Audit Committee

MINUTES Audit Committee of Roanoke City Council Location: Council Conference Room Noel C. Taylor Municipal Building, Room 451 South Date: September 7, 2016 Time: 4:00 p.m. to 5:00 p.m. Attendees: Audit Committee Member Present (Y/N) William Bestpitch (Chair) Y Anita Price (Vice-Chair) Y Michelle Dykstra Y (4:05) Sherman Lea (ex-officio) N Ray Ferris, City Council Member Drew Harmon, Municipal Auditor Cari Spichek, Senior Auditor Wayne Parker, Senior Auditor Barbara Dameron, Director of Finance Sherman Stovall, Assistant City Manager for Operations Dan Callaghan, City Attorney Sherman Holland, Commissioner of the Revenue Greg Emerson, Chief Deputy Commissioner of the Revenue Terra Heavner, Senior Tax Compliance Administrator 1. Call to Order: Mr. Bestpitch called the meeting to order at 4:00 p.m. and welcomed everyone. He asked those present to introduce themselves. 2. Approval of the Minutes from the June 8th Meeting: Mr. Bestpitch asked if there were any corrections to the minutes. Hearing none, the minutes were received and filed as written. 3. Right-of-Way Maintenance: Mr. Harmon reported that the City’s rights of way are maintained by 29 full- and part-time employees, supplemented by three independent contractors. He stated that members of the landscape maintenance staff hold the required Commonwealth of Virginia certifications. Additionally, the September 7, 2016 Page 2 of 6 Landscape Coordinator is a Certified Grounds Manager, a distinction which is held by only 88 individuals across the United States. Municipal Auditing worked with management to identify risks in establishing the scope and objectives of the audit. Management viewed the hazards inherent to mowing operations as their most significant risks. The audit evaluated employee training, worksite safety, equipment condition, and cycle time performance. Mr. Harmon pointed to the results of an employee survey conducted by Municipal Auditing which indicated that employees were, to a great degree, operating safely. Employee concerns primarily related to the condition of vehicles used to haul equipment. Mr. Bestpitch asked if there were any concerns related to management’s action plans. Mr. Harmon did not have any direct concerns; however, he noted that employee training is a challenge throughout the city. The city relies on instructor-led classes to deliver much of the training required by regulatory agencies such as the Occupational Safety and Health Administration [OSHA]. Attendance is documented on sign-in sheets and then keyed into a competency database administered by Risk Management. Mr. Harmon commented that the city needs a learning management system to enable on-demand delivery of training and to automatically record participation. Ms. Price concurred and noted that training needs to be more intentional. Mr. Bestpitch asked if the contractors used by the City’s Transportation Division for right-of-way mowing are the same as those called upon to abate weeds and overgrown grass cited by Code Enforcement. Mr. Harmon responded that the contractors are not the same. The report was received and filed without objection. 4. Records Storage Services Review: Mr. Harmon stated that records management is generally challenging for all organizations and governments. This review was in response to comments from the City’s external auditors, who asked about security over the City’s data and system backups, which are stored offsite by a third-party contractor. The vendor’s system of controls had not been independently audited; as such, Municipal Auditing undertook an evaluation of their compliance with the terms of the City’s contract and Library of Virginia requirements. Data backups were found to have been securely transported and stored in a vault with access controls, temperature controls, and a fire suppression system. However, the City’s paper records were stored in the vendor’s general warehouse, which was found to be less secure than the vault and had no temperature or humidity controls. The Library of Virginia states that maintaining consistent temperature and humidity levels is an important factor for the preservation of paper records, particularly permanent records. While the risk to the City’s short-term records is minimal, the risks are greater for the City’s archival records. September 7, 2016 Page 3 of 6 Mr. Bestpitch asked if all physical records and tapes are handled by this vendor and inquired about the security of the transport process. Mr. Harmon responded affirmatively, and added that the company is bonded. Their couriers pick up records and data backups directly from City premises. Mr. Bestpitch inquired as to whether the City has offsite electronic storage. Mr. Harmon stated that City primarily uses backup tapes and does not use cloud services for backups. Mr. Bestpitch noted that some of the target dates for management actions were quickly approaching. Mr. Harmon reported that the vendor has provided a Disaster Recovery Plan. The report was received and filed without objection. 5. Risk Management General Liability Claims Follow-Up: The City uses the Virginia Association of Counties Group Self-Insurance Risk Pool [VACORP] as a third-party administrator for processing general liability claims. The only issue identified in the original audit was that the contract did not explicitly require compliance with Library of Virginia retention schedules or specify that the records were the City’s and open to inspection at any time. The follow up audit confirmed that an addendum to the contract containing these provisions was signed, effective July 1, 2016. The report was received and filed without objection. 6. Citizen-Centric Revenues: Mr. Harmon noted that this update relates to what staff commonly refers to as the “Tax Treasury Project”. Dawn Mullins, Assistant Municipal Auditor, who is coordinating the initiative and Evelyn Powers, City Treasurer, were unable to attend the Audit Committee meeting as both were in Richmond, along with staff from the Commissioner’s office, attending a user conference for the revenue system under consideration. Ms. Dameron began the presentation noting that City revenues of approximately $271 million will be impacted by this initiative. One of the primary goals of the project is to provide a positive customer experience. The focus at this time is largely on trust taxes and miscellaneous accounts receivable, as Finance prepares to transition responsibilities for those accounts to the Commissioner of the Revenue and the City Treasurer. This change will take effect as of July 1, 2017. The project team is working with the City Attorney’s Office to identify any necessary city code amendments. Mr. Callaghan stated that no changes to the city’s charter are expected and that only city code would be affected. Mr. Harmon provided an overview of tax administration and collections responsibilities from the 1980’s to-date. The city began studying its tax and treasury systems in the early 2000s when it established the Financial Application Integration Team, commonly referred to as “FAIT.” The city ultimately selected the Government Revenue Management (GRM) software from Manatron as its tax and treasury system. September 7, 2016 Page 4 of 6 The implementation of GRM proved challenging for the City of Roanoke as well as for Virginia Beach, the only other Virginia client. Installations of the real estate billing and cashiering portions of the system were completed in 2010. Neither the vendor nor the GRM system met the City’s expectations; management decided not to install the business license and personal property tax modules. Virginia Beach was also unable to achieve the desired level of functionality with GRM and ultimately chose to look for an alternative system. The city continues to use GRM for real estate billing and cashiering while using its legacy systems for personal property and business license taxes. The legacy systems were programmed in COBOL, an antiquated programming language with which fewer and fewer people are familiar. The city converted these legacy systems to a more modern programming language (.NET); however, the converted systems provide no additional functionality or improvement prospects. This year, the Commissioner of the Revenue and the Treasurer began looking into a system used by several of their peers in Virginia. PCI’s myRevenue system is used in ~ 18 Virginia localities and can be purchased via cooperative procurement. Municipal Auditing is working with the Commissioner, Treasurer, and Department of Technology to evaluate the vendor and its system. Mr. Bestpitch asked if the City will no longer have a Billings and Collections office. Ms. Dameron confirmed that would be the case. Commissioner Holland added that things are progressing well and moving in the right direction. Ms. Heavner stated that the project is improving communication between offices and should lead to process efficiencies. Mr. Emerson commented that the work being done through the Municipal Auditor’s office has been very helpful and recognized Ms. Mullins for her work on the project noting that it is a significant undertaking. Mr. Bestpitch expressed his appreciation for everyone’s work on the project and noted that such an initiative has been discussed since 2000. While citizens may not enjoy paying taxes, they appreciate anything the city can do to make it easier. Mr. Bestpitch asked if the Revenue Governance Committee will continue to operate. Mr. Harmon confirmed they would. The committee promotes regular communication and shared decision making. Mr. Harmon reviewed progress-to-date and next steps for the project. He noted that physical space requirements will be evaluated as part of the initiative. Ms. Price asked if this part was still in the planning stages. Mr. Harmon affirmed it was. Mr. Emerson stated that the Commissioner’s office is still holding onto the vision of a Business Center, where owners and managers can more efficiently receive help. Commissioner Holland stated that he envisions a “one stop shop.” Ms. Price commended those working on the project for their collaboration and commitment. Mr. Bestpitch asked that Mr. Stovall coordinate with Municipal Auditing to schedule a City Council briefing on this initiative. September 7, 2016 Page 5 of 6 The presentation was received and filed without objection. 7. Annual Report: Mr. Harmon reviewed audit services provided during Fiscal Year 2016. He discussed the importance of increasing efforts directed towards information technology [IT], which is a critical area. He also highlighted client satisfaction ratings for last year, noting that management has responded favorably to Auditing’s risk-based, collaborative approach. The report was received and filed without objection. It will be placed on the next City Council agenda. 8. Hotline Update: Mr. Harmon reviewed the allegations investigated the previous quarter, noting one was substantiated and three were unsubstantiated. He discussed the city’s exception-based payroll system and the challenges of managing overtime while responding to public service needs that occur after regular hours. Ms. Price commented that the hotline report validates that issues and allegations coming into the hotline are taken seriously and investigated. She has encouraged members of the School Board to consider a similar process for administering the Division’s employee hotline. The update was received and filed without objection. 9. Other Business: Mr. Harmon informed committee members of the resignation of Ann Clark, Senior Auditor, effective September 7, 2016. The position has been advertised and the job posting closes on September 14, 2016. Mr. Harmon reported that Muncipal Auditing has contracted with a new hotline provider. As the previous provider had been in place for six years, he felt it was time to review other available options. The new provider delivers comparable services for approximately one-third the cost. Employees and the public can still report concerns anonymously via phone [utilizing a toll-free 800 number], website or fax. Information about the new hotline is available on Municipal Auditing’s webpage and an awareness campaign is being planned. Mr. Harmon noted that the following audits are in progress; Civic Facilities, Police Cash, City Council Expenditures, External Audit Coordination, Citizen Centric Revenues, School Board Transportation, and follow-up related to School Board Workers’ Compensation and Student Health Services. Future audits include; Greater Roanoke Transit Company fuel expenses and environmental controls, Fleet Division operations, purchasing cards, and the special education program. September 7, 2016 Page 6 of 6 As part of the annual financial audit, Cherry Bekaert reviews general controls over the city’s technology systems to gauge data reliability for financial reporting. Cherry Bekaert recommends that the city complete an IT risk assessment every two to three years. Municipal Auditing plans to gather examples of IT risk assessment reports and work with the Department of Technology to develop a scope of work and cost estimates for an assessment. Mr. Harmon noted that the next meeting will be held on December 14, 2016. Mr. Bestpitch asked if meetings for the remainder of the fiscal year have been set. Mr. Harmon responded that the committee typically meets the first Wednesday in March and June. He will confirm those dates with the City Clerk and update committee members. 10. Adjournment: Mr. Bestpitch adjourned the meeting at 5:00 p.m.