Internal Audit Report. Public Transportation Grant Management TxDOT Office of Internal Audit

Internal Audit Report Public Transportation Grant Management TxDOT Office of Internal Audit

Objective To determine if effective and efficient controls are in place for grant administration. Opinion Based on the audit scope areas reviewed, control mechanisms require improvement and only partially address risk factors and exposures considered significant relative to impacting financial reporting reliability, operational execution, and compliance. The organization's system of internal controls requires improvement in order to provide reasonable assurance that key goals and objectives will be achieved. Significant improvements are required to correct control gaps and mitigate residual risk that may result in potentially significant negative impacts to the organization including the achievement of the organization's business/control objectives. Overall Engagement Assessment Needs Improvement Finding 1 Finding 2 Finding 3 Title Request for Reimbursement Approval Process Sub-recipient Monitoring and Public Transportation Coordinator Oversight OMB Circular A-133 Single Audit Requirements Findings Control Design Operating Effectiveness Rating x x Needs Improvement x x Needs Improvement x x Needs Improvement Management concurs with the above findings and prepared management action plans to address deficiencies. Control Environment The Public Transportation Division (PTN) views its role as business partner with the subrecipients as critical to the overall success of public transportation grant programs at TxDOT. PTN views monitoring and oversight of the sub-recipients and their usage of grant funds as important; however, control and monitoring activities that are currently implemented do not provide adequate monitoring and oversight to ensure that grant requirements are met. August 1, 2014 2

Summary Results Finding Scope Area Evidence It was determined through audit activities that: 41 of 51 (80%) Requests for Reimbursements (RFRs) were paid without review of source documents: o Accounting summaries, which are developed by the sub-recipients and provide high-level summaries of expenses, were submitted for each RFR. Sub-recipient 10 RFRs submitted had Monitoring accounting summaries that were 1 not created through the system s accounting system. All expenditures on the RFRs are not reviewed as part of the quarterly review: 71 expenses, or $469K of $16.6M (3% coverage), were reviewed from the RFRs selected for testing. 36 of 71 (51%) items did not have source documentation that clearly describe or identify if the good or service purchased was related or essential to the purpose of the grant. 2 Program Oversight It was determined through audit testing that: Public Transportation Division (PTN) procedural manuals do not reflect the new reporting structure. This structure was adopted in 2012. Manuals do not provide information on how PTN will provide oversight to the Public Transportation Coordinators (PTCs), including when training visits or Technical Assistance Reviews will occur. Manuals do not include information related to monitoring sub-recipients that are considered high-risk, as identified by PTN, including whether source documentation for RFRs should be required and retained. Manuals do not reflect current guidance for use of Improvement Action Plans (IAP), which are used by PTCs to document a sub-recipient s compliance deficiency and plan for corrective action. August 1, 2014 3

3 Sub-recipient Monitoring PTCs are not always using IAPs even when additional monitoring is prescribed: 2 of 10 (20%) IAPs required of sub-recipients were not issued. It was determined through audit activities that: 1 of 10 (10%) sub-recipients did not submit an A-133 Single Audit Report or a letter selfcertifying that they did not need an A-133 Single Audit Report by the required time; PTN was not aware of the status. PTN was unable to provide a list of which subrecipients had submitted an A-133 Single Audit Report or a letter self-certifying that they did not need an A-133 report for FY2011 FY2013 audit cycles. Audit Scope The audit was performed by Azana Headspeth, Letta Hinton, Timothy Owen, and Sonya Ayers (Engagement Lead). The audit was conducted during the period from March 24, 2014 to May 30, 2014. Methodology The methodology used to complete the objectives of this audit included: Reviewing applicable federal and state laws and regulations Reviewing key documents, including relevant Master Grant Agreements (MGA), Project Grant Agreements (PGA), organizational charts, and internal memos Interviewing key personnel, including Public Transportation Coordinators (PTC) and Public Transportation Division staff Reviewing prior audit reports for applicable findings, including the State Auditor s Office (SAO) and Federal Transportation Administration (FTA) reports Reviewing Request for Reimbursements, Quarterly Reviews, Annual Reviews, and Technical Assistance Review documentation The scope of the audit was from the fourth quarter in Fiscal Year (FY) 2013 to the second quarter of FY2014 for the Request for Reimbursements and quarterly review documentation; and from FY2011 through FY2013 for the A-133 compliance report. These procedures were applied as necessary to perform the audit fieldwork. Background This report is prepared for the Texas Transportation Commission, TxDOT Administration, and Management. The report presents the results of the Public Transportation Grant Management Audit which was conducted as part of the FY 2014 Audit Plan. The Public Transportation Division (PTN) administers several federal grant programs and state grant programs for transit projects. In FY2012, PTN had about $470 million in funding from the state and federal government for programs with active project grant agreements August 1, 2014 4

with sub-recipients. The grant programs help facilitate the development of public transportations services to meet the growing needs of Texans across the state, including rural areas. PTN provides the grant funding to the sub-recipients for project use. Most of the sub-recipients have received funding from PTN for several years. To help support the administration of the grants to sub-recipients, PTN has staff in Austin Headquarters and throughout the districts. There are 28 Public Transportation Coordinators (PTCs) located across the state that work directly with the sub-recipients. The PTCs review the Request for Reimbursements (RFR), conduct quarterly and annual reviews, and monitor the sub-recipients compliance with grant requirements. PTN staff located in Austin headquarters, known as PTN HQ, is responsible for providing oversight to the PTCs and working with sub-recipients on ensuring A-133 compliance. We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards and in conformance with the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Recommendations to mitigate risks identified were provided to management during the engagement to assist in the formulation of the management action plans included in this report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Office of Internal Audit transitioned to Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Integrated Framework version 2013 in December 2013. A defined set of control objectives was utilized to focus on reporting, operational, and compliance goals for the identified scope areas. Our audit opinion is an assessment of the health of the overall control environment based on (1) the effectiveness of the enterprise risk management activities throughout the audit period and (2) the degree to which the defined control objectives were being met. Our audit opinion is not a guarantee against reporting misstatement and reliability, operational sub-optimization, or non-compliance particularly in areas not included in the scope of this audit. August 1, 2014 5

Detailed Findings and Management Action Plans (MAP) Finding No. 1: Request for Reimbursement Approval Process Condition Public Transportation Coordinators (PTCs) are approving Requests for Reimbursements (RFRs) without reviewing source documentation of the expenses. Unless otherwise determined due to sub-recipient specific issues, sub-recipients are not required by the Public Transportation Division (PTN) to submit source documents showing the expenses that have been incurred and paid for using grant funding before reimbursements are made. Insufficient supporting documentation (account summaries) provided to support RFRs were identified. Effect/Potential Impact Reimbursements may be made to grant sub-recipients for ineligible expenses. Sub-recipients may be using grant money for items that are not in line with the purpose of the grant. Funds paid out for ineligible expenditures may be difficult to recover from sub-recipients. The Federal government may require the agency to pay back any funding that found to be unallowable. Criteria The Grants Management Manual, Texas Administrative Code (TAC), and US Code state that records need to identify the source and application of funds for grant-supported activities, and that any accounting records need to be supported by source documentation. Further, reimbursements can only be submitted and paid for items that are eligible costs. Cause A process has not been developed to ensure adequate review of the RFR to determine that reimbursement amounts are adequately supported in the initial or quarterly review. Accounting summaries, which are required to be submitted along with the RFRs, are supposed to be developed by the sub-recipient through their accounting system. However, not all accounting summaries reviewed were developed by their accounting system and some included handwritten notes/adjustments or were developed through a spreadsheet. The summaries provide high-level spending information, but they do not show individual expenses that are being requested for reimbursement. It was discovered during our audit testing that PTCs do review some source documentation for specific items but only after the RFR has been paid. These quarterly reviews are limited since they do not look at all the source documentation for the RFR and very few RFRs are actually selected for review. PTCs are also examining documentation for only one or two items in the operating and administrative expense categories for each RFR, which often don t amount to a very high amount of coverage. August 1, 2014 6

Evidence The evidence obtained in the review included: 41 of 51 (80%) RFRs were approved and paid by the PTC without review of source documents. These 41 RFRs did have accounting summaries provided, which are supposed to be created through the system s accounting system o 10 RFRs submitted had accounting summaries that were not conclusively created through the system s accounting system. All expenditures on the RFR s are not reviewed as part of the quarterly review (PTN-126) from fourth quarter of Fiscal Year(FY)2013 to the second quarter of FY2014 o 71 expenses ($469K of $16.6M (3%)) submitted for reimbursement and paid to sub-recipients were reviewed for source documentation during the quarterly review: 36 of 71 (51%) expenses had source documentation that did not clearly describe or identify if the good or service purchased was related or essential to the purpose of the grant 5 of 36 (14%) expenses did not include source documentation that identified the good or service purchased 5 of 36 (14%) expenses did not include source documentation that clearly identified the parties paid 3 of 36 (8%) expenses did not include source documentation that clearly identified the purchase date of the good or service Management Action Plan (MAP): MAP Owner: Donna Roberts, Section Director, Public Transportation Division (PTN) MAP 1.1: PTN agrees to strengthen the process for conducting quarterly reviews of financial records to ensure increased coverage of operating and administrative categories expenses reviewed. At a minimum, we will review the source documentation for 30% of the line items within each budget category associated with a reimbursement request. We have already updated our quarterly monitoring form to allow for the increase in coverage. PTN also agrees to implement a 2 nd level approval for any request for reimbursement (RFR) of $250,000 or more and has already included this requirement in the reimbursement form drafted for use under the new Enterprise Resource Planning system (ERP). For those agencies who have a history of financial compliance and offer little risk, our procedures will continue to allow for the processing of RFRs with supporting documentation that consists of a general ledger report, produced from the sub-recipient s accounting system, as long as the report indicates the specific grant program, total budget, expenditures to date, amount of expenditures requested for reimbursement by category (administrative, operating, capital), and description of line items for each category. We will provide guidance on documentation requirements including type of documentation by budget category and when source documents are reviewed at the time of reimbursement. August 1, 2014 7

We will update our recently developed Standard Operating Procedures (SOPs) with these new requirements for conducting and documenting financial reviews. The new requirements, along with the updated quarterly monitoring form, and updated ERP form, will be introduced at the July 2014, PTC Workshop, with full implementation targeted for fiscal year 2015. Completion Date: January 15, 2015 August 1, 2014 8

Finding No.2: Sub-recipient Monitoring and Public Transportation Coordinator Oversight Condition Limited standardized guidance has been provided by Public Transportation Division (PTN) to the Public Transportation Coordinators (PTCs) related to monitoring techniques of subrecipients and PTN s oversight of PTCs. Currently, monitoring techniques are inconsistent between PTCs. The PTCs are responsible for the day-to-day interaction in the Districts with sub-recipients, including ensuring the sub-recipients are adhering to grant requirements, reviewing sub-recipients Request for Reimbursements (RFR), conducting quarterly and annual reviews of their sub-recipients, and signing the grant agreement with the subrecipient. Effect/Potential Impact Without consistent oversight and guidance available in up-to-date Standard Operating Procedures (SOPs), there is an increased risk that PTCs will fail to meet performance and management expectations and will not ensure use of grant funds for their intended purposes through proper monitoring techniques. Criteria The U.S. Federal Transit Administration s (FTA) Grant Management Guidelines establish TxDOT s obligation for developing and maintaining adequate internal control over all functions that affect implementation of a grant program. Adequate internal control includes monitoring and overseeing controls to ensure that the operating controls (e.g., SOPs) are operating as intended. Cause Guidance and processes to provide PTCs with the necessary tools for adequately monitoring sub-recipients have not been sufficiently documented. SOPs, that define when increased monitoring of the sub-recipient is needed or when a subrecipient should be put on an Improvement Action Plan (i.e., control weakness has been identified), have not been clearly defined or developed. Evidence Guidance for Monitoring Sub-recipients Procedural manuals do not reflect the new reporting structure. This structure was adopted in 2012. o Manuals do not provide information on how PTN will provide oversight to the PTCs, including when training visits or Technical Assistance Reviews will occur. o Manuals do not include information related to monitoring sub-recipients that are considered high-risk, including whether source documentation for RFR needs to be required o Manuals do not reflect current guidance for use of IAPs, which are used by PTCs to document a sub-recipient s compliance deficiency and plan for corrective action PTCs do not use Improvement Action Plans (IAP), even when high-risk sub-recipients have been identified and additional monitoring is prescribed: August 1, 2014 9

o 2 of 10 (20%) sub-recipients reviewed had been identified as high-risk and increased monitoring and retention of RFR source documentation was advised: 1 of 2 (50%) sub-recipients reviewed by PTC, as part of routine quarterly reviews, identified non-compliance with grant regulations; no IAP was issued No IAPS were issued for these sub-recipients Management Action Plan (MAP): MAP Owner: Donna Roberts, Section Director, Public Transportation Division (PTN) MAP 2.1: All written division guidance used to communicate program management and oversight procedures will be updated by January 15, 2015. A set of Standard Operating Procedures (SOPs) is scheduled for distribution by August 31, 2014. These SOPs will provide detailed guidance for sub-recipient monitoring and enhance current training and technical assistance methods which include: New Public Transportation Coordinator (PTC) orientation, on-the-job training and mentoring, formal classroom training, written form-specific procedures, regularly scheduled PTC meetings and workshops held four times a year, and visits from headquarters staff to the field (on a rotational basis) to review PTC operations in depth. The SOPs will require that all compliance deficiencies and need for corrective action are documented on the Improvement Action Plan (IAP) form and included in the tracking log. This was discussed in detail at our July 2014 PTC Workshop. New PTC orientation, on-the-job training, PTC meetings and regularly scheduled workshops will be used as opportunities to clarify the importance of documenting compliance program deficiencies and the value of anticipating and addressing potential compliance program issues through technical assistance and training. Completion Date: January 15, 2015 August 1, 2014 10

Finding No. 3: OMB Circular A-133 Single Audit Requirements Condition Public Transportation sub-recipients have not consistently submitted their A-133 Single Audit Report status or a letter self-certifying that they do not need an A-133 Single Audit Report to the TxDOT External Audit& Advisory Services Section (EXT) for review. The report submittal and review may prompt follow-up actions to be taken by the Public Transportation Division (PTN). Finally, PTN was not aware of which sub-recipients had submitted an A-133 report to the EXT. Effect/Potential Impact TxDOT may not be aware whether their sub-recipients have processes in place to ensure compliance with A-133 Single Audit requirements. In addition, there is an increased risk that follow-up on findings related to Public Transportation Grants are not being completed as required by A-133 requirements. Criteria U.S. Office of Management and Budget (OMB) Circular A-133, Section 400, requires TxDOT to ensure that each sub-recipient expending $500,000 or more in all federal awards (e.g., including awards given to the sub-recipient from another agency) in one fiscal year needs to obtain an OMB Circular A-133 Single Audit and provide a copy of the report to TxDOT. TxDOT is required to follow-up on any A-133 findings that relate to grants given by them. PTN identifies all grant sub-recipients and sends them an e-mail notifying them that they need to submit their A-133 Single Audit report or a letter self-certifying that they do not need an A-133 report to EXT. It is PTN s responsibility to monitor that sub-recipients complete an A-133 report. EXT will track receipt of the report or letter self-certifying that they do not need to complete an A-133 report, review the report, and let PTN know if follow-up is required by them. If follow-up is required, PTN will need to assign corrective action to the sub-recipient and monitor until completion. Cause The current TxDOT process developed with PTN and EXT is not being followed to ensure that all sub-recipients: 1) are identified, 2) have submitted their A-133 Single Audit Report or a self-certifying letter, and 3) follow-up of any A-133 finding is completed, when necessary. Further, PTN HQ did not follow-up with the EXT to ensure that all sub-recipients had submitted an A-133 report status. Evidence The evidence obtained in the review included: 1 of 10 (10%) sub-recipients did not submit an A-133 Single Audit Report or a letter selfcertifying that they did not need an A-133 Single Audit Report by the required time (i.e., a maximum of nine months after the close of the sub-recipients fiscal year). PTN was unable to provide a list of which sub-recipients had submitted an A-133 Single Audit Report or a letter self-certifying that they did not need an A-133 report for FY2011 FY2013 audit cycles. August 1, 2014 11

Management Action Plan (MAP): MAP Owner: Donna Roberts, Section Director, Public Transportation Division (PTN) MAP 3.1: PTN will meet with External Audit & Advisory Services Section (EXT) every August to ascertain the status of A-133 audits due for the previous fiscal year. We have also added a step to our annual sub-recipient monitoring process to determine the status of the sub-recipient s A- 133 audit. These two additional elements will be added to the current process wherein PTN sends a letter to each sub-recipient annually reminding them of the A-133 audit requirement, deadlines, and specific instructions to submit their audit report, or exemption letter, to EXT. EXT is copied on that letter and is provided a list of the sub-recipients who received grant funds through PTN. EXT tracks receipt of the audits, reviews them, and notifies PTN when an audit requires follow-up. PTN, through the Public Transportation Coordinators, monitors corrective action performed by the sub-recipient and reports back to EXT. In the future, as part of our annual reminder to the sub-recipients, we will ask that a copy of either the report or exemption letter that is submitted to EXT be provided to the respective Public Transportation Coordinator. Completion Date: September 15, 2014 MAP Owner: Tony Rose, Section Director, External Audit & Advisory Services Section (EXT) MAP 3.2 We have developed a new Single Audit report tracking database and are currently working to identify all sub-recipients of federal funds through TxDOT and will be including these in the tracking database. This will facilitate providing TxDOT divisions, including Public Transportation Division (PTN), with a list of their sub-recipients for each fiscal year and dates for all Single Audit reports (Single Audit reports or letters that Single Audit reports were not required) received. It is the PTN responsibility to follow-up with sub-recipients that have not submitted their Single Audit reports. In addition, tracking of Single Audit reports with findings is being explicitly tracked in the new database to facilitate the identification of such reports and the status of receiving updates on the status of implementation. When the EXT identifies findings that require follow-up, the relevant TxDOT division(s) will be notified and provided information on the finding to facilitate following up with the sub-recipient. The EXT will monitor the status of these followups to ensure that its reporting to the respective federal agencies is completed by the required deadline. Completion Date: September 15, 2014 August 1, 2014 12

Observations and Recommendations Audit Observation (a): Electronic Grant Information System The Public Transportation Division (PTN) does not have an information system that provides direct access and efficiency in capturing grant documentation and records from the 28 Public Transportation Coordinators (PTCs) that are dispersed among 25 different locations. The records, which PTCs have to manually input all the information, include vital information about the monitoring of sub-recipients (e.g., Request for Reimbursements (RFR), Quarterly Reviews, and Annual Reviews). Currently, the Traffic Operations Division uses an information system, egrants, to administer grants, review Request for Reimbursements (RFRs), and monitor their subrecipients. This system has allowed Traffic Operations Division to achieve significant efficiencies and have more oversight of the sub-recipients by doing the following: Reducing human data entry errors Developing comprehensive reports on the grant program and sub-recipient performance Integrating the RFR processing with TxDOT s Accounting systems Retaining key sub-recipient documents, like grant agreements, RFRs, and proposals Enhancing performance monitoring of the sub-recipient Reducing cost due to savings in time, cost, resources, and physical storage space Effect/Potential Impact Without having an information system that allows for greater process/procedural efficiency and sharing of documents throughout the entire PTN locations, the following impacts may occur: Limited effective oversight of PTC work Increased risk for undetected non-compliance and or conflict of interest Missed opportunities to improve effectiveness of monitoring activities Limited or incomplete information to evaluate program and personnel performance Recommendation The Office of Internal Audit recommends that PTN work with IT to modify egrants for managing the Public Transportation Grant program. August 1, 2014 13

Audit Observation (b): Use of Improvement Action Plans (IAPs) Public Transportation Coordinators (PTCs) are to utilize Improvement Action Plans (IAPs) on sub-recipients when significant non-compliance is identified and the non-compliance cannot be remedied immediately. In the past three years, only 2 of 7 (29%) PTCs documented IAPs for sub-recipients. When PTCs were asked why they did not issue IAPs, PTCs expressed concern that the use of an IAP is an indication that they are not doing a proper job of monitoring by identifying and correcting issues in advance of a deficiency. Effect/Potential Impact There is an increased risk that PTCs will fail to meet performance and management expectations and the Public Transportation Division (PTN) may not be aware of significant non-compliance issues with sub-recipients. Recommendation The Office of Internal Audit recommends that PTN work with their PTCs to educate them on the usage and the importance of IAPs. August 1, 2014 14

Summary Results Based on Enterprise Risk Management Framework Audit Results Dashboard PTN Grant Management Scope Areas Evaluated Business Objectives (Reporting, Operational, Compliance) R, O, C R, O, C ERM Component Control Activities Sub-recipient Monitoring Program Oversight Control Environment Organizational Tone Planning Forecasting Goal-Setting 1 (a) 2, (b) 2, (a) Cost-Benefit Analysis Risk Assessment Control Activities Business Continuity Evaluations/Analysis Management Action Plans Policies/Procedure Development & Maintenance Approvals/Authorizations Supporting Evidence/Records Availability Segregation of Duties 3 1 2 1, 3 1 1 2, 3, (b) 2, 3 Safeguarding Assets Information Classification Information & Communication Monitoring Information Input Information Processing Output/Reporting and Messaging Exception Reporting Review Reconciliations/Root-Cause Analysis Peer Reviews 1 1 2, (b) 2, 3 Management Representations Scope Area Assessment Rating Assessment Grid Exemplary Satisfactory Needs Improvement Unsatisfactory Closing Comments The results of this audit were discussed with Public Transportation Division and the External Audit & Advisory Services Section. We appreciate the assistance and cooperation received from the Public Transportation Division contacted during this audit. August 1, 2014 15