rcsd audit procurement

8/7/2019 RCSD Audit Procurement

1/16

O,FFICEO F ' A U D IT O R G EN E R A L

Procurement

Audit

March 25,2009


2/16

Report Section

Procurement AuditIndex

Pages

Executive Summary

Summary of Recommendations

Observations, Recommendations and Action Plans

Policies and ProceduresPO MonitoringDocumentationWritten QuotationTabulation of BidsGaps in PO SequencePeopleSoft UsersCommoditiesConfirming Order

2

4

57

9

10

11

12l3

1415


3/16

Procurement AuditExecutive Summary

OBJECTIVE:

To evaluate procurement operations including the internal control environment, procedures, policies and compliance.

BACKGROUND:

During calendar year 2008, over 12,000 purchase orders were created totaling in excess of $200 million. The volume of purchasingactivity demands that comprehensive policies and procedures be in place and operating effectively to ensure that the District receivesthe best possible value. Laws exist that govern purchasing in the public sector and all purchase orders made by the District mustcomply with proper bidding and quotation procedures.

SCOPE:

We evaluated Purchasing processes to assess the control environment, as well as to evaluate efficiencies. Purchase orders wereselected for testing to determine if the requisition, purchase order and receipt were properly executed, as well as the timeliness of thepreparation of the purchase order. The confirming order process was evaluated for reasonableness. Change orders were tested toensure proper documentation to support the change exists. The approval process was tested to evaluate the effectiveness of workflow.Testing was performed on the competitive bid process and the written quotation process to ensure compliance with General Municipal

Law and District policies.

- 2-


4/16

Procurement AuditExecutive Summary

CONCLUSION:

The Purchasing Department processes a large volume of purchase orders annually, as well as conduct the competitive bid and requestfor proposal processes, and administers the P-Card function. With all the areas the Purchasing Department is responsible for, theprocurement process has been effectively managed, but there are some areas with needed improvements.

The Purchasing Department has standardized processes, but the processes need to be formalized and documented. Although thePurchasing Department has a detailed policy manual; it has not been updated since the implementat ion of PeopleS of t 8.9, and there isa lack of detailed procedures for the various purchasing functions. Purchase orders are not monitored to ensure completeness of theorder as well as to determine which POs have not been received or have residual amounts outstanding. Consistency of documentat ionwithin PeopleSoft should be enforced. Details surrounding conf irming orders are not reported to the Purchasing Department whosecontrols are being circumvented. Commodities should be monitored to recognize cost saving opportunities for the District.

The policy for obtaining the three wr itten quotes for purchases greater than the established threshold needs to be enforced andevidence needs to be documented. The written quotation thresholds have not been reevaluated to ensure it aligns with the District'sgoals and current needs. The tabulat ion of bids which is used in the competitive bidding process should be ver ified by an independentperson for completeness and accuracy. .

- 3 -


5/16

Procurement AuditSummary of Recommendations

1.

Establish documentation standards and approval to substantiate instances where IM&T personnel have been requested toto resolve a

Update the Business Services Procedures and Reference Manual for the Purchasing Department. Complete a departmentmanual which detailed variousImplement procedures to identify and closefully spent POs until PeopleSoft is automated toperform thisfunction.Monitor orders to determine PO balances should be released2 .

Develop and implement documentation standards for procurement information maintained in PeopleSoft. Specify

"O""''' nrl to contract and3.

4.

Enforce the policy of obtaining the three written quotations for purchase orders over the established threshold anddocument evidence that the written quotations were obtained. If the current procedures are not realistic with the currentvolume consider to better with business limitations.Establish independent verification procedures to ensure completeness and accuracy of the tabulation of bidsprior to the

lowest bidder.5.

6 .

Ensure that Procurement operating procedures do not allow employees to skip PO numbers. Also, develop periodicmonitoring procedures to detect skipped PO numbers. If gaps are identified, they should be detected, explained,documented and that the is reasonable.

7.

8.

9.

- 4 -


6/16

Procurement AuditObservations, Recommendations and Action Plans

Policies and Procedures

The Business Services Procedures and Reference Manual for the Purchasing Department has not been updated since November 2006.This manual does not include policy changes since the implementation of PeopleSoft 8.9. The PeopleSoft 8.9 upgrade automatedrequisitioning, approvals, purchase order preparation and receiving. The desk procedures manual for the various functions in thePurchasing Department also requires completion and updating. A policies and procedures manual for procurement should be completeand up to date to ensure consistent application of procurement procedures. Written and communicated policies and procedures wouldenhance the accuracy and consistency of recorded data, consistency in the handling and recording of transactions, and aid in holdingemployees responsible and accountable for the work performed.

Update the Business Services Procedures and Reference Manualfor the Purchasing Department. The manual should, at aminimum, include: Approval level criteria, Bidding policies and procedures, Quotation policies and procedures, RFP policies andprocedures, and Guidelines for purchases below the bidding and quotation thresholds.

Management Responses: The risk of poor purchasing management presents low operational andfinancial risks to the District. Policies and Procedures (Regulations) are being rewritten and expanded as part of a Business Servicesdirective rewrite. This was in process before this audit and will continue until completed. Not only are the procedures and referencemanual being revised but desk procedures for each function are being revised. Pertinent procedures will be included in the manual and

the desk procedures.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply

Due Date: August 31, 2009

- 5 -


7/16


Complete a department manual which provides detailed procedures for the various Purchasing functions including, but not limited toPurchase order preparation, the bidding process, change order processes, instructions for the handling commodities (i.e. directconnect, textbooks) and monitoring procedures.

Management Responses: As stated in the response to Observation 1, this presents low operational andfinancial risks to the District. Purchasing is currently working on revising and expanding the departmental manual to include pertinentprocedures. This manual will include the monitoring procedures.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

- 6-


8/16


PO Monitoring

Monitoring procedures are not in place to determine which purchase orders are outstanding. Open purchase orders can include ordersthat have not been received and completed orders with dollars remaining on the purchase order. It was noted during our testing that onlyapproximately 600 out of 8,000 POs created this fiscal year have been closed. Management has communicated that a "purchase to pay"project team is working on eliminating this backlog and establishing an automated process to remediate this issue.

Also, once a purchase order has been created, they are not monitored to ensure that they have been dispatched or used. During our

testing, we observed that there were POs with open and approved statuses that were inadvertently not dispatched. There were POs in a"pending cancel" status which were selected for cancellation, but never finalized or "dispatched" to complete the action. As a result,these orders remained in a "pending cancel" status and funds remained encumbered and were not released for spending. Becausepurchase orders are not monitored, Purchasing was not aware that these POs were outstanding.

Monitoring purchase orders should be performed on a regular basis to ensure completeness of the order, as well as to determine whichPOs have not been received and/or have residual amounts outstanding. If the PO has a remaining balance, then the unused encumberedfunds should be released back into the budget. Monitoring POs will also ensure that the POs are dispatched in a timely manner. ClosingPOs will assist in expediting the year end closing process.

-7-


9/16


Implement procedures to identify and closefully spent POs until PeopleSoft is automated toperform thisfunction.

Management Responses: have been defined and parameters put in place to automaticallyclose purchase orders meeting a certain cr iter ia. The criteria were set as the three-way match of purchase order, receipting and invoiceall match completely and a specific timeframe of non-activity. As part of the process for year-end close action the purchasing andaccounting departments will review and initiate the close of remaining POs. Included in this process will be the use of a daily reportreceived from MIS showing all POs approved but not dispatched. Moving forward, the review of open purchase orders will be reviewedby the purchasing department on a monthly basi s. The procedures for this process will be finalized and documented.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

Monitor open purchase orders regularly to determine if the remaining PO balances should be releasedfor spending.

Purchasing recently (February 2009) implemented a procedure to "finalize"any purchase order that is created for less than the requisition, which releases the "dangling dollars" back to the requisitioningdepartment's budget. Additionally, Accounts Payable implemented a procedure to "finalize" and invoices that are less than the line itemdollar amount, which releases the "dangling dollars" back to the requisitioning department's budget. This should resolve this issuemoving forward. A monthly close process, which is a goal for 2009-10, will include the monitoring of open purchase orders.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31,2009

- 8 -


10/16


Documentation

During the audit, it was noted that information is not consistently documented in PeopleSoft for purchase orders that require quotations,competitive bids, contracts or change orders. Contract numbers were not consistently referenced in the PO, change orders did not alwayshave documentation regarding why the change was being made, and POs that required three written quotes did not consistently have thethree quotes attached. Documentation should exist to support the District's efforts for obtaining the best possible pricing and value.Quotations which are required to be obtained should be attached to the PO in PeopleSoft. If quotes were not obtained or bidding was notperformed, then an existing contract should have been used and the contract should be referenced in PeopleSoft.

Develop and implement documentation standards for procurement information maintained in PeopleSoft. Specify informationrequired to support change orders, contract information, bidding and quotes.

Management Responses: The risk of poor documentation presents low legal and financial risks to theDistrict. For the omissions cited in this audit the staff was able to provide justification in the "header" field of most of the citeddocuments. Documentation standards for procurement are in place. Procedures are being updated to better maintain the documentationwithin the PeopleSoft system. As part of our updating of the procedures manual we will be including the documentation standards andtheir implementation. It is the intent of the District to provide documentation within the system to facilitate the tracking of purchases and

to eliminate excessive paper files.

Responsibility: Joyce Martelli , Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

-9-


11/16


Written Quotations

Per District Policy, three written quotes are to be obtained for any purchase greater than $2,000. It was noted during our testing,although infrequent, evidence of three written quotes were not always obtained. Three written quotations should be obtained for allpurchase orders greater than the District's establi shed threshold. If the purchase is under contract with the District, NYS or MonroeCounty, the quotes are not required. Written quotations should be obtained for purchases greater than the established threshold to ensurethe District is obtaining the best pricing for i ts purchases.

If the current procedures are not realistic with the cur rent volume of purchases, establish policies that would better align within businesslimitations.

Enforce the policy of obtaining the three written quotations for purchase orders over the established threshold and documentevidence that the written quotations were obtained. If the current procedures are not realistic with the current volume ofpurchases,consider modifying procedures to better align with business limitations.

Management Responses: is District policy to obtain three competitive quotes for commodities thatare not on contract wi th costs between $2000 and $9999. Although the audit noted infrequent findings where this was not completed,

these were exceptions and not stemming from a repeated concern of following procedures. Management has performed additionaltraining to its staff. Current procedures are realistic and align with business l imitations and risk levels. Policies and procedures areevaluated regularly for any necessary changes.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply

- 10 -


12/16


Tabulation of Bids

The tabulation of bids is prepared by the Purchasing Assistant who then reviews her own tabulation. The Buyer determines the lowestbidder utilizing the tabulation of bids, as well as the actual bids. Although the Buyer does verify numbers, there is not a formalizedreview of the tabulation of bids by an independent person prior to the determination of the lowest bidder. During the bid testing, it wasnoted in two instances of the ten contracts tested that there was an omission of a bid on the tabulation of the bids. These omissionswould not have created a change in the awarded bid, but should have been included on the tabulation of bids. Per General MunicipalLaw, the award of a competitive bid should go to the lowest responsible bidder. Omitting bids on the tabulation of bids could cause avendor who was not really the lowest bidder to get awarded the bid. The tabulation of bids should be reviewed by an independent personto ensure accuracy and completeness.

Establish independent verification procedures to ensure completeness and accuracy of the tabulation of bidsprior to the analysis ofthe lowest bidder.

Management Responses: bids are publically opened and evaluated by the buyer. Bidtabulations are completed by the Purchasing Assistant. Both the purchasing assistant and the buyer review the tabulations independentlyof one another. This procedure will be evaluated and any changes will be included in the policy and procedure manual.

Responsibility: Joyce Mar telli , Comptroller; Gary Smith, Director of Procurement and Supply

Due Date: August 31, 2009

- 11 -


13/16


Gaps in Purchase Order Sequence

Purchase orders are automatically assigned a sequential purchase order number by the PeopleSoft system. While examining purchaseorders for the calendar year 2008, it was noted that there were gaps in the purchase order numeric sequence. Although IM&T providedexplanations regarding how numbers could be skipped, specific reasons for the gaps in purchase order numbers could not be explained.These gaps were identified by OAG during our audit and neither management nor IM&T were aware that they existed. Operatingprocedures should be established in Procurement to ensure that staff does not create these gaps while performing daily responsibilities.In addition, periodic monitoring should occur to ensure that gaps in the sequential purchase orders do not exist. In the rare event thatgaps are detected, management should evaluate and substantiate specifically as to why the gap exists. All purchase order numbers,which are assigned sequentially, should be accounted for. An audit trail should exist for all purchase order activity. Undetected missingPO numbers allow data integrity concerns that could be the result of inappropriate transactions.

Ensure that Procurement operating procedures do not allow employees to skip PO numbers. Also, develop periodic monitoringprocedures to detect skipped PO numbers. If gaps are identified, they should be detected, explained, documented and approved bymanagement certifying that the gap is reasonable.

-L)'' '' 51ULll ll Jl5 July 1,2009 for fiscal year 2009-10, all purchase orders will beginwith the four digits 2010xxxxxx (the first PO number will be 2010000001). Fiscal year 2010-11 will begin with 2011xxxxxxx (the first

PO number will be 2011000001) and so on in future years. This will allow Purchasing to run queries on not only the status but identifyany missing PO numbers. A review will be established of this query including supporting documentation, oversight, and approvalprocess for any missing PO numbers. This information will be included in the procedures manual.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply; IM&T Due Date: August 31,2009

- 12 -


14/16


PeopleS oft Users

Dur ing our PO testing, POs were identified that were created by individuals outside of Procurement and Contracts (ICS). We notedwhile analyzing purchase orders that there were POs that were created by IM&T users. Several POs totaling in excess of$lM werecreated by IM&T staff. Of significant concern is the fact that a PO was created using the VPl user ID. The VPl user ID is the highestlevel of authority in the system which can allow the user to perform all system functions and if desired actions could be performedwithout detection. Since VPl is a generic utility ID, there is no visibility regarding who actually performed the transactions. The VPluser has complete access of the entire PeopleSoft system and creates a segregation of duties issue. IM&T should not be per formingoperating processes in PeopleSoft. This ID should not be used to perform any operating functions. If there is a need for IM&T toperform production emergencies, operating management should maintain sufficient documentation including authorization for thesetypes if issues. OAG evaluated all transactions originated by IM&T personal and ver ified the cancelled checks to ensure that alltransactions appeared to be for legit imate exist ing vendors.

Establish documentation standards and approval to substantiate instances where IM&T personnel have been requested toperformoperating functions to resolve aproblem.

Management Responses: The creation ofPOs by the VPl user ID existed only in the rollover of

information from 2007-08 to the 2008-09 fiscal year. This was completed in order to implement PeopleSoft 8.4 upgrade. Several of thePOs needed correction or re-entering due to improper procedures being implemented during the transition per iod. It is not the normalfunction of the IM&T staff to perform operating processes. Procedures will be developed to authorize, monitor and document anytransaction created by IM&T for emergencies and/or upgrades made to the system which require intervention by the IM&T staff.

Smith, Director of Procurement and

- 13 -


15/16


Commodities

Commodities are assigned to buyers in the Purchasing Department. Each buyer is responsible for recognizing potential biddingopportunities for their commodities. Reporting has not been established to facilitate monitoring commodities to help ensure that theDistrict is acquiring contracts to obtain the best pricing for the District. The commodity codes that the District assigns in PeopleSoft arenot specific enough to effectively utilize reporting to recognize savings opportunities. The District should be maximizing their costsavings by monitoring commodities to identify potential competitive bidding and contract opportunities.

Develop a process to monitor commodities to recognize cost saving opportunities for the District. Consider implementing morespecific coding tofully utilize system reporting capabilities.

Management Responses: category codes are assigned to particular buyers and requisitions areprocessed by the buyers that have the greatest knowledge of commodities within the category codes, monitoring of best value and NYPublic Law is being affected. To include commodity codes on all purchasing lines (greater than 12,000 purchases orders with an averageof 6 lines per order totaling more than 72,000 lines) at this point will not have the return on investment.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: No further action.

- 14 -


16/16


Confirming Orders

Confirming orders are a result of invoices received that do not have a corresponding purchase order, but by definition should have.Confirming orders must receive Chief, Comptroller and Legal approval before payment can be made on the invoice. Purchasing is notinvolved in the confirming order process, nor is Purchasing made aware of the details surrounding a confirming order.

Confirming orders circumvent the entire purchase order process which includes quotation and competitive bidding processes. The

Purchasing Department should be made aware of confirming orders and they should be reviewed to ensure the District policiesregarding quotations and competitive bidding are being adhered to. Per General Municipal Law, purchases greater than $lOk must goout for competitive bid. If there are confirming orders that have commodities greater than $10k, then they should have gone out forcompetitive bid. Awareness of purchases that are not in compliance with District policy and General Municipal Law will allowPurchasing to enforce compliance.

Develop aprocedure to inform the Purchasing Department about confirming orders to allow Purchasing to enforce compliancewith Procurement policies. .

Management Responses: orders are reviewed by the Comptroller and Legal forapproval. Before presentation to the Comptroller the Accounts Payable staff discusses the lack of compliance with the requisitionerand their supervisor. The requisitioner is educated as to the proper procedure to follow. It should be noted that confirming orders areon the decline from prior years. Additional procedures will be evaluated to ensure that purchasing is included in the process wherenecessary.

Director of Procurement and

- 15 -

rcsd audit procurement

Documents