process ● Budget Calendar: Including a snapshot of all key dates in the process (initial budget notifications from Finance, department/program due dates, original draft budget submission, internal reviews/approvals, Council presentation and budget adoption/approval, budget finalization, system entry, etc.) ● How to address budgeting for new funding identified during the year (resources greater than budget estimates, new appropriations or new grants/donations, etc.), including timeline requirements, reviews/approvals, and system entry ● Budget monitoring, including budget-to-actual reporting, use and responsibilities, required reviews, justification for budget overages, and anticipating changes throughout the year
● City-mandated budget requirements and how each will be considered and applied to ensure compliance
● Budget amendment and transfer processing, including the documentation and approvals required and responsibilities for each
● Overall roles and responsibilities within the budget function, including budget establishment, monitoring, etc.
● Required budget-to-actual reporting to leadership and/or City Council, including what information is to be reported and at what frequency
Capital
Assets
Expand and develop a full, comprehensive Capital Asset P&P that includes all significant areas within the Capital Asset function including, but not limited to, the following:
● Capital budgeting (incorporate the existing Capital Improvement Policy located within Financial Policies)
● Depreciation: Methods used, determination of useful lives, entering during asset setup, depreciation expense entry preparation, review, approval and posting, etc. ● Capital asset receiving process, including physical receipt and documentation of receipt
● Reporting new fixed assets to Accounting and issuing asset tags (including who issues tags, tracking tags, placement on assets, and recording tag numbers in ERP system)
● New asset setup in the City ERP system (including required information, supporting documentation submitted/maintained, etc.)
● Reconciliation between G/L and capital asset data in the ERP system, and reviews to ensure all capital assets are captured
● Policies regarding capital asset reviews, their purpose, who is responsible for performing reconciliations, identifying variances, repairs/maintenance expense review and documentation, etc.
● Capital Asset Custodians: Assignment and accountability of those responsible for capital assets in each department/division/site
Fiscal Policy Inventory and Gap Analysis | 7
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Policy Area Summary of Recommendations
● Capital Asset Transfer and Disposal Procedures: Reporting disposals/transfers to Accounting, updating in the ERP system, changes in accountability, methods of disposal including documentation requirements and approvals, lost/stolen asset handling/reporting, etc.
● Annual Inventory Count: Procedures, condition assessment, and segregation of duties (including having an independent person perform count, identify assets damaged or not tagged, add assets, verify asset details, reconcile information, and make updates in the ERP).
● Record retention for capital assets
Cash
Management
Incorporate the existing Cash Receipts/Handling Policy into a full Cash Management P&P. A comprehensive set of Cash Management P&Ps should be developed and should cover, at a minimum, the following:
● Bank account setup, cancelling, access monitoring, etc. ● Bank reconciliations, including responsibility for preparation, supporting documentation required, outstanding items monitoring, variance handling, review, and approvals
● Bank account signature authority
● Change fund policy (for sites that handle cash payments) ● Payment acceptance, including types of payments accepted (cash, checks, credit cards, ACH, etc.) and requirements for processing/accepting each type ● Cash reconciliations, deposits, and variance reporting (reporting overages/shortages) ● Counterfeit detection requirements
● Required frequency for remitting cash to Cashiering for deposit ● Segregation of duties
● Monitoring of locations’ deposit frequency
● Consequences for non-compliance
● Minimum security requirements for transporting deposits ● Petty cash handling
The City should also consider developing site/location-specific P&Ps that apply to all City locations that accept or handle monies. Each site that handles payments should be required to develop internal Cash Handling P&Ps to show how they will ensure compliance with City-wide policies. Detailed Cash Handling P&Ps, by site, would include areas such as the following:
● How receipts are issued and reconciled
● Where payments are recorded (manual log, system, etc.) upon receipt ● Responsibilities for cash handling and daily reconciliations ● Daily reconciliation procedures (i.e., base funds, system/log totals for receipts, payments being deposited, etc.)
● Detailed procedures for storing payments, closing credit card machines, etc.
Payroll and
Timekeeping
Develop comprehensive Payroll & Timekeeping P&Ps to help ensure that time worked is properly accounted for, reviewed, and approved; that pay rates are properly controlled and applied; and that employees are ultimately paid appropriately and accurately.
Payroll and Timekeeping P&Ps should cover, at a minimum, the following:
● New employee setup and pay rate adjustments (in general, this duty should be performed by someone independent of the payroll processing function to ensure that duties are adequately segregated)
Fiscal Policy Inventory and Gap Analysis | 8
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Policy Area Summary of Recommendations
● Time recording for exempt and non-exempt employees
● Time reviews and approvals
● Timecard edits or corrections before/after payroll processing ● Transfer of time detail to process payroll
● Payroll processing (including required reviews/approvals pre and post processing, reconciliations, general ledger posting, reporting, etc.) ● Direct deposit setup and processing
● Check printing, signature, and distribution
● Payroll tax reporting and tracking and accrual account reconciliations ● PTO accruals, use and recording, monitoring of PTO balances, etc. ● Payroll monitoring and oversight (including pay rate change report reviews; timecard edit reviews; systems access monitoring; payroll trend analysis by employee, position, department, etc.; and other reviews/reporting performed to ensure the payroll function is well-controlled)
Procurement
Expand and develop a full comprehensive set of Procurement P&Ps and include, at minimum, the following key areas:
● Due diligence thresholds, including online/verbal quotes, format written quotes, Requests for Proposal (RFPs), and a dollar threshold for each level of due diligence.
The existing chart defines thresholds but does not provide details on how a user should complete the various methods. The attachments to the current policy, address some specific procedures (e.g., Formal Bid Procedures) but they need to be updated and organized.
● Approval thresholds and a clear definition of the workflow process for obtaining all required approvals. In addition, definition of approvals that may be required for certain types of purchases, based on G/L code (i.e., IT, fixed assets, and/or grant- related).
● Sole-source and emergency purchase procedures (justifications and documentation requirements, approvals, etc.) that define their appropriate use(criteria, etc.). ● Initiating Purchase Requisitions (PRs), and a clear definition of the process for PRs and POs.
● Receiving procedures and related documentation requirements (on packing slips/receiving reports and in the system, if applicable). ● Segregation of duties between Purchasing and Receiving. ● Documentation requirements and methods of storing information. ● Suspension and Debarment Checks: The threshold for when to perform checks and responsibility for performing them, when they must occur in the procurement process, documentation required to support they were performed, how/where documentation will be maintained to support new vendor setup, and the reverification process to confirm that vendors used for longer than a specified period (e.g., one year) are reconfirmed and the results of the review are documented. ● Specific requirements for certain high-risk purchases. ● Specific restrictions and unallowable purchases (alcohol or other).
Revenue and
Accounts
Receivable
Develop a comprehensive set of Revenue and A/R P&Ps at a City-wide level to address, at a minimum, the following:
● Defining the specific types of revenue throughout the City, referencing Department and Division-specific P&Ps where appropriate
● Revenue recognition and accounting for revenue
Fiscal Policy Inventory and Gap Analysis | 9
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Policy Area Summary of Recommendations
● Customer account setup and requirements
● Overall monitoring of revenue activity
● Defining the City's requirements for billing and collection activities (including defining roles and responsibilities, documentation requirements, frequency, etc.) ● Accounts receivable management, including tracking and reporting A/R, requiring aging analysis, reporting on delinquent accounts, etc.
● Systems access related to A/R management systems, to ensure proper segregation of duties
● Allowance for doubtful accounts establishment, recording of bad debt expense, criteria for estimate development, etc.
● Handling refunds and account credits, including required documentation, approvals, etc.
● Guidance to Departments/Divisions for developing their specific billing policies/procedures, and for ensuring consistency and enhancing revenue capture ● Establishing criteria to determine when past due/delinquent accounts are sent to collection agencies and how revenue collection service providers are engaged and monitored
● Defining when account write-offs can occur, what approvals are required, and how write-offs/account adjustments must be documented and controlled ● Unclaimed Refunds: Procedures to follow when customers don’t cash refund checks or checks are returned to the City Utility Bills, when to waive late fees, when to credit overcharged customers, when to invoice undercharged customers ● General Bills and Taxes: When to waive late fees and allow for payment plans Given the various types of revenue across the City, it may be appropriate for individual revenue-generating Departments/Divisions to develop their own specific P&Ps. These should cover how the Departments/Divisions will implement specific P&Ps and monitor for compliance with City-wide P&Ps, including the use of account management systems, reconciliations to the City's ERP system, specific billing/collection activities, etc.
Fiscal Policy Inventory and Gap Analysis | 10
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Appendix A – Management Responses to Fiscal Policy Inventory and Gap Analysis:
1. Accounting and Financial Reporting
Management Response:
Management agrees that formalized policy and procedures are needed in Accounting and Financial Reporting. Currently, staff utilizes non-formalized procedures for the processes listed above. Staff created polices in these areas the review process and expected to be approved by the Director of Administrative Services and the City Manager.
2. Accounts Payable
Management Response:
Management agrees that formalized policy and procedures are needed in Accounts Payables.
Currently, staff utilizes system set up and security and non-formalized procedures for the processes listed above. Staff created polices in these areas the review process and expected to be approved by the Director of Administrative Services and the City Manager.
3. Budgeting
Management Response:
Management agrees that formalized policy and procedures are needed in Budgeting. Currently, staff utilizes system security and non-formalized procedures for the processes listed above. Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager.
4. Capital Assets
●
Management Response:
Management agrees that formalized policy and procedures are needed in Capital Assets. Currently, staff utilizes non-formalized procedures for the processes listed above. Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager.
5. Cash Management
Management Response:
Management agrees that formalized policy and procedures are needed in Cash Management.
Currently, staff utilizes non-formalized procedures for the processes listed above. Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager.
6. Payroll and Timekeeping
Management Response:
Management agrees that formalized policy and procedures are needed in Payroll and Timekeeping.
Currently, staff utilizes system security and non-formalized procedures for the processes listed above.
Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager.
7. Procurement
Fiscal Policy Inventory and Gap Analysis | 11
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Management Response:
Management agrees that formalized policy and procedures are needed in Procurement. Currently, staff utilizes system security and non-formalized procedures for the processes listed above. Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager. These changes will be delayed as the City prioritizes findings from the procurement audit and has requested a Purchasing Manager as part of the Proposed Budget. To minimize changes and potential confusion all changes to procurement will occur at one time and after the review of the new Purchasing Manager should the position be approved.
8. Revenue and Accounts Receivable
Management Response:
Management agrees that formalized policy and procedures are needed in Revenue and Account Receivable. Currently, staff utilizes system security and non-formalized procedures for the processes listed above. Staff created polices in these areas are in the review process and expected to be approved by the Director of Administrative Services and the City Manager.