2022-02 Wireless Audit Reponses
December 1, 2023
Wireless Communication Audit
January 25, 2024
Internal Audit Unit
Kriti Agrawal, CIA
Principal Internal Auditor
2600 Fresno Street, Suite 2162 PH (559) 621-6880 FAX (559) 498-2544 Fresno, California 93721-3611
www.fresno.gov
January 25, 2024
Honorable Mayor and Audit Committee Members
City of Fresno, California
In accordance with Administrative Order 1-10 and conjunction with the FY 2020 Risk Assessment, the Internal Audit Unit undertook a financial and controls-based audi t of the Information Services Department for the audit period of October 1, 2018, to June 30 , 2021. The Audit Results are presented on page 6. Management's responses have been provided by the department and are presented immediately following the recommendations.
The Internal Audit Unit may perform a follow-up audit twelve months after this report is issued to verify that each recommendation has been impl emented and that the documented findings have been resolved to address the cause of the issue or risk identified.
The Internal Audit Unit would like to thank the staff from the Information Services Department for their assistance and cooperation during the course of the audit.
Respectfully submitted,
KRITI CHADHA AGRAWAL, CIA
Principal Internal Auditor, Internal Audit
CC: Georgeanne White, City Manager, Office of the Mayor & City Manager Ruth F. Quinto, Assistant City Manager, Office of the Mayor & City Manager TJ Miller, Assistant City Manager, Office of the Mayor & City Manager Bryon Horn, Chief Information Officer, Information Services Department Kim Jackson, Division Manager, Information Services Department Santino Danisi, City Controller/Finance Director, Finance Department Isabel Merino, Internal Auditor, Finance Department
Liliana Vidrio Flores, Internal Auditor, Finance Department
Wireless Communication Audit
January 25, 2024
Table of Contents
Introduction ................................................................................................................................................. 4 Objective, Scope, and Methodology ........................................................................................ 4 Background ................................................................................................................................................. 4 Audit Procedures .......................................................................................................................... 5 Audit Results............................................................................................................................................... 8 Finding 1: Policies and procedures lack clarity .................................................................. 8 Finding 2: 10C forms are not completed uniformly ............................................................. 10 Finding 3: Inconsistent monitoring of cellular devices ...................................................... 12 3a. Ineffective use of service provider plans......................................................................... 12
3.a.1 Unusual usage of City mobile cellular device ............................................................. 12
3.a.2 Unusual underutilization of devices .............................................................................. 12 3b. Calls made outside normal business hours ................................................................... 14 3d. Additional charges incurred in addition to the service plan ...................................... 15 Recommended Best Practices 1a: 10C Forms were created for unfilled positions ... 18 Recommended Best Practices 1b: Individual 10C Forms included multiple requests 18 Recommended Best Practices 2: Cellular inventory system lacks consistent details 18 Appendix: Supporting Documentation ................................................................................................ 21 Wireless Communication Audit
January 25, 2024
Introduction
In accordance with the City of Fresno Administrative Order 1-10 and Governmental Auditing Standards, the Internal Audit Unit has completed an Audit of the City’s wireless communications.
The objective of this audit was to evaluate the effectiveness of controls and policies over wireless communications with a focus on mobile cellular devices. The Internal Audit Unit conducted this performance audit following Generally Accepted Government Auditing Standards. These standards require the Internal Audit Unit to plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for the audit findings and conclusions based on the Internal Audit Unit audit objectives.
Objective, Scope, and Methodology
The objective of this internal audit was to assess the design and effectiveness of internal controls over wireless communication devices with a focus on mobile cellular devices. The audit identified areas of risk and opportunities for potential savings; this could include enhancements in policies and procedures and additional controls. To accomplish this objective, areas of focus included:
• Wireless communication device policies and procedures • Segregation of duties and access
• Device inventory, device acquisition, provider activation, and provider deactivation • Device/service usage reporting and monitoring
The Information Services Department (ISD) provided the Internal Audit Unit with a list of the wireless accounts belonging to seven different providers during the audit period between October 1, 2018, and June 30, 2021. The Internal Audit Unit requested invoices from the City's mobile cellular device providers to conduct the audit. ISD developed a dashboard to provide the Internal Audit Unit with the requested data, including invoice information, usage, and device information.
During the wireless audit, the Internal Audit Unit conducted various testing and analysis to determine cellular mobile device usage throughout the departments.
Background
City employees can be assigned wireless communication devices, which include mobile cellular devices, to conduct official City business in the course and scope of their employment. The devices incur a monthly charge for the wireless services provided by the City’s two providers:
AT&T and Verizon. ISD created the 'Account 4' application to help manage the inventory of the City’s wireless devices and optimize the City’s wireless device billing. ISD tracks mobile cellular devices, cellular modems, tablets, phone lines, and other devices within the 'Account 4' application. Based on the dashboard created by ISD, the City spent $4,328,065 on all City telecommunication devices from October 2018 through June 2021. The Internal Audit Unit focused on mobile cellular device usage, monitoring, and oversight for the purpose of this audit.
Due to the lack of available information across all providers, the Internal Audit Unit was not able to obtain the total spend specifically related to mobile cellular devices for the scope period.
Because the audit was specific to mobile cellular devices, the Internal Audit Unit found that the AT&T CALNET account pertained to landlines, circuits, and other devices. The Internal Audit Unit Wireless Communication Audit
January 25, 2024
could not receive the data in a uniform format that could be effectively analyzed; as a result, the audit focused on the Verizon account.
The Internal Audit Unit confirmed the mobile cellular device charges based on the reports provided by Verizon Business Group. It was determined that the City spent $987,955 on Verizon mobile cellular devices from October 2018 through June 2021. The amount audited for Verizon represented 23% of the total spent on all telecommunication expenses paid during the scope period. The figure below shows the amount spent by calendar year specific to Verizon mobile cellular devices.
Figure 1: Verizon mobile cellular device cost audited by calendar year Source: Verizon report provided by Verizon Business Group Audit Procedures
The Information Services Department provided mobile cellular device data from October 1, 2018, through June 30, 2021. The Internal Audit Unit performed the following audit procedures to determine the effectiveness of internal controls over the City’s mobile cellular devices.
1. The Internal Audit Unit selected four departments (Airports, Finance, PARCS, and Police) to evaluate the controls around requesting a mobile cellular device and terminating a device after employee separation.
a. The Internal Audit Unit chose a sample of 40 mobile cellular device request forms, known as 10C forms, across the selected departments. The sample represented approximately 20% of each selected department's total mobile cellular device population.
b. The Internal Audit Unit obtained a list of individuals no longer employed with the City from the Payroll Unit for the scope period. The Internal Audit Unit identified twenty-two individuals assigned a mobile cellular device during their employment.
The Internal Audit Unit reviewed each selected employee’s separation date to the termination/separation date of their mobile cellular device account.
2. The Internal Audit Unit tested the telework reimbursements between March 1, 2020, and June 30, 2021, to determine whether employees received reimbursements for a personal cellular mobile device while simultaneously being assigned a city mobile cellular device.
The Internal Audit Unit obtained a listing of the telework reimbursement journal entries from October 1, 2018, through June 30, 2021. The Internal Audit Unit tested the reimbursement forms to determine whether the reimbursement was for a personal cellular mobile device.
Wireless Communication Audit
January 25, 2024
3. The Internal Audit Unit obtained wireless mobile device data from October 1, 2018, through June 30, 2021. The Unit sorted the data by calendar year and cross-referenced it to data from the 'Account 4' application and the Verizon Business Report to confirm mobile cellular devices and their usage during the audit period. A detailed analysis was created to review usage data – zero usage, additional charges outside the assigned plan, and excessive usage.
4. Reconciled the present-day number of depar tmental mobile cellular devices on hand to service provider reports.
Relevant Policies and Procedures
Administrative Order 8-11: Use of Electronic Systems & Tools is the administrative order related to wireless devices. This AO explains certain requirements for handling all the City's electronic devices, such as, "The City may issue a cellular telephone, smartphone, or pager if deemed appropriate for an employee's job responsibilities. Devices/services are approved by the employee's Department Director, Assistant Director, or Manager on the basis of need. Each department is responsible for the determination of the need as well as the usage." ISD currently has one intradepartmental policy that focuses on wireless devices. This policy stipulates the guidelines that all city employees shall abide by when assigned a wireless device.
The policy also details the procedures regarding the Use and Responsibility, Setup and Support, Security and Administration, General Terms and Conditions, Enforcement, and Disposal.
Figure 2: Process for Request of Communication Devices
Source: IT.2.6 Mobile Electronic Communication Device, section 3.01.1 Assignment of Mobile Device:
ISD created the form 10C for departments to submit a request for a mobile cellular device. All the departments in the City shall submit a 10C form to be assigned a mobile cellular device.
Figure 3: Process of Requesting Cellular Devices through ISD Source: ISD Mobility Process
Wireless Communication Audit
January 25, 2024
City of Fresno Wireless Contracts
Each department's management determines the need for a mobile cellular device and approves the service plan for each employee. Determination is primarily based on an individual’s job duties and responsibilities. Mobile cellular devices range from standard flip phones with only voice plans to smartphones with voice, texting, and data plans.
CALNET Contracts
The California Network and Telecommunication (CALNET) contracts are individual competitively bid contracts that were created in an agreement by the California Department of Technology with the four (4) major wireless providers, which include AT&T Mobility, Verizon Wireless, Sprint Solutions, Inc., and T-Mobile USA, Inc. These contracts provide state and local government entities easy and reliable access to cellular services, thus avoiding lengthy and costly procurement processes. The City participates in the CALNET contracts and selects mobile cellular device service plans from AT&T (CALNET NextGen) and Verizon Wireless (CALNET Contract #C4-CVD-19-001-03).
Verizon Wireless
As a participant of the Verizon contract, the City can select from several service plans and purchase equipment at a reduced cost if the device remains active for twenty-four months with the original or upgraded service plan. The City will pay the total retail price on a device if it is deactivated before the end of the twenty-four-month period or is downgraded to a lower-cost plan. The table below provides a comparison of the top plans used during the audit scope. Email and Data Unlimited was the most used plan during the audit period.
Figure 4: Voice and Data plans from Verizon
Source: Auditor generated based on ISD Dashboard
In addition to the monthly service plans, there were special add-ons purchased for mobile cellular devices to allow text messaging and data. The tables below provide the feature names and prices.
Figure 5: Special add-on features
Source: Generated by the Internal Audit Unit based on the ISD Dashboard
Wireless Communication Audit
January 25, 2024
Audit Results
Finding 1: Policies and procedures lack clarity
The Internal Audit Unit identified the following City policy pertaining to the issuance and use of City mobile cellular devices.
Administrative Order 8-11: Use of Electronic Systems & Tools Administrative Order 8-11 was initially issued in 2007 and last updated in 2020. However, this AO does not provide guidance detailing which stakeholders or departments are responsible for monitoring a device once ISD deploys it. Furthermore, it does not specify which department is responsible for the monthly monitoring of the device charges. The absence of review prevents the City from electing the most cost-effective plan(s). The Internal Audit Unit determined that the City does not have adequate policies and procedures in place to provide direction on the issuance and utilization of wireless devices. Consequently, this had a negative fiscal impact on the City due to the mobile cellular devices not being monitored. If the responsible parties had been appropriately assigned to monitor mobile cellular devices, the City might have experienced cost savings.
ISD has an intradepartmental Policy: IT.2.6 Mobile Electronic Communication Device, section 3.01.1. This policy stipulates in section 3.1.1.3, "The requesting department shall be responsible for any/all costs associated with the device including the device itself, data charges, appropriate licenses and any applications that are required”. However, policy section 3.3.1.1 states that “ISD shall manage and administer all City owned devices.” This policy does not clearly distinguish the roles and responsibilities between City departments and ISD.
For example, The Internal Audit Unit initially selected four departments to evaluate the mobile cellular device process. However, one department issued a communication stating, "past issuance was not tracked." This department was not centralized under ISD since it kept its wireless communication devices and provider separate until the s ummer of 2022. The
department operated its device process and inventory independently and could not provide the records requested for the audit period.
Management should ensure that all departments remain centralized under one responsible authority. The potential impact of decentralization may include purchasing, maintenance, and usage monitoring inefficiencies.
Recommendations:
The Information Service Department should develop a process to consistently review and update Administrative Order 8-11 to include adequate procedures on the roles and responsibilities regarding issuing and monitoring of City cellular devices. City Management should follow up with all parties involved with reviewing and approving the Administrative Order to ensure it is authorized and released in a timely manner.
Wireless Communication Audit
January 25, 2024
Administrative Order 8-11 should be updated to include specific verbiage that identifies ISD as the department responsible for acquiring and overseeing cellular mobile devices in each department.
The City should update User Guide to 10C /10X/ AT Purchasing System to limit the submission of requests to one device per form to enable better record-keeping and tracking of the device.
Update AO 8-11: Use of Electronic Systems & Tools to include guidance prohibiting employees from receiving a City mobile cellular device and reimbursement for personal devices.
o City-provided cellular telephones shall be discontinued upon receipt of the technology allowance by the employee. The Internal Audit Unit found that one of the thirty-three employees with an assigned mobile device had received both a technology allowance and a City-provided mobile cellular device during 2020.
Management Response –
Management would like to address the reco mmendations given by the Internal Audit Team for Administrative Order (AO) 8-11 first. Management created AO 8-11 as a Use Policy and not as an in-depth How-To or Procedural policy for mobile devices. A new AO has been drafted to address procedures on roles, accountability and responsibilities for each employee receiving a city issued cellular device, however, as of this date, the AO has not been finalized and approval is still pending.
Management agrees that the AO 8-11 should be revisited periodically to update and modernize language and to address current standards and technology. ISO will perform that task before the fiscal year end.
Management also agrees that the 10C/1OX System User Guide should be updated and in fact has already completed the revision (see attached). However, Management does not agree that the submission of requests from departments be revised to requesting only one device per 1QC order. The 10C system is not the tracking system of record, Account 4 is the tracking system of all communications lines, and that system does require one entry per line. The 10C systems is not a tracking system, but rather an ordering system.
Many of the 10C requests are used for budget costing purposes on proposed new positions in the new fiscal year. To require a separate 10 C request for each individual device, particularly for budgetary costing purposes, would put a huge burden on each department as well as overwhelm the ISO equipment request system, creating unnecessary tracking, filing and administrative workload for homogeneous items that can be costed out as a group. If and when a device is actually issued, then and only then should it be identified and tracked separately and that is what the Account 4 billing system is used for. The 10C process is only for departments to request device costs. You can think of it more like a 'shopping cart'. If after being costed, the order is approved by the department's management and then ISO will order the device.
Management does inform all users of wireless devices of the standards and Wireless Communication Audit
January 25, 2024
responsibilities of the Users through AO 8-11 and that all city business conducted on that device, whether city issued or personal, can be deemed discoverable if a legal action occurs. ISO does not, however have any control over departments who allow city employees to use their personal cell phone for business and yet still make the determination to give them a stipend. That is an independent Department decision.
ISO is not consulted or notified of this determination. This is a policy that will need to be created and supported if this is to be the mandate. If a stipend is requested, it should be the requesting department verifying that the employee does not have a City owned phone.
The intradepartmental Policy: IT.2.6 Mobile Electronic Communication Device, section
3.01.1 referenced in this Finding is an internal only document to the Information Services Department (ISO) and has not been dispersed across the city. As Centralization of all IT staff citywide is completed by the end of this fiscal year, each IT employee, consolidated in ISO, will receive a copy of these updated ISO Policies to follow and adhere to. ISO will also reference the requesting department's responsibilities for any and all costs associated with the device including the device itself, data charges, and applications in the new Equipment Usage AO ISO wants to secure.
Finding 2: 10C forms are not completed uniformly
Departments are required to submit a 10C Request Form to ISD when an employee(s) needs a mobile cellular device. ISD created the manual, “User Guide to 10C /10X/ AT Purchasing System”, which provides instructions to assist departments submitting requests. The Internal Audit Unit reviewed 10C request forms submitted to ISD for 34 devices by departments. ISD was unable to locate and provide six of the requested 10C forms. The forms were assessed to verify that they were appropriately and accurately authorized.
The following issues were identified on the forms, with one form having multiple irregularities:
Nine instances where a 10C form did not include the name of the assigned employee Three instances where a 10C form did not reflect manager approval One instance where a 10C form did not reflect the designated employee’s name and manager's approval
ISD staff utilizes the forms to select devices and service plans, and then the information is entered into ISD’s 'Account 4' application. Incomplete forms and omitted approval in this form result in inaccurate record-keeping in 'Account 4' and unauthorized approval. Inaccurate record- keeping could potentially lead to erroneous inventory and ineffective management of devices.
Managing complete and accurate forms is critical in ensuring that all City devices are being properly tracked and accounted for and that the City is utilizing all available inventory in a cost- effective and efficient manner.
Wireless Communication Audit
January 25, 2024
Recommendations:
Update “User Guide to 10C /10X/ AT Purchasing System” to include detailed instructions regarding data entry.
o Required fields should include the full legal name of the assigned employee, phone number, device type, provider, and plan type.
o Include definitions for each device type option and examples so users in 'Account 4' can properly distinguish. Examples can include which devices can be categorized as PDAs.
Update Administrative Order 8-11 to reference "User Guide to 10C /10X/ AT Purchasing System" so that departments utilize this resource when placing a wireless device request. Implement data validation checks on the 10C request forms to reduce errors and ensure consistent data.
Management Response –
Management has already updated directiona l language in the "User Guide to 10C/1OX" (see attached). Also, Management has sent out new instructions for the department's review and usage of Account 4 wireless phone data (see attached email). Management will include reference to the "User Guide to 10C/1OX" in AO 8- 11 and will be including reference in the new Equipment Usage AO when it is finalized and approved by the City Manager's Office.
Data validation on each 10C issued is currently being performed daily by our TeleComm staff working with Account 4 and the 10C/1OX systems. ISO is also updating the 10C screen to request more information from the departments upon the issuance of the order. For example, when the order comes in, if it is to be a replacement cell phone, ISO wi ll require the ordering department to be mandated to enter the employee's name, EMPLID #, and the asset inventory phone number that it will be replacing to ensure appropriate information is entered into Account 4 for future reference.
The challenge is the historical field data that was incomplete in Account 3 when ISO transferred all active accounts over into Account 4 (no disconnected numbers were transferred into the new system). However, Mana gement has been working with our programmers to create a report that will give us all the Account 4 wireless fields that should be populated and aren't, so that ISO personnel can correct the historical data in the system in the system over time.
As noted and expressed to the audit personnel, the 10C process was a paper process until late in 2018 and wasn't really implemented fully until 2020/2021. ISO has enhanced, expanded, and developed our order and tracking processes significantly since the targeted audit period of 2019.
Wireless Communication Audit
January 25, 2024
Finding 3: Inconsistent monitoring of cellular devices
The City lacks internal controls over the monitoring of mobile cellular devices once a device is given to the department. As a result, the following weaknesses were identified:
a. Ineffective use of service provider plans
b. Calls made outside of standard working hours
c. Untimely suspension of accounts/phones
d. Additional charges incurred outside of the monthly service plans 3a. Ineffective use of service provider plans
The Internal Audit Unit is unable to determine the extent to which mobile cellular devices are being monitored throughout the City based on the testing performed.
3.a.1 Unusual usage of City mobile cellular device
The Internal Audit Unit assessed the mobile cellular device data to determine the level of frequency the devices were utilized. Figure 6 below summarizes the City’s mobile cellular device usage per department based on total minutes used in calendar year 2019 and the call with the longest minutes used. The minutes per calls ranged from 22 minutes up to 474 minutes. The Internal Audit Unit concluded that the usage of high minutes was unusual.
Figure 6: Minutes Used in year 2019
Source: ISD Dashboard
3.a.2 Unusual underutilization of devices
The Internal Audit Unit analyzed the usage of mobile cellular devices to determine the level of use per device to ensure the City resources are utilized effectively. Based on the
Wireless Communication Audit
January 25, 2024
analysis, the Internal Audit Unit determined that the City incurred $87,362 in mobile cellular device charges on devices not used throughout the audit period. Zero usage is defined as when an assigned employee does not use their mobile cellular device voice plan or data plan that the department is paying for. The Internal Audit Unit assessed the use of mobile cellular devices that were assigned unlimited voice plans and zero-use data plans.
Under the unlimited plan, the City pays a flat monthly fee for unlimited voice minutes. Zero usage for unlimited voice plans was based on zero voice minute use as well as zero additional usage charges, such as text messaging. It was determined that the City incurred a total of $7,321 during the scope period for devices with zero usage on an unlimited voice plan. The amounts shown in Figure 7 reflect a breakdown by department of devices that are on an unlimited voice plan. The total cost for zero-use devices under an unlimited voice plan during the audit scope was $7,321.
Figure 7: Zero-Use Unlimited Voice Plans
Source: Verizon Data provided by ISD Dashboard.
In addition to voice plans, some employees are assigned a mobile cellular device with only a data plan. The Internal Audit Unit reviewed devices with a ‘data-only plan’ that were not utilized at any capacity. Based on the assessment, it was determined that the City expended $80,060 during the scope period on devices with a data-only plan that the employee did not use. Figure 8 below provides details on the charges incurred by each department during the audit scope period.
Department Total Per Department
City Attorney 102 $
City Council 441$
Information Services 321$
Parks, After School, Recreation, and
Community Services 1,053$
Planning and Development 2,686$
Public Utilities 965$
Public Works 1,114$
Transportation 620$
Grand Total (33 Months) 7,303$
Zero‐Use Unlimited Voice Plans
Wireless Communication Audit
January 25, 2024
Figure 8: Zero-Use Data Plans
1 Source: Verizon Data provided by ISD Dashboard.
The mobile cellular devices not utilized could have resulted from inappropriate assignment to employees. In addition, devices may be assigned to vacant positions; therefore, the City continued to incur charges on these phones.
3b. Calls made outside normal business hours
Based on the analysis, the Internal Audit Unit also identified calls made outside of normal business hours between 8:00 AM and 5:00 PM. AO 8-11 stipulates, "Any personal use of the City’s electronic systems beyond incidental personal use, to be determined on a case- by-case basis, could subject the employee to disciplinary action, up to and including termination.” Therefore, the Internal Audit Unit reviewed data to verify that City employees did not use their City-issued mobile cellular devices excessively for personal use. An analysis was performed to identify calls made outside of typical business hours. The Internal Audit Unit assessed a sample from calls made between the hours of 7:00 PM to 5:00 AM. Figure 9 below shows the number of calls made in 2019 with a beginning time and the longest duration of the calls. Within the sample selection the Internal Audit Unit was able to verify that employees were inappropriately utilizing the device outside of their working hours. For instance, one individual made a call for 504 minutes on Friday, July 26, 2019, at 11:21 PM, and another made a call for 385 minutes on Monday, March 4, 2019, at 11:10 PM.
1 Unidentified refers to devices no longer in ISD's 'Account 4'; therefore, the Internal Audit Unit could not identify which department the device belonged to.
Wireless Communication Audit
January 25, 2024
Figure 9: Afterhours Calls
Source: ISD Dashboard
*Internal Audit understands certain departments have employees that work outside of normal business hours. 3c. Mobile cellular devices are not terminated promptly According to IT.2.6 Mobile Electronic Communication Device policy, section 3.3.1.11, “Accounts that are not active for over 30 days shall be automatically disabled.” The Internal Audit Unit assessed the timeframe for termination of services for mobile cellular devices that were assigned to former employees. An analysis was conducted to determine the timeliness between an employee's separation and the termination of services for their assigned City mobile cellular device. The analysis determined that, on average, the number of days from the employee separation date to the last payment date was 364. The total charges incurred after termination totaled $6,193 during the audit scope period. The high average timeframe to deactivate mobile cellular devices could be a result of unused devices after termination or lack of entering new assigned user information in 'Account 4'.
3d. Additional charges incurred in addition to the service plan The Internal Audit Unit reviewed additional charges, such as messaging and voice, not included in the service plan allowance. Most of the additional usage charges incurred pertained to voice and messaging use. These instances occurred by mobile cellular devices under two service plans: email & data unlimited and the consumption plan.
The Internal Audit Unit reviewed these service plans and determined that the charges were incurred because voice and text messaging are not features included in the email & data unlimited plan. The consumption plan does not include text messages as a feature.
The total of additional charges incurred during the 33 months of the audit totaled $229,030.
Figure 10 below provides details on the additional charges incurred per department during the audit scope period. This total represents 23% of Verizon total charges. These additional charges could potentially be avoided through consistent monitoring of mobile cellular device usage.
Wireless Communication Audit
January 25, 2024
Figure 10: Additional Charges by departments
Source: Auditor generated based on ISD Dashboard
It appears that management did not anticipate the high use of additional features when service plans were initially selected. For example, the employee with the highest additional usage charges during the scope period expended a total of $2,691 in additional charges over their monthly service charge total of $994. This employee's mobile cellular device was assigned to the Email & Data Unlimited plan for all thirty-three months of the audit. On average, this employee incurred $42 per month in additional charges to voice and $39 per month in additional charges to text messaging.
Recommendations:
The City should assign an employee from each department to work with ISD to review the usage and charges of the assigned department's devices. This will ensure employees are utilizing the devices for city purposes and select an appropriate plan for that device if the job function requires additional utilization. Management should enforce periodic reviews of the mobile cellular device service plans to ensure that the selected plan meets the needs of the assigned employee while being cost-effective.
Update AO 8-11 to clearly state the responsibilities of the departments, including the task to review the 90-day report that shows the usage and service charges during the past three months.
Review the service plan features and limits with the assigned employee of the mobile cellular device.
Wireless Communication Audit
January 25, 2024
Use other communication methods to reduce voice minutes and text messages such as email, instant messages (Teams), or the softphone from Cisco. Cancel services timely on devices that are not being utilized to save costs. Reassign devices to other employees who have a greater need for a device to complete job duties.
Management Response –
Department Management understands the frustration the Internal Audit Division recognized in Finding 3. ISO issues monthly reports for the review by departments to ensure that ISO has the most up-to-date information, however, despite ISD's best efforts to work with the departments, many of the automated reports remain unreviewed. This results in incorrect charges, over-usage, incorrect plans assigned, employees no longer working in the department, and reassigning phones to other employees without notifying ISO of the changes required to ensure the billing information is true and correct. That said, ISO will continue to work with the departments to ensure a more efficient and effective information store in its Account 4 database.
ISO processes the order from the departments per the automated 1OC system being fully utilized since around 2020 and the cellular device is supplied directly to the stated employee at the time of deployment per the department's request. As soon as the phone leaves the hands of ISO, it is the department's responsibility to track the Sensitive Asset throughout its life in the department (See AO 1-3 Fixed Asset Inventory lnventoriable Assets c. attached). The proc ess works as long as the departments take responsibility for the city asset and continue to relay communiques to ISO when changes are needed or have been completed. While the TeleComm Team review s reports from the cellular carriers to ensure correct Plans are assigned, it is at the request of the department as to what they need/want for the employee based upon their knowledge and needs of the department. If a department does not notify ISO that an employee has left city service or has transferred to another department, ISO Personnel is not able to disconnect the service plan timely and charges will continue until the department informs us of the change.
Working with the Personnel Services Department (PSD), ISO developed an "Electronic Offboarding Form" that provides departments who are terminating employees the ability to define the disposition of mobile devices assigned to the employee. Th is has been included in the PSD Separation Packet since 6/2022. (attached). Departments should also be monitoring their monthly reports to ensure corrective action is taken if they perceive a problem in usage - ISO would have no knowle dge if the over/under usage is because of a conference the employee is attending, a City emergency or of any other circumstances that may arise with one of their employee's affecting the usages.
Management created the AO 8-11 as a Use Policy and not a How-To or Procedures policy for mobile devices. A new AO has been submitted to the City Manager's Office to address procedures on roles, accountability, and responsibilities for each department as well as for each employee receiving a city issued cellular device, however, as of this date, the AO has not been approved for publication. ISO continue s to follow up and has done so over the last year.
Management has attached supporting documentation for your reference.
ISO is committed to implementing the corrective actions associated with the Information Service Department promptly and would appreciate your confirmation of their sufficiency. Management is open to any discussions or additional suggestions you may have.
Recommended Best Practices 1a: 10C Forms were created for unfilled positions
Based on Internal Audit's analysis of the City's 10C Request Forms, it was identified there were six instances when the request form was created for multiple unfilled positions. The Internal Audit Unit determined that the selected department submitted the 10C request forms for positions that were intended to be filled in the future. For example, one form included a request to obtain thirty-three phones for unfilled positions.
The Internal Audit Unit determined that the selected department submitted the 10C request forms for positions they intended to fill in the future. As a result, the City incurred unnecessary charges that could have been avoided.
Recommended Best Practices 1b: Individual 10C Forms included multiple requests
Furthermore, based on the review, it was discovered that individual request forms reflected multiple requests for different employees. Internal Audit Unit identified 11 out of 24 forms assessed included requests for multiple devices on one form to obtain cellular devices.
Proposed Change:
Update AO 8-11 to clarify the procedure of assigning and obtaining devices to
limit requests to filled positions.
Recommended Best Practices 2: Cellular inventory system lacks consistent details
As part of the audit, the City’s Audit Committee requested the Internal Audit Unit to provide the total number of mobile cellular devices maintained by each department.
However, the Internal Audit Unit was unable to obtain past mobile cellular device count because the City’s cellular inventory management system, 'Account 4', does not maintain historical information. Furthermore, the device data is not appropriately Wireless Communication Audit
January 25, 2024
categorized in 'Account 4'. For example, there were instances where a mobile cellular device was inappropriately categorized or mislabeled as another device type or was not categorized. Therefore, the Internal Audit Unit was unable to properly confirm cellular information and device count during the audit scope period using 'Account 4'.
The Internal Audit Unit calculated the current mobile cellular device count based on the provider reports. In April 2023, the City had 453 active mobile cellular devices under its AT&T FirstNet provider. In May 2023, the City had 1,157 active mobile cellular devices under its Verizon provider. Figure 11 shows the number of mobile cellular devices assigned to each City department per provider. The Internal Audit Unit requested departments to provide their mobile cellular device inventory count to reconcile with the provider reports and determined discrepancies in the departments' current inventory records.
Figure 11: Number of Mobile Cellular Devices by Vendor, AT&T FirstNet April 2023 & Verizon May 2023
Source: AT&T FirstNet & Verizon Inventory report
Wireless Communication Audit
January 25, 2024
Proposed Changes:
Establish a database to maintain historical data pertaining to devices in 'Account 4'
Implement a data archiving system to ensure that there is a record of the device that includes device user history, maintenance record:
repairs/upgrades
o This information will assist the department in the future to make informed decisions about device use and maintenance going forward. Improve data accuracy by implementing data validation checks to ensure the accurate information is being entered into 'Account 4' to reduce errors and ensure data is consistent
Throughout the audit, the Internal Audit Unit noticed that there was a wide variety of device types since users were typing in instead of selecting from a limited list of options
Update guidelines to include definitions and examples of device types The Internal Audit Unit was unable to track changes that occurred during the audit since there is only current information (live website). Some devices have remarks that indicate changes made, but they do not have consistent structure/details.
Wireless Communication Audit
January 25, 2024