Proprietary & Confidential
FINAL REPORT
City of Stockton
INVENTORY INTERNAL CONTROLS INTERNAL AUDIT
February 11, 2022
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Attachment A
Inventory Internal Controls Internal Audit Report
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Table of Contents
Executive Summary 1
A. Scope and Methodology 1
B. Summary of Findings and Recommendations 1
Background, Scope, and Methodology 3
A. Background 3
B. Scope and Methodology 3
C. Commendations 5
Findings and Recommendations 6
Process Improvement Opportunities 16
Attachment A
Inventory Internal Controls Internal Audit Report | 1
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
EXECUTIVE SUMMARY
Moss Adams LLP (Moss Adams) was contracted by the City of Stockton (the City) to perform an internal audit to assess and test internal controls related to the City’s inventory management function and to identify opportunities for improvement. The internal audit was originally started in April 2021; however, due to delays that occurred and issues that were encountered during the transition to the new enterprise risk management (ERP) system, Tyler Munis (Munis), several procedures were put on hold and were not able to be completed until November 2021. The scope of this internal audit focused on assessing the overall inventory management process for adequate controls, testing the completeness and accuracy of inventory listings, and assessing the tracking and control of inventory on hand in comparison with best practices.
This engagement was performed in accordance with Standards for Consulting Services established by the American Institute of Certified Public Accountants. Accordingly, we provide no opinion, attestation, or other form of assurance with respect to our work or the information upon which our work is based. This report was developed based on information gained from our interviews and analysis of sample documentation. The procedures we performed do not constitute an examination in accordance with generally accepted auditing standards or attestation standards.
FINDINGS AND RECOMMENDATIONS
1. Finding
The City does not have documented policies and procedures over inventory management, resulting in a lack of understanding of controls that should be in place and significant control gaps over the inventory function.
Recommendation
Develop comprehensive policies and procedures over inventory management at the City-wide level that address the minimum control standards that must be followed at the Central Warehouse/Store, the MUD Warehouse/Store, and other departments that maintain smaller levels of inventory.
2. Finding
The annual physical inventory performed for both the Central and MUD Warehouse/Store did not include someone independent of the daily inventory management function performing all counts, results of the counts were not reconciled to the system timely, and documentation of variances being researched was not available. Spot checks/audits on inventory balances are not being performed regularly.
Recommendation
Improve the annual physical inventory process to require blind counts that are performed by employees independent of the inventory management function, a full reconciliation of the results be performed, variances be researched timely, and system adjustments be processed. Implement regular independent spot checks/audits of inventory balances.
Attachment A
Inventory Internal Controls Internal Audit Report | 2
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
FINDINGS AND RECOMMENDATIONS
3. Finding
The results of the last physical inventory count performed were not utilized in a meaningful way. Inventory items identified that had not been previously setup in the perpetual system were not researched or added following the count. Some inventory was counted twice, with different totals on hand identified, and subsequent research and resolution was not documented.
Recommendation
When physical inventory counts are performed, if inventory types are identified that were not previously established in the system, research should be performed to identify where there was a control breakdown in the City’s processes. Count results should be reconciled to the system immediately following the physical inventory, and variances should be researched and addressed timely.
4. Finding
Internal inventory purchases made by employees at the Central and MUD Stores may not be properly approved and monitored, acceptance of the inventory items is not documented, and regular monitoring of inventory charges to individual departments may not be performed. Inventory obtained is not linked to work orders or another means of tracking to track the subsequent use of the inventory obtained.
Recommendation
The City should evaluate the current internal department purchasing process and consider whether pre-approval should be required. Reports of inventory purchased should be run, by department and by employee, on a monthly basis to allow for department-level monitoring and a work order tracking process should be considered.
5. Finding
Duties are not adequately segregated within the inventory management function as Materials Specialists are responsible for all key aspects of the function, and there are not adequate mitigating controls, such as independent monitoring and oversight, to reduce the risk to the City.
Recommendation
Where possible, duties should be segregated, and in the absence for segregation, mitigating controls such as independent verifications of inventory received, logging of internal department purchases, department reviews of internal purchase activity, and independent inventory counts, should be implemented.
6. Finding
Physical security controls at both the Central Warehouse/Store and MUD Warehouse/Store are not adequate, which could result in unauthorized access or misappropriation of inventory.
Recommendation
Consider installing a security system at the Central Warehouse/Store and monitor access granted. If locks/keys will continue to be used, ensure all keys are properly accounted for and only issued to current employees who warrant them based on job responsibilities.
Review access currently granted to the MUD Warehouse/Store, ensure only current MUD employees have badge access rights, and monitor access going forward.
Attachment A
Inventory Internal Controls Internal Audit Report | 3
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
BACKGROUND, SCOPE, AND METHODOLOGY
The City has inventory maintained in two warehouses: Central Warehouse and the Municipal Utility Department (MUD) Warehouse. Both City warehouses operate a “store” function where defined City employees or departments go to obtain related inventory items (i.e., MUD Store and Central Store).
City inventory mainly consists of items for both the City’s Public Works and MUD activities. The City spends approximately $2 million on inventory purchases annually. The City transitioned to a new enterprise risk management (ERP) system, Tyler Munis (Munis), in fiscal year 2021. The original transition to the new ERP occurred in January 2021; however, there was a delay in reconciling data from the old system to the new system. Despite the delays in reconciling, the City began utilizing the inventory module, including recording purchase and the receipt of inventory, recording uses/decreases of inventory, and adjusting balances when physical counts were performed, as of January 2021.
Moss Adams was contracted by the City to perform an internal audit over internal controls related to the City’s inventory management function and to identify opportunities for improvement. This internal audit was performed as part of the Fiscal Year (FY) 2020–2021 Internal Audit Program. The internal audit originally started in April 2021. However, due to the implementation and reconciliation delays described above, several procedures were put on hold and were not able to be completed until November 2021.
The scope of this project was focused on internal controls related to the City’s inventory processes and was performed to assess the following objectives:
• Assess the overall inventory management process for adequate controls, compliance with policies and procedures, and best practices.
• Test the completeness and accuracy of inventory listings. • Assess the tracking and control of inventory on hand, such as supplies, tires, and safety equipment, that is expensed when purchased.
• Assess the reconciliation that was performed during conversion between the old system and the new system (Munis).
The procedures performed included:
• Interviews and Inquiries: In order to gain an understanding of the specific processes, controls and overall inventory management function, we conducted interviews with City personnel within the Procurement Department, MUD Store, and Central Store. • Document Review: We reviewed the Munis Inventory Management Procedure Manual, draft Desk Procedures for Material Specialist at Central Store and MUD Store, and other applicable inventory City desktop procedures and resources available.
Attachment A
Inventory Internal Controls Internal Audit Report | 4
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
• New Enterprise Resource Planning (ERP) System Implementation Analysis: We obtained a listing of the City-wide inventory as of December 31, 2020, which was produced from the City’s old module (HTE) and a listing of the beginning inventory balances in Munis as of January 1, 2021. We performed a high-level reconciliation between the balances in the old system and Munis, and for variances identified, we requested any supporting documentation available including the related journal entries recorded to adjust balances. • Testing: We performed the following detailed testing procedures:
○ Purchasing and Receiving:
− Warehouse Level Purchases: We obtained a listing of all purchases of inventory (i.e., expenses coded to City inventory G/L accounts) between January 1, 2021 and June 30, 2021 for each of both the Central Warehouse and the MUD Warehouse. Using these listings, we indiscriminately selected a sample of 20 purchases from each warehouse, obtained all supporting documentation that was available to support the related purchase, and tested for the following:
• Evaluated whether the delivery receipts (i.e., packing slips or receiving report) tied to the original approved purchasing documents.
• Assessed whether verification and approval of receipt was performed and documented.
• Evaluated for appropriate segregation of duties between the employee who purchased/ordered the inventory and the employee who received and verified the shipment/purchase.
• Assessed whether documentation supported that the inventory received was appropriately added to some form of inventory tracking system/log. − Internal Department Level Purchases: We obtained a listing of all internal department level purchases (i.e., employees within departments that come to one of the stores to obtain inventory) of inventory (i.e., expenses coded to department inventory G/L accounts) between January 1, 2021 and June 30, 2021. For each store/warehouse, we indiscriminately selected a sampled of 20 internal purchases that departments made, obtained all supporting documentation that was available to support the related purchase, and tested for the following:
• Evaluated whether there was documentation of any prior approval obtained by the employee for making the internal purchase for their department. • Assessed whether there was documentation of department acceptance and receipt of the inventory purchased.
• Determined if the purchased inventory items were accurately recorded in the system to remove the items from the inventory balances.
• Assessed whether the internal purchase was properly recorded as an expense to the department making the purchase.
○ Physical Inventory Counts: For both Central and MUD Warehouses/Stores, we requested all documentation related to the last physical inventory counts performed, which was December 30, 2020, and assessed the related documentation for the following:
− Inventory counts were performed by someone independent of those responsible for managing/handling the inventory on a regular basis.
− A full inventory count was performed, and the count process appeared to be effective and well controlled.
Attachment A
Inventory Internal Controls Internal Audit Report | 5
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
− A reconciliation was performed, any variances identified were researched, and documentation of resolution was made.
○ Physical Controls: We met with City personnel to develop an understanding of the current physical security controls in place and requested documentation to support physical security controls, where possible. We assessed whether security cameras with recording devices were in place over material inventory, inventory storage areas were locked or otherwise restricted, badge access was required to limit access to authorized individuals and that reports of access entry were monitored, and alarmed entry systems were in place.
Due to the COVID-19 pandemic, which was occurring at the time of this internal audit, we were unable to perform certain procedures as we were unable to go on site for testing. As a result, we were unable to fully assess physical security over inventory in person and had to rely on virtual interviews and photos of the stores provided.
Although the focus of this assessment was to identify opportunities for improvement, it is important to note the areas of commendable operations. The City should be commended for the following accomplishments:
• Readiness for Change: During interviews, feedback from City employees indicated that they try to manage and control inventory in their respective areas; however, they are unsure of the level of controls and tracking that should be in place. Employees were open to opportunities for improvement to ensure inventory is properly controlled.
We would like to thank City staff and management for their willingness to assist with this project.
Attachment A
Inventory Internal Controls Internal Audit Report | 6
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
FINDINGS AND RECOMMENDATIONS
1. Finding The City does not have documented policies and procedures over inventory management, resulting in a lack of understanding of controls that should be in place and significant control gaps over the inventory function.
Recommendation Develop comprehensive policies and procedures over inventory management at the City-wide level that address the minimum control standards that must be followed at the Central Warehouse/Store, the MUD Warehouse/Store, and other departments that maintain smaller levels of inventory.
The City does not have comprehensive policies and procedures covering the overall inventory management function, including the minimum internal controls that must be established and implemented at both City Warehouses/Stores. The only formalized policy and procedure manual in place for inventory management is the Desk Procedures Manual for Material Specialists, which covers general responsibilities and expectations of the Materials Specialists. As a result, there were significant gaps in internal controls across the City’s departments surrounding inventory.
City-wide policies and procedures covering inventory management should be developed that cover, at a minimum, the following key areas:
• Roles and responsibilities for inventory management including Materials Specialists and others involved.
• Definition of inventory including the types of inventory such as supplies, small tools, materials, and equipment.
• Purchasing and receiving of inventory, including the process of verifying inventory received against the receiving report/packing slip and the related purchase order, and a requirement for these duties to be adequately segregated or for a secondary independent verification to be performed.
• Receiving inventory directly in the system (i.e., purchase orders are in the system and when they receive items at the warehouses, the receiver goes in and selects the units/items that were received which automatically adds them to the inventory on hand in the inventory module within Munis).
• Requirements for internal purchases made by departments at the two City Stores including pre- approval requirements, documentation of inventory disbursed, change in custody documentation/sign-off and expense recording.
• Requirements for maintaining some level of detailed inventory listing for all material inventory (in quantity or based on the type of inventory being susceptible to misappropriation), outside of the inventory recorded in Munis. Define general dollar thresholds and qualitative characteristics for the minimum tracking requirements.
• Inventory reporting requirements to the Finance Department for financial reporting and general oversight.
Attachment A
Inventory Internal Controls Internal Audit Report | 7
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
• Periodic spot-checks/inventory counts performed by an independent party (e.g., Finance or other outside department/position).
• Physical inventory counts including frequency, segregation of duties, documentation, and reporting (refer to Recommendation 2).
• High-level controls over City inventory including trend analysis, reasonableness checks, budget- to-actual monitoring, department-level reviews, etc.
Management Response: The City has recently hired a consultant, Civic Initiatives, to develop a comprehensive manual that incorporates policies, procedures and best practices for procurement, including inventory management, at the citywide level to ensure appropriate controls are implemented and monitored over the inventory function.
2. Finding The annual physical inventory performed for both the Central and MUD Warehouse/Store did not include someone independent of the daily inventory management function performing all counts, results of the counts were not reconciled to the system timely, and documentation of variances being researched was not available. Spot checks/audits on inventory balances are not being performed regularly.
Recommendation Improve the annual physical inventory process to require blind counts that are performed by employees independent of the inventory management function, a full reconciliation of the results be performed, variances be researched timely, and system adjustments be processed.
Implement regular independent spot checks/audits of inventory balances.
As noted previously, formal inventory policies do not exist, however; based on discussions with management, it is current practice at the City that a full physical inventory count should be performed, at least annually, for all material inventory of the City. This inventory would include the following:
• A blind count would be performed including the printing of a system-generated Inventory Count Sheet, which identifies all inventory items that the City maintains, without any information as to the current system on-hand totals.
• The Materials Specialist at each warehouse would use the inventory count sheet to perform a full physical inventory count of all inventory on hand and document the totals counted. • The Procurement Specialist, who is not directly involved in daily management of inventory, participates in the inventory count process to ensure that all inventory counted is recorded accurately.
• A full reconciliation between the system totals and the amounts counted would be performed. • Variances less than 5% are considered reasonable and variances over 5% must be researched, documented, and resolved.
• An independent review of the results of the inventory would be performed (i.e., someone in Accounting or Finance).
Attachment A
Inventory Internal Controls Internal Audit Report | 8
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
The last physical inventory was performed in December 2020, prior to the transition to Munis. We obtained all supporting documentation for the physical inventory counts performed at both the Central and MUD Warehouse. In our assessment of the adequacy of the physical inventory counts performed, as well as follow-up interviews that were performed, we found that counts are not being performed in line with the expectations described above and the overall count process is not well- controlled.
Lack of Independent Counts/Reviews
Inventory count sheets, without on-hand totals, were utilized in the December 2020 count and the inventory count was split between the Materials Specialist and Procurement Specialist; however, each counted half of the inventory independently without a second verification of count results. The Purchasing Specialist is not involved in the daily handling of inventory resulting in their half of the count being a blind, independent count. However, for the half counted by the Materials Specialist, who is also responsible for daily inventory management including running daily inventory levels report, initiating purchases, handling inventory on hand daily, and recording inventory uses, did not include an independent review/verification. This creates a segregation of duties risk given the Materials Specialist has unrestricted access to handling inventory daily, adjusting balances by recording department uses, and knowing the system totals at any point in time.
In addition, based on review of the support provided, there was no documentation that someone outside of the inventory management function, such as Accounting or Finance, had reviewed the count results.
Incomplete Physical Inventory Count
Based on our assessment of the Inventory Count Sheets provided for the December 2020 physical inventory performed, a full/complete count of all inventory on hand may not have occurred. There was a total of 105 individual inventory line items on the Inventory Count Sheets that did not have a count recorded and there was no indication, such as “0” or “none”, that the individual performing the inventory verified that there were no quantities on hand at the time of the count. The lack of documentation makes it unclear whether a full count of all inventory on hand occurred.
Lack of Reconciliations and Unresolved Variances
LOCATION VARIANCES
MUD Warehouse/Store $12,101
Central Warehouse/Store $140,336
Total $152,437
For both locations, the total inventory on hand (as counted) was more than the system inventory balances and many individual accounts contained variances more than 5%. There was no documentation that individual variances had been researched, adjusted or resolved internally.
Attachment A
Inventory Internal Controls Internal Audit Report | 9
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
Lack of Spot Checks/Audits
An independent spot check/audit process has not been established to regularly monitor the City’s inventory. There had been no spot checks/audits performed since the last physical count was performed in December 2020.
Physical inventory counts represent an opportunity for the City to periodically assess the inventory balances and use the results to determine if the ongoing daily inventory controls appear to be functioning effectively. Physical counts also allow for significant variances or issues to be identified timely, by someone independent of the inventory management/handling functions, and for those variances/issues to be researched and addressed to ensure that the City’s large investment in inventory is protected and well-controlled. The following recommendations should be considered to improve the City’s current physical inventory process:
• A full annual physical inventory should be performed for all material inventory balances. Blind counts should be used, which includes printing inventory lists without current inventory totals, to perform the count. The individual(s) performing the counts should record the results blindly, without having insight into what the system totals reflect. If items are on the listings but there are no quantities on hand at the time of the count, “0” or “none” should be noted. • All inventories should be counted by someone independent of the daily inventory management function. If Materials Managers are involved in the count, a second individual who is deemed independent should be involved with the full physical count process. • Following the count, a full reconciliation between the inventory counted/on hand and the system inventory balances should be performed. All variances over a defined threshold should require research and documentation of the results, and approved adjustments to update/correct the inventory levels in Munis should be recorded.
• All inventory documentation should be reviewed by someone independent of the inventory management function to ensure the count was performed, the results were reconciled, and variances were appropriately researched and adjusted.
In addition, the City should consider implementing a process where an independent department such as the Finance Department perform regular (quarterly or other) spot checks/audits. These spot checks/audits should involve selecting a sample of inventory items, on a rotating basis, at both warehouse/store locations, and comparing the system totals to the inventory on hand and researching any variances. Best practices require that a department/position outside of the inventory management function, perform regular spot checks or audits of the inventory balances on hand to assess whether the perpetual inventory system/process is functioning effectively, and that inventory variances or control issues are identified and addressed timely.
Management Response: The annual physical inventory count is already part of the fiscal year-end schedule. Going forward, the Administrative Services Department (ASD) will utilize an independent entity (such as the General Ledger team) to provide an independent review of the process. This will allow an improved annual physical inventory process and full reconciliation of results – including the incorporation of regular independent spot checks. This independent review will be incorporated into the policies and procedures noted in the response to Finding 1.
Attachment A
Inventory Internal Controls Internal Audit Report | 10
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
3. Finding The results of the last physical inventory count performed were not utilized in a meaningful way. Inventory items identified that had not been previously setup in the perpetual system were not researched or added following the count. Some inventory was counted twice, with different totals on hand identified, and subsequent research and resolution was not documented.
Recommendation When physical inventory counts are performed, if inventory types are identified that were not previously established in the system, research should be performed to identify where there was a control breakdown in the City’s processes. Count results should be reconciled to the system immediately following the physical inventory, and variances should be researched and addressed timely.
The City utilizes a perpetual inventory system to account for all inventory maintained at both the Central and MUD Warehouses/Stores. The expectation is that all inventory is accounted for through the system to allow for accountability and control and that the physical count process provides a control to ensure that missing inventory items are identified, researched, and corrected.
During our review of the documentation provided to support the December 2020 physical inventory count, there were manual, hand-written listings provided, which appeared to have been used for documenting those inventory types that were not included as types of inventory on the system generated report. For example, if during the count process there were “pumps, size 23” found on hand; however, on the system listing used for the blind count (which shows each type of inventory that is setup in the system and may be found during the count), the item “pumps, size 23” was not included, the individual counting the inventory would handwrite “pumps, size 23, 12 units” to record the count results. To assess whether these hand-written count results were adequately researched and followed through on to get the inventory setup and recorded in Munis following the count, we documented the individual inventory lines written (location, inventory account number, units counted) and attempted to trace the items to the updated Munis system reports. Based on this testing, we found that the inventory count results were not followed-up on to ensure that the inventory item types and amounts on hand were added to Munis to account for the inventory going forward. Specifically, we found the following:
• Twenty-four different inventory item account numbers, and related count totals (153 individual units), that were handwritten on the manual count sheet; however, they did not appear to have been researched and updated in Munis following the count. These inventory account numbers had not been included on the original system generated Inventory Count Sheets used to perform the count (i.e., those account numbers had previously been accounted for in the system). After being located and counted during the physical inventory process, they were not subsequently added to Munis to establish the setup of the previously unrecorded inventory type (account number, inventory description, etc.) was not established and the counted units were therefore not input to reflect the inventory on hand.
• Six different inventory item account numbers, and related count totals, that were handwritten; however, the account numbers were not legible and therefore, we were unable to determine if they were subsequently added to Munis for tracking.
Attachment A
Inventory Internal Controls Internal Audit Report | 11
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
• Fifty-five different inventory item account numbers, and related count totals, that were handwritten; however, after researching these items, we were able to locate them on the original system-generated Inventory Count Sheets used for the count. It appeared these items had been counted twice and the amount counted when the item number was handwritten and the amount counted, as noted on the original Inventory Count Sheets were different. These differences had variances totaling 892 individual units, and there was no documentation that these differences had been identified or researched, and subsequent recounts were not performed.
The benefit of performing a full physical inventory count is to allow the City to ensure that all inventory is being accurately accounted for and controlled using the perpetual inventory system. It provides an opportunity to identify issues, perform research to determine the ultimate cause, when possible, and to update the City’s system to allow for accountability and tracking going forward. All inventory items maintained at both the Central and MUD Warehouses/Stores should be tracked using the perpetual system. Going forward, when physical inventory counts are performed, if individual types of inventory are identified that were not previously established in the system, research should be performed to identify where there was a control breakdown in the City’s processes. The identification of missing items (items never established in the system) implies that inventory was received at some point, and never added into the system for tracking, and could be indicative of an underlying breakdown between the purchasing function and inventory function within the City’s ERP. Implementing a full reconciliation process and independent review of the count results should help in preventing future variances from not being addressed timely. Refer to Recommendation 2, which addresses handling of other variances identified during the count process.
Management Response: This finding is due to the understaffing of the City’s stores operations, high demand and sourcing mandates of materials due to the COVID-19 pandemic, implementation of the City’s new Enterprise Resource Planning (ERP) system, and lack of existing procedural documents.
The City is exploring resources, including additional personnel and written procedures, to address this issue in a timely manner.
4. Finding Internal inventory purchases made by employees at the Central and MUD Stores may not be properly approved and monitored, acceptance of the inventory items is not documented, and regular monitoring of inventory charges to individual departments may not be performed. Inventory obtained is not linked to work orders or another means of tracking to track the subsequent use of the inventory obtained.
Recommendation The City should evaluate the current internal department purchasing process and consider whether pre-approval should be required. Reports of inventory purchased should be run, by department and by employee, on a monthly basis to allow for department-level monitoring and a work order tracking process should be considered.
Attachment A
Inventory Internal Controls Internal Audit Report | 12
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
The Central Store is used for employees of the City to come to and obtain or purchase inventory for their department/program. The MUD Store serves the same function for employees within the Municipal Utilities Division. These stores, which are connected to the Central and MUD Warehouses, hold the majority of the City’s inventory on hand, and provide centralized locations for departments to go to obtain inventory. Currently, when a department needs inventory, a designated employee will go to the appropriate store to request and obtain the inventory needed. Based on interviews performed, the process of requesting an internal purchase, obtaining prior approval, and documenting the transfer of the inventory is not well controlled.
When an employee makes a purchase, their badge is scanned into the Munis system, which implies that the system is tracking who makes the purchase, what inventory is being disbursed, and what department will be charged; however, there is no documentation required to show that 1) pre- approval for the internal purchase was obtained (from a supervisor/director), 2) the change in custody such as the receiving employee signing to acknowledge the inventory they obtained. For January through August 2021, there were approximately $850,000 of internal purchases made at the MUD Store and $143,000 from the Central Store. These purchases are not linked to individual work orders to track the use of the inventory obtained.
The City should evaluate the current internal department purchasing process at these stores to consider whether documentation of pre-approval should be required. On a monthly basis, a Department Withdrawal Report, which details all internal inventory charges, by department, should be run and provided to the appropriate supervisor/director level within respective departments. An additional report may be able to be run to show the individual employee identification numbers and names who purchased which inventory items. These listings should be reviewed for reasonableness, including a comparison to the department’s budget, to help reduce the risk that unapproved or inappropriate internal purchases are being made or that inventory is being incorrectly charged to the wrong department. In addition, given the volume of internal inventory purchases, the City should evaluate whether an internal work-order process should be established to track the subsequent use of inventory obtained.
Management Response: The new Enterprise Resource Planning (ERP) system, through the requisition Pick-Ticket program, will help address this finding. ASD will collaborate with other City departments to explore feasible options to achieve and maintain efficiencies using a pre-approval process. Upon implementation of Phase 3 of ERP (Payroll and Human Resources modules), departments will have the ability to monitor and track purchases made by their respective employees at the department level.
Attachment A
Inventory Internal Controls Internal Audit Report | 13
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
5. Finding Duties are not adequately segregated within the inventory management function as Materials Specialists are responsible for all key aspects of the function, and there are not adequate mitigating controls, such as independent monitoring and oversight, to reduce the risk to the City.
Recommendation Where possible, duties should be segregated, and in the absence for segregation, mitigating controls such as independent verifications of inventory received, logging of internal department purchases, department reviews of internal purchase activity, and independent inventory counts, should be implemented.
Best practices require that key duties within the inventory management function are appropriately segregated to prevent misappropriation of inventory occurring and not being identified timely. Duties within the City’s inventory functions are not adequately segregated, and there is a lack of monitoring controls over the Material Specialists. Currently, Materials Specialists at each Warehouse/Store have access and/or responsibility for the following:
• Handling inventory on hand daily (stocking, organization, monitoring balances, etc.) • Initiating purchase requests
• Physically receiving inventory purchased, verifying the inventory received and recording the receipt into the inventory system which increases the perpetual inventory balances • Processing inventory purchases made by City employees at the stores including physically obtaining and disbursing the inventory and recording the internal purchases which recognizes the expense to the employee’s department. These purchases decrease the perpetual inventory balances
• Conducting the annual physical inventory counts of a portion of the inventory at their site During testing related to the supporting documentation for 40 inventory purchases made by the Central and MUD Warehouses, in all cases, the purchases were requested by the same Materials Specialist that received the inventory. Based on interviews performed, adequate mitigating controls such as secondary verifications, documented reviews, and real-time monitoring/oversight were not identified. Given that Materials Specialists have access to, and are responsible for performing, substantially all duties within the inventory function at their location, without regular independent reviews and monitoring, there is a significant segregation of duties risk present. Materials Specialists could potentially purchase inventory, receive that inventory, and record an internal purchase to remove the inventory from the on-hand totals. Currently, there is not a process in place to document the employee who is making a purchase at one of the stores, and there is no process for documenting prior approval for those internal purchases. As a result, inventory stolen or otherwise misappropriated would likely not be identified.
The responsibilities of the Materials Specialists should be evaluated to determine where duties could be segregated or mitigating controls could be implemented. Specifically, the following changes would help to reduce the risk described above:
Attachment A
Inventory Internal Controls Internal Audit Report | 14
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
• Segregate the duties of purchasing and receiving inventory. If this is not possible, require that a second individual, independent of the inventory purchasing/ordering function, review the inventory received, including verifying that the physical inventory items received tie to the receiving report/slip and system entries, and that this review/verification be documented. • Implement controls for recording/documenting internal “purchases” such as through purchase logs or internal purchase request forms to document the employee making each department-level purchase and the transfer of custody of the related inventory items (refer to Recommendation 4). • Require that the Department Withdrawal Report, which is a report from Munis that details the inventory charges, by department, be ran and provided to all departments that had internal purchases each month. Departments should be required to acknowledge the internal purchase charged to their department monthly. Departments should be encouraged to monitor their internal purchases and the related budget to actual expenses.
• Require independent counts be performed during the annual physical inventory count process (refer to Recommendation 2).
• Develop and implement City-wide inventory management policies and procedures that document the required segregation of duties for all inventory sites (refer to Recommendation 1).
Management Response: Key duties may not be adequately segregated due to limited staffing, added workload due to the COVID-19 pandemic, and lack of documented procedures. The inventory management team will utilize the new ERP inventory reporting function to explore segregation of duty options within existing processes. This will be paired with documented procedures and additional staffing resources (subject to approval).
6. Finding Physical security controls at both the Central Warehouse/Store and MUD Warehouse/Store are not adequate, which could result in unauthorized access or misappropriation of inventory.
Recommendation Consider installing a security system at the Central Warehouse/Store and monitor access granted. If locks/keys will continue to be used, ensure all keys are properly accounted for and only issued to current employees who warrant them based on job responsibilities.
Review access currently granted to the MUD Warehouse/Store, ensure only current MUD employees have badge access rights, and monitor access going forward.
Given the large investment that the City makes in inventory, it is important to ensure that the physical security controls are adequate to prevent unauthorized access or misappropriation. During interviews performed, we found that physical controls could be improved at both the Central and MUD Warehouses/Stores. Specifically:
Attachment A
Inventory Internal Controls Internal Audit Report | 15
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
• Central Warehouse/Store: The Central Warehouse/Store has security cameras installed over the areas where inventory is maintained. However, based on discussions, a security system or other type of badge entry system is not in place. As a result, there is no daily recording of who comes in/out of the store. In addition, the store and warehouse are currently secured via lock/key; however, a listing of how many keys are issued, and to whom each key is issued, is not maintained.
• MUD Warehouse/Store: The MUD Warehouse/Store has security cameras installed over the areas where inventory is maintained. A security system is installed which requires employees to have a badge to enter the store, allowing for a detailed record of all employees who swipe in/out.
Based on discussions, only MUD employees should have access rights on their City badge to access the store; however, a listing of all employees that are granted access could not be provided. We obtained the access logs showing employees that had badged in/out; however, in the absence of a listing of authorized employees, we were unable to determine if access was properly restricted to only MUD employees.
The City should consider installing a security system at the Central Warehouse/Store. A security system would provide increased control and monitoring of the inventory during non-business hours and would allow for real-time tracking of who comes in/out of the store and warehouse areas. If a security system is installed, access to the Central Store could be granted to all (or designated) City employees while access to the Central Warehouse could be restricted to those few designated employees that warrant access based on their job responsibilities (Materials Specialists, etc.). Access levels should be monitored regularly so that access is properly removed upon termination or transfer.
Until a security system is installed, keys to the Central Warehouse and Store should be inventoried and accounted for. A log of those individuals with keys should be maintained and properly monitored/controlled.
The City should monitor the access granted to the MUD Store to ensure that only MUD employees have badge-entry access granted through their City-issued badge. If any employees that are not currently working within MUD are found to have access, the access should be terminated. Access should be monitored regularly to ensure that upon termination or transfer, access is terminated timely to prevent unauthorized access.
Management Response: ASD is currently looking into card access entry at central stores; this will help monitor store items and prevent unauthorized access and/or misappropriation of inventory. Staff will collaborate with other City departments to maintain adequate records of appropriate staff authorized to access central stores.
Attachment A
Inventory Internal Controls Internal Audit Report | 16
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
PROCESS IMPROVEMENT OPPORTUNITIES
Moss Adams identified two opportunities for process improvement as a result of this internal audit. The following tables summarize these recommendations.
CATEGORY PROCESS IMPROVEMENT RECOMMENDATION
1 ERP Implementation
and Reconciliation
Although immaterial, whenever the City does a system transition, or any kind of update that requires large volumes of data to be transferred/imported in, there should be a timely reconciliation process to verify that the data transferred out/in reconciles. Variances should be identified and resolved at that time to ensure the integrity of the balances going forward.
During our reconciliation between the inventory balances exported from the old (HTE) system and the balances imported into MUNIS, we identified the following variances.
Inventory Value on Hand
Store/Warehouse HTE (Old System) MUNIS (New System) Variance MUD $1,964,922 $1,971,357 $6,435
CS $440,892 $459,260 $18,368
Total Variance (MUNIS over HTE) $24,803
Number of Inventory Items on Hand
Store/Warehouse HTE (Old System) MUNIS (New System) Variance MUD 3,250 3,200 (50)
CS 1,773 1,762 (11)
Total Variance (MUNIS under HTE) (61)
Attachment A
Inventory Internal Controls Internal Audit Report | 17
FOR INTERNAL USE OF CITY OF STOCKTON ONLY
CATEGORY PROCESS IMPROVEMENT RECOMMENDATION
The variances in both inventory value and units indicate that some errors occurred during the export/import process.
However, there was no documentation that this reconciliation was performed by the City or that variances identified were researched and resolved.
2 Receiving Function During our analysis of the supporting documentation for 40 purchases of inventory, there were many instances where the City could not provide adequate documentation to support the receiving process, such as a receiving report/packing slip with notes and signature or a Purchase Order Inquiry Report from MUNIS showing quantities were marked as “received.” The employee receiving inventory should verify the contents upon receipt including comparing the items to the receiving report/packing slip and the related purchase order and document the verification performed on the receiving report/packing slip and by documenting, by line item, the “receipt” in MUNIS.
Attachment A
Attachment A