CITY OF FRESNO – ACCOUNTS PAYABLE AND DISBURSEMENTS
REPORT ON INTERNAL CONTROL REVIEW
November 16, 2023
Prepared by:
Price Paige & Company
Certified Public Accountants
570 N. Magnolia Avenue, Suite 100
Clovis, CA 93611
www.ppc.cpa
(559) 299‐9540
November 16, 2023
To Ruth F. Quinto, CPA, Assistant City Manager
City of Fresno
2600 Fresno Street
Fresno, California 93721
RE: REPORT ON INTERNAL CONTROL – ACCOUNTS PAYABLE AND DISBURSEMENTS
Dear Ms. Quinto,
Attached is our report related to the review of internal controls over the City of Fresno Finance Department’s
Accounts Payable and Disbursements and related recommendations. Should you have any questions, please feel free to contact us.
Very truly yours,
Fausto Hinojosa, CPA, CFE Osvaldo Gutierrez, CPA Anthony Gonzales II, CPA Price Paige & Company Price Paige & Company Price Paige & Company
CITY OF FRESNO – ACCOUNTS PAYABLE AND DISBURSEMENTS
REPORT ON INTERNAL CONTROL REVIEW
TABLE OF CONTENTS
Page
Independent Consultant’s Report .............................................................................................................................. 1
Mission Statement of the Finance Department ......................................................................................................... 3
Background ................................................................................................................................................................. 3
Consulting Objectives and Scope ................................................................................................................................ 3
Report Structure ........................................................................................................................................................ 4
Conclusion .................................................................................................................................................................. 4
Current Processes, Recommendations, and Operational Impact:
Section A: General Reporting and Operations .................................................................................................... 5
Section
B: Control Activities ............................................................................................................................... 10
Section C: Other Comments ............................................................................................................................... 17
Exhibits:
Exhibit A: COSO Internal Control – Integrated Framework Principles ............................................................... 22
1 INDEPENDENT CONSULTANT’S REPORT
November 16, 2023
To Ruth F. Quinto, CPA, Assistant City Manager
City of Fresno
2600 Fresno Street
Fresno, California 93721
RE: Internal Control Review over the City of Fresno Finance Department
Dear Ms. Quinto,
We have provided the following services to the City of Fresno (the City) as it relates to the Accounts Payable and
Disbursement process:
1) Performed an evaluation of internal controls, including the effectiveness of the controls, the reliability of financial data, safeguarding of assets, and compliance with laws and regulations. 2) Prepared written recommendations for areas of improvement identified as a result of the internal control review.
Our services were conducted using the following methods of information gathering and reporting: examination and inspection of books and records, interviews and inquiries with staff at various levels and different departments, and direct observation of the subject matter. Information received by City staff was reviewed using professional judgment and was subjected to professional skepticism.
The results of our services are summarized in detail in the following pages of this report. Due to the nature of the services provided, there may be additional recommendations and improvements to be made; however, we believe the proposed recommendations will significantly improve the City’s existing processes, policies, and procedures.
This will ultimately result in more effective and efficient processes for City staff and management alike.
It is acknowledged that although there were various recommendations provided as a result of our review, the opportunity for improvement does not detract from the hard work and dedication of City staff. Many of the recommendations stem from training opportunities, availability of resources and monitoring of key activities, all of which are addressed in this report.
2 This report was prepared specifically for use by the City Manager’s Office, Department of Finance, City Council, and any other City staff (as directed by the City Manager’s Office) that would directly benefit from reviewing this information. It is not intended to be, and should not be, used by anyone other than these specified parties.
Very truly yours,
Fausto Hinojosa, CPA, CFE
Price Paige & Company
CITY OF FRESNO – ACCOUNTS PAYABLE AND DISBURSEMENTS
REPORT ON INTERNAL CONTROL REVIEW
3 MISSION STATEMENT OF THE FINANCE DEPARTMENT
To guide fiscal policy and advocate for sound business processes.
BACKGROUND
Price Paige & Company was engaged to perform an evaluation over the City of Fresno’s Accounts Payable and Disbursements process, with a key focus being on effectiveness of internal controls, reliability of financial data, safeguarding of assets, and compliance with laws and regulations. As part of this arrangement, we performed various interviews with key Accounts Payable staff, along with members of management and those in departments supporting or working with the Accounts Payable function (such as Informational Services and Internal Audit).
Based on information gathered,
interviews conducted, and processes observed, we identified various areas for improvement and implementation of best practices that we believe will equip City staff and management to more effectively and efficiently meet its desired objectives as it relates to the accounts payable and disbursement process.
CONSULTING OBJECTIVES AND SCOPE
Our first objective was to gain an understanding of the City’s processes and procedures for the accounts payable and disbursement process. Key to this understanding included the following:
1) The City’s structure, including reporting hierarchies and other defined reporting rankings/groupings. This includes an evaluation of duties, with a focus on adequate segregation of duties.
2) The City’s process for identifying and assessing potential risks within the Accounts Payable function, whether financial or operational, including those steps taken to reduce identified risks.
3) The City’s control activities, specifically related to the City’s processing of accounts payable and disbursements.
4) The City’s methods, tools and defined lines of communication between departments, with a focus on interactions with the Finance Department.
5) The City’s methods and processes used to monitor control systems specific to accounts payable and disbursements to ensure errors are identified and corrected timely.
Our consideration of the City’s internal control structure and related recommendations are based on the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which are widely used guidelines for organizations to consider for internal controls, risk management, and other fraud deterrence activities (see Exhibit A for the Integrated Principles of Internal Control as defined by COSO).
The second objective was to prepare a summary of written recommendations for improvement based on the understanding obtained in the first objective. Those recommendations follow in the subsequent pages of this report.
CITY OF FRESNO – ACCOUNTS PAYABLE AND DISBURSEMENTS
REPORT ON INTERNAL CONTROL REVIEW
4 REPORT STRUCTURE
On the following pages, we created a structure by subject area which details the following components:
Current Process
o This section details how the process is being carried out with the current staff and resources available.
Additional information is added as needed to provide context to users of this report.
Recommendations
o Each subject area item will have one or more recommendations which are the result of our examination and inspection of books and records, interviews and inquiries with staff at all levels and different departments, and direct observation of the subject area.
Operational Impact
o This section details the benefits and potential positive outcomes of implementing the recommendations.
At the end of the report are various exhibits, which are either examples of the subject matter or are worksheets that we created to support our conclusions. They are referenced as detailed in the “Recommendations” section noted above.
CONCLUSION
There are many recommendations as a result of this review. Although some of them may not seem attainable due to cost, time, or other available resources, implementing them will significantly improve the operations of the Finance Department. That is why the recommendations need to be evaluated by the key staff involved in these functions, so that a plan can be made for successful and timely execution of the recommendations. Note that the cost (which could include payroll, non‐payroll, and other indirect charges) of internal controls should not exceed anticipated benefits. We took this into consideration when providing the recommendations, however, management should also consider this when deciding on the implementation of any recommendation.
It is important not to attempt to implement all recommendations at once. It is more critical to make an organized plan such that there is a clear path and goal for successful implementation of all the recommendations in stages.
Lastly, there should be a system and level of accountability for structure and timing of how and when these recommendations will be implemented. This report is not useful unless there is internal follow‐up for the implementation of each stage of the process.
5 SECTION A:
GENERAL REPORTING AND OPERATIONS
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION A: GENERAL REPORTING AND OPERATIONS
6 ITEM 1 – FINANCE DEPARTMENT ACCOUNTING POLICY AND PROCEDURES Current Process
Currently, the City’s Finance Department does not frequently rely on or provide training on written standards on the adopted policies and procedures for the various functions performed by the department. Additionally, while policy and procedure documentation does exist, it is not comprehensive and there is opportunity for refinement.
Recommendation(s)
We recommend the refinement of written standards, defining the adopted policies and procedures for all functions within the Finance Department. These standards should be documented, accessible, and aligned with local, state, and federal laws, including applicable reporting standards (e.g., Government Accounting Standards Board).
Examples of potential policies and procedures include an accounting manual describing specific steps taken to process accounts payable, posting journal entries, and other significant accounting functions; matrix of job duties, by department; and clear roles and responsibilities for those involved in the AP process.
There is a risk with the City not having updated documented procedures as staff turnover or transfers could impact the City’s ability to having an efficiently functioning AP department. Furthermore, documentation should emphasize who is responsible at what level in the workflow to determine if proper documentation exists for payment to be authorized.
Operational Impact
There are many benefits to encapsulating the City’s policies and procedures into a written document, including:
1. Training and Development – Having clear standards facilitates the onboarding of new employees and the continuous training of existing staff, allowing for professional growth and development.
2. Accountability – Providing measurable and enforceable guidelines that employees must follow enhances accountability.
3. Compliance with rules and regulations – Written guidelines in alignment with legal requirements provide a solid framework to ensure compliance with applicable laws and regulations.
4. Quality Control – Standardization enhances the quality of work by providing a reference for best practices and procedural steps, minimizing the changes of errors and omissions.
5. Clarity and consistency – Written standards ensure a clear understanding of the roles, responsibilities, and expectations across the department. It promotes consistency in execution and reduces ambiguity.
The potential risks of not having documented standards for the City’s policies and procedures could include:
1. Loss of Information – Potential turnover of key management and staff positions could place the City in an unfavorable position if key institutional information is lost.
2. Inconsistency in Practice – Variations in practice leading to inefficiencies and potential compliance issues.
3. Legal and Compliance Risks – Increased challenges demonstrating compliance with laws and regulations.
4. Decreased Efficiency – Performance may be left to personal judgment without written standards, which can lead to inconsistent results and wasted resources.
5. Difficulty in monitoring and evaluation – Evaluation of performance becomes more complex and may lead to unjust appraisals.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION A: GENERAL REPORTING AND OPERATIONS
7 ITEM 2 – ACCOUNTS PAYABLE – ADDITIONAL TRAINING RESOURCES Current Process
The City’s Accounts Payable (A/P) staff should receive more frequent and regular training after their initial onboarding and learning of the new accounting system. Training is provided as questions arise, concerns are identified, and/or changes to existing processes are made. In addition, the City has recently implemented a new financial management software, Tyler Enterprises (accounting system), which presents both opportunities and challenges for the staff responsible for inputting, processing, and otherwise utilizing the system. City staff has expressed challenges in using the new software, which were observed by us during the check batch process.
In addition, Business Managers and other staff responsible for financial reporting and related functions outside of the Finance Department should also receive frequent and regular training or other feedback as it relates to the accounts payable process. As the financial transactions within the user departments (e.g., fleet, public works, police department, etc.) interact closely with the Accounts Payable process, it is crucial that processes and standards are developed and trained to ensure accurate, timely financial reporting by departments and Accounts Payable alike.
The implementation of Tyler represents a change in the way many functions and activities are processed by City staff. Ensuring that staff are properly trained on the system’s current functions and uses is key to the staff being able to meet the objectives of the department. The City does have a general Tyler user guide available to all departments as a resource, which should continue to be emphasized and utilized during frequent training sessions.
Recommendation(s)
To ensure proper use of the accounting system, and to increase efficiency of operations within the accounts payable function, we recommend the following:
1. The City should institute, at least annually, (a) training session(s) that bring(s) together the accounts payable department and key staff from all other departments (which should include Business Managers and anyone who is directly involved with the Disbursement process). This training should be focused on the areas and aspects of the process that are driving inefficiencies or otherwise resulting in unnecessary time spent processing disbursements. We recommend that a leader from the Accounts Payable team summarize these key issues prior to meeting with the departments to ensure only the key activities central to the processing of City disbursements are covered and focused on to avoid unnecessary feedback that could affect the strength of the message.
2. For the periodic training noted above, it would be beneficial if each attendee from the departments were able to submit a simple form with topics or general questions that AP can review and consider when providing the training. The training ideally will be mandatory and enforced by City leadership because the benefit of attending will greatly outweigh the cost of “lost time” by attending and significantly increase overall efficiency and accuracy.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION A: GENERAL REPORTING AND OPERATIONS
8 ITEM 2 – ACCOUNTS PAYABLE – ADDITIONAL TRAINING RESOURCES (Continued) Recommendation(s) (Continued)
3. Also, the City should investigate if additional training or resources are available from the City’s Accounting Software vendor or other 3rd parties to ensure that all facets of the accounting system are understood and being used to their full maximization. Many constraints imposed on City staff by the accounting software and lack of training have resulted in workarounds such as external supplemental schedules and tracking mechanisms outside of the purview of the accounting system (e.g., tracking of check numbers are manually input in a spreadsheet maintained on a shared drive with all Accounts Payable staff as a result of system issues with the accounting software), which increases the risk of error or improper payments being made.
Operational Impact
If implemented effectively, additional staff training and related understanding, at both the Accounts Payable level and the related departmental level, will only further the City’s ability to effectively and efficiently process disbursements and ensure the related financial reporting is timely and accurate. The City should expect increased staff costs related to training time along with additional costs related to obtaining the training services from qualified vendors. However, this would be offset by the cost savings City‐wide due to increased efficiency and availability of staff resources to tackle other projects.
ITEM 3 – WHISTLEBLOWER HOTLINE
Current Process
The City currently does not have a centralized line of communication for all stakeholders to report actual or suspected wrongdoings as it relates to internal and external City operations (commonly referred to as a “Fraud Hotline”).
Recommendation(s)
We recommend that the City consider implementing an anonymous tip hotline for reporting of all suspected and actual fraud. In addition, this hotline should be clearly displayed on the City’s website. The initial rollout of any tipline or reporting system should include a campaign to increase awareness of this tool to all City Stakeholders.
Key considerations for an effective Whistleblower hotline:
1. Anonymity and confidentiality – A common feature of many effective whistleblower hotlines does not require that the reporting party identify themselves. Anonymous and confidential reporting mechanisms help foster a climate whereby stakeholders are more likely to report or seek guidance regarding potential
or actual wrongdoing without fear of retaliation.
2. No retaliation – This should be publicly stated as fear of retaliation will reduce the effectiveness of any whistleblower hotline.
3. Tone at the top – Creating a culture where internal reporting is valued and where tipsters are protected is essential to preventing and detecting suspected unethical or unlawful conduct.
4. Multiple uses – Commonly used are multi‐purpose “helplines” that also function as a reporting tool for tipsters, effectively reducing the stigma and associated fear of using a dedicated “fraud hotline”.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION A: GENERAL REPORTING AND OPERATIONS
9 ITEM 3 – WHISTLEBLOWER HOTLINE (Continued)
Recommendation(s) (Continued)
5. Data collection and evaluation – The information and data obtained should be regularly reviewed by management for potential trends and other indications of abuse, waste, fraud, or ineffective/inefficient operations.
6. Education and outreach – Significant education and outreach should be made, on an ongoing basis, to ensure that all stakeholders are made aware of the hotline and its importance.
Operational Impact
Increased costs related to staff time in monitoring and investigating reports to the Fraud Hotline. Increased costs related to informational technology for the initial setup and maintenance of the reporting tool itself. Increased public awareness of communication lines with the City to report fraud. Most significant is the potential decrease to negative impacts of fraud, waste, or abuse as a result of more timely identification of issues or indications of such occurrences.
10 SECTION B:
CONTROL ACTIVITIES
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
11 ITEM 1 – IN‐PERSON CHECK PICK‐UPS
Current Process
The City’s current process for the disbursement of processed checks to vendors includes an option, generally on rare occasions, for employees of the various City departments to physically pick up processed checks from the Accounts Payable (A/P) department for subsequent remittance/delivery to the vendor/payee. The standard process for check disbursements is for them to be directly remitted to the City’s vendors through the mail once all relevant processes have been completed for the related check batch. It does not normally include City staff manually picking them up.
Recommendation(s)
We recommend that the City consider revising its current policies and procedures for check pick‐ups to remove the ability of staff to take custody of checks after being processed by Accounts Payable. If the City believes that a check pick‐up by City staff is needed to ensure viability or efficiency of operations, we recommend the City review and revise its current procedures for the following:
1. How payments to vendors are identified for check pick‐up.
2. The review and approval process of check pick‐up.
3. Documentation of the reason necessitating check pick‐up.
If the check pickup option is continued, we recommend that all check pick‐ups are approved by an appropriate level of management prior, including a designee within the Finance Department at a sufficient level in management (such as an Assistant‐Controller), the reason necessitating the check pick‐up, and the subsequent monitoring of the check clearing the bank by appropriate staff. Having this summarized in a form (digital preferred) would make this a streamlined process. The creation and content of the form should be handled by the Finance Department leadership.
Having checks mailed out to a vendor/payee will reduce the risk of any potential misappropriation or misuse of the check/City resources. This is in alignment with internal control best practices related to segregation of duties and custody of assets.
Operational Impact
The A/P Disbursement process for check release will become much more efficient. A/P staff will not have to field as many special requests which can interrupt the pay run, and they will have to make fewer judgment calls about whether someone is authorized to pick up a check. In addition, the form that must be filled out will help deter departments from being too “last minute” with their requests and causing unforeseen additional challenges for the A/P team. The benefit from having the form is that it will serve as a preventative control, making it more difficult to circumvent the normal A/P process. Departments will find ways to process their disbursement requests more timely and prevent the need for a check pick‐up in the first place.
Furthermore, increased controls over the custody of assets (checks) will increase the City’s control system to ensure that payments are only made to those vendors that have been properly authorized and approved. In addition, there will be a reduction in the potential risk of improper payments made whether due to fraud or error.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
12 ITEM 2 – VENDOR CREATION
Current Process
The City’s current process for vendor creation begins with a new vendor being created by the department requesting payment. After subsequent review and approval by required levels of management and other departments, the final step includes review and approval by the City’s Accounts Payable department.
Recommendation(s)
While the City’s current process appears to be reasonably segregated, we recommend that the City consider reassigning the vendor creation function to the City’s purchasing department for the reasons identified below:
1. Segregation of duties – By confining vendor creation to the purchasing department, the City will be better equipped to ensure those employees responsible for vendor creation are not the same individuals who approve invoices or make payments, reducing the possibility of collusion or unauthorized actions.
2. Specialization and expertise – The purchasing department typically has the expertise and understanding of the procurement process and is better suited to identify vendor compliance standards. They will most likely be able to build efficiencies in the consolidation of the vendor creation function.
3. Standardization and consistency – Implementation of standardization to increase the City’s ability to ensure consistency and compliance with related standards and processes.
4. Efficiency and effectiveness – As purchasing is already involved in the procurement processes, logically, they are in the best position to manage vendor creation and maintenance. This fosters effective communication, alignment with procurement strategies, and streamlines the workflow.
5. Compliance and regulation – As previously mentioned, the expertise of the purchasing department is likely to lend itself to increased awareness and adherence to City policy for procurement and related processes.
6. Risk management/monitoring & oversight – Through consolidation, vendor creation, oversight and management of vendors becomes more cohesive, facilitating regular reviews and application of City policy.
7. Alignment with strategic objectives – Vendor creation within the purchasing department ensures alignment with the City’s procurement strategies and objectives.
Furthermore, it is key that the vendor creation process needs to continue to ensure the City is taking appropriate steps for verifying and reviewing banking information to reduce or eliminate the potential risk of error or fraud.
Operational Impact
Increased efficiency and accountability, as noted in the above recommendations. Additional resources will likely be needed within the purchasing department to support the additional responsibility for vendor creation and management. However, there are various ways that the vendor setup process can be streamlined and organized using current City software and resources.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
13 ITEM 3 – USER ACCESS CONTROLS – WORKFLOW ROLES IN TYLER Current Process
The Informational Services Department (ISD) is responsible for ensuring that City employees have the proper user access roles within the Tyler Accounting System. Functionally, ISD receives requests from departments to approve, remove, or otherwise modify user access within Tyler. These changes are handled specifically by the Administrative Division, and require the attention of more experienced, senior‐level staff within ISD. Interviews with these two senior ISD staff indicated estimates of approximately 20% of their total daily time was spent solely on updating user access controls during the earlier stages of Tyler being implemented. Currently they are spending an estimated 2%‐ 5% of their daily time updating user access controls.
In addition, we identified instances whereby employees were given temporary access for approval of invoices, despite this not being a normal part of their user access.
Finally, based on our discussions with key staff, there does not appear to be a formally documented process for management of the City to use in reviewing, approving, or otherwise authorizing user access control changes within the City’s accounting system.
Recommendation(s)
We recommend that the city formalize the user access controls, by position if possible, for all City departments and users of the City’s accounting system. In addition, we recommend that all employees, as part of the onboarding process, are assigned their roles/responsibilities/workflows within the accounting system. This formalized process should be added to a new employee checklist of required steps needed for an employee’s onboarding to be considered complete. User access controls for new employees should be based on the City’s formalized matrix of employee user access dependent on the position, and should be approved, either explicitly or implicitly, by the related manager or position that is responsible for oversight.
In addition, we recommend that the City implement additional monitoring controls over the City’s user access within the accounting system. Key considerations in this process include:
1. Identification of all user access control changes – This should include new and removed users to the system as well as changes to existing user control access. This should include all activity during the period under review and not the user access control at a specific point in time, as user access roles could be inappropriately changed and subsequently reverted to the original assignment of controls without identification by management.
2. Understanding and usefulness of information – The person or persons responsible for reviewing changes to user access controls must have a sufficient level of understanding of the changes, including the roles and responsibilities for the related changes. If not already done, perhaps a summary training on Tyler’s workflow could help them understand better.
3. Documentation and Approvals – All changes to the user access controls are properly authorized with the appropriate trail of approval (which is supported with appropriate documentation).
4. Regular confirmation of need – Outside of general changes to user access controls, we recommend that City management, at an appropriate level, review user access controls for employees that are their direct reports, as these members of management are in the best position to accurately assess if their permissions are not only correct, but make sense for those roles.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
14 ITEM 3 – USER ACCESS CONTROLS – WORKFLOW ROLES IN TYLER (Continued) Recommendation(s) (Continued)
For these items noted previously, appropriate monitoring should take place. The City should consider making that a key function of the Internal Audit department or other staff that would not be influenced by City leadership/management, or are otherwise involved with approval‐related workflows in Tyler.
Finally, we recommend that the City formalize a process whereby Business Managers, or other appropriate designee, submit requests to ISD for needed user access control changes. During the earlier stages of the implementation of Tyler, the individual employee notified ISD, generally by calling the City’s “Help Desk”, regarding changes that were needed to user access control settings. This was subsequently submitted to the related manager or person in charge of authorizing changes, resulting in significant back and forth and inefficiency of operations.
Currently a Supervisor/Business Manager will submit the request on behalf of their employee. If the Supervisor/Business Manager need a change, their supervisor will request it. The documentation of a formalized process will clarify roles and expectations City‐wide.
Operational Impact
Key considerations for providing the preceding recommendations included the following benefits and challenges if the city chooses to implement:
Benefits
1. Enhanced security – Proper restriction of access based on the user’s position helps ensure that employees can only access information needed to perform their job functions, which subsequently minimizes the risk of unauthorized access, fraud, or misuse of sensitive data.
2. Improved efficiency – Standardized access controls based on roles streamline the onboarding and offboarding process. When a new employee is hired into a specific role, access rights can be quickly assigned based on that role’s predefined permissions, saving time and effort.
3. Better accountability and traceability – Role‐based access controls can more easily be traced back to specific users, which allows for more effective monitoring and auditing, fostering accountability, and aiding in investigations if irregularities are detected.
4. Facilitates segregation of duties – Standardized role‐based access helps in defining and enforcing segregation of duties, a critical aspect of internal controls. By ensuring that conflicting duties are assigned to different individuals, the city minimizes the risk of errors of fraud.
Challenges
1. Complexity of implementation – Standardizing access controls based on roles requires a comprehensive understanding of each position’s responsibilities and the relevant system permissions. This can be complex and time‐consuming to implement, initially.
2. Ongoing management and maintenance – Roles and responsibilities within the City may change, and access controls must be continually reviewed and updated to reflect these changes. This ongoing maintenance requires resources and careful management.
3. Potential workflow disruptions – Overly restrictive access controls may impede workflow if employees cannot access the information they need to perform their duties efficiently. Finding the right balance between security and operational efficiency is essential.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
15 ITEM 3 – USER ACCESS CONTROLS – WORKFLOW ROLES IN TYLER (Continued) Recommendation(s) (Continued)
Challenges (Continued)
4. Training and awareness – Employees must be educated about the access controls in place, why they are essential, and how to comply with the policies. This requires ongoing training and communication.
5. Technology considerations – Implementing robust access controls may require investment in technology or adjustments to existing systems. Integration with other City systems might also be a consideration.
ITEM 4 – DUPLICATE PAYMENT CHECK
Current Process
City staff has developed a tool that is used to analyze the data in each check batch processing to ensure that a duplicate payment is not made in error. While the tool is available to all Accounts Payable staff, there was inconsistent application of the use of this tool during the earlier implementation phase. During our observation of the Accounts Payable check batch process, we did not observe the Accounts Payable staff utilizing this tool to confirm whether duplicate payments were made.
Recommendation(s)
We recommend that City staff are made aware of this tool and its requirement for use as part of processing each check batch. In addition, we recommend that the City include this as a key step when developing written standards for the Accounting Department functions to ensure proper compliance with all required steps.
Operational Impact
Having limited financial or staff resource impact, we still believe this will greatly increase the City’s effectiveness of internal controls as it relates to improper disbursements, due to fraud or error. Although using the tool will take extra time for every pay run, there would now be more available time for staff to do this with the increased efficiencies gained across all other processes noted in this report.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION B: CONTROL ACTIVITIES
16 ITEM 5 – TIMELINESS AND COMMUNICATION BETWEEN DEPARTMENTS Current Process
During our observation of the check batch process, we identified instances where invoices requiring immediate payment were submitted to Accounts Payable with limited buffer time between the payment request from the department and the related payment due date (payment requested on the same day payment was due), despite the related invoice/activity being received by departments significantly earlier than when submitted to Accounts Payable.
As a result, department staff requested immediate payment, which caused significant delays in the overall check batch process due to various processes and checks required by Accounts Payable staff for a first‐time payment to a vendor, resulting in checks not going out in the mail in accordance with the City’s normal control processes. In addition, this resulted in multiple instances of back‐and‐forth communication between the department, Accounts Payable staff, and finance management. Furthermore, we observed one member in A/P receiving a phone call, Teams message, email request, and system message all within the span of a few minutes (due to special requests), which disrupted the workflow and could have led to mistakes being made due to the volume of distractions.
Rush submissions to the accounts payable department can result in inefficiencies for all involved, in addition to creating risks to the city as controls are more likely to be overridden or bypassed.
Recommendation(s)
We recommend that the City communicate and reinforce strict deadlines that clearly define and communicate the timeframe for invoice/document submission and approval to ensure timely processing. Regular reminders can also be used by the City to ensure the various city departments are notified of any pending deadline.
We also recommend that the Business Manager (or equivalent) at each Department work towards submitting payment requests in accordance with requested timelines to alleviate the need for last minute payments. This could mean them communicating to the vendor about any potential delays (for example – a check will be received in 3 days instead of 1).
Operational Impact
Having limited financial impact, staff time will still be required to create the policy on timeliness of vendor invoice/approval submission, which will result in increased efficiencies for both department and Accounts Payable staff, more secure controls over the cash disbursement process, and ensure compliance with the City’s normal operating control processes and procedures. The continuous training of the departments will be done as part of the previous recommendation noted.
In addition, A/P will spend less time handling special requests and last minute changes with a clear cutoff time in place. This allows pay runs to go much more smoothly and efficiently.
17 SECTION C:
OTHER COMMENTS
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION C: OTHER COMMENTS
18 ITEM 1 – WORKFLOW LOGIC
Current Process
The City’s current workflow logic within Tyler allows for an “Originator” to approve their own input if certain processes occur in‐between, such as modifications to the original input (e.g., invoice) by another user within the system.
Recommendation(s)
We recommend that this process is evaluated by the City’s Informational Services Department and a revision is made, ideally with the assistance of the City’s vendor, to ensure that no one person or position can approve the transactions they initiate.
Operational Impact
Removing any opportunity for one person to approve their own inputs into the system will result in a properly designed control system that will more effectively ensure the City’s goals are met through a reduction of errors and other undesired outcomes.
ITEM 2 – WORKFLOW APPROVAL THRESHOLDS
Current Process
The City’s approval process for large disbursements, currently all individual disbursements over $250,000, require the approval of the respective department’s Director.
Recommendation(s)
We recommend that the City consider lowering this threshold to $100,000, or to another threshold that will allow for an acceptable balance between management time and risk to the City.
Operational Impact
Additional management time will be needed to allow for the review of additional invoices; however, this will also increase management’s ability to identify potential errors or other issues in a timely manner. While additional staff time may increase staff’s workload, the reduction of errors and timely correction of those that would not have been identified during the City’s current process will likely result in cost savings to the City in the long‐run.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION C: OTHER COMMENTS
19 ITEM 3 – CONTROL MONITORING
Current Process
There are opportunities for a macro‐level review of the City’s disbursement processes. Many control activities are reviewed and approved at a transactional level, but summarized data (weekly, monthly, etc.) does not appear to be regularly evaluated.
Recommendation(s)
We recommend that the City consider implementing specific monitoring controls that are performed, ideally, by appropriate levels of management and at regular intervals.
Areas for management to consider implementing additional reviews:
1. Periodic summary level review of key information such as approvals of invoices, by user, within Tyler, to identify potential approvals of invoices by unauthorized staff in accordance with City policy. Unauthorized staff approving invoices within Tyler could result in improper disbursements and loss to the City. Ideally, system generated report templates will be created and generated periodically for management’s review. a. While proper setup and timely rejection of user access during hiring, termination, and other key events is important, a subsequent review and monitoring of this process is key to ensure only authorized individuals are accessing and approving activity in this process.
2. Rejected invoice report to identify invoices that are rejected by the Accounts Payable department for not conforming to City policy.
a. Regular improper submissions to the Accounts Payable department result in inefficiencies for all involved and could indicate that additional training or support is needed.
3. Credit card charges/utility payments/etc. – Considerations for reviewing this activity includes potential lack of timeliness of submission of supporting credit card receipts, potential improper payments to PG&E for non‐city accounts, amongst other considerations.
4. Payments to vendor to identify trends such as potential bid‐splitting and duplicate payments.
Operational Impact
Ensuring proper levels of review at the management level will help management identify errors or other trends on a timely basis, subsequently allowing for a faster and more efficient process that will ensure accuracy and achievement of City objectives. The items included in the above recommendations are not all‐inclusive, and it is key that management continually evaluate processes and additional reviews are implemented when areas are identified.
CITY OF FRESNO – FINANCE DEPARTMENT
REPORT ON INTERNAL CONTROL REVIEW
SECTION C: OTHER COMMENTS
20 ITEM 4 – INTERNAL TRAINING AND PROCESS RESOURCES
Current Process
The City’s current training resources are not well organized to ensure effortless access by staff when needed. At least one City department is utilizing vendor software designed for creating and storing training resources. Our understanding is that City Management is currently in the process of providing resources for the implementation of a City‐wide repository of training and related resources.
Recommendation(s)
In line with our previous recommendations on staff training, we recommend that City management continue to prioritize the implementation of a City‐wide repository of training resources (such as instructional videos, step‐by‐ step process guides, and other tools) that are available to staff to ensure they are provided with the resources needed to complete their work assignments in a timely and efficient manner. Many software and platforms are available from third‐party vendors (Cornerstone, iSpring Solutions, Litmos, etc.) and should be considered once the objectives and scope of the training resources made available to employees are more defined.
Operational Impact
Potential increased costs related to the creation, implementation, and maintenance of a training directory or third‐ party vendor software. Once effectively implemented and communicated, increased staff awareness of processes and a reduction of duplicative training, resulting in decreased staffing time in both training and in process.
21 THIS PAGE IS LEFT BLANK INTENTIONALLY.
22 EXHIBIT A