Agenda 04/26/2016 Item #10E 4/26/2016 10.E.
EXECUTIVE SUMMARY
Recommendation to direct the County Manager to develop internal controls over
Electronic Fund Transfers (EFTs) in conformance with § 668.006, Florida Statutes, and
bring the proposed control measures back to the Board of County Commissioners for final
approval.
OBJECTIVE: That the Board of County Commissioners follow Florida Statutes,
specifically § 668.006(1).
CONSIDERATIONS: Section 668.006, Florida Statutes provides the following:
The head of each agency shall be responsible for adopting and implementing control
processes and procedures to ensure adequate integrity, security, confidentiality, and
auditability of business transactions conducted using electronic commerce.
In Auditor General Report No. 2013-085,the Okaloosa County BCC was required to develop
internal controls over EFTs as is being recommended here. According to the Auditor General:
The BCC should develop written policies and procedures addressing EFTs as
required by Section 668.006, Florida Statutes, including providing for an adequate
separation of duties over access to County assets and the related accounting records,
and documenting independent approvals before the funds are transferred. (Finding
No. 23)
FISCAL IMPACT: There is no fiscal impact associated with this executive
summary.
LEGAL CONSIDERATIONS:
GROWTH MANAGEMENT IMPACT: There is no growth management impact
associated with this executive summary.
RECOMMENDATION: To direct the County Manager to develop internal controls over
Electronic Fund Transfers (EFTs) in conformance with § 668.006, Florida Statutes, Florida
Statutes, and bring the proposed control measures back to the Board of County Commissioners
for final approval.
Prepared by: Georgia Hiller,Esq.,District 2 Commissioner
Attachment: (1) § 668.006, Florida Statutes (2015)
(2)Auditor General Report No. 2013-085 (Excerpt: Finding 23)
Packet Page -56-
4/26/2016 10.E.
COLLIER COUNTY
Board of County Commissioners
Item Number: 10.10.E.
Item Summary: Recommendation to direct the County Manager to develop internal
controls over Electronic Fund Transfers (EFTs) in conformance with § 668.006, Florida Statutes,
and bring the proposed control measures back to the Board of County Commissioners for final
approval. (Commissioner Hiller)
Meeting Date: 4/26/2016
Prepared By
Name: BrockMaryJo
Title: Executive Secretary to County Manager,County Managers Office
4/20/2016 5:12:17 PM
Submitted by
Title: Executive Secretary to County Manager, County Managers Office
Name: BrockMaryJo
4/20/2016 5:12:19 PM
Approved By
Name: OchsLeo
Title: County Manager,County Managers Office
Date: 4/20/2016 5:18:35 PM
Packet Page -57-
4/26/2016 10.E.
Online
Sunshine
The 2015 Florida Statutes
668.006 Control procedures.—The head of each agency shall be responsible for adopting and
implementing control processes and procedures to ensure adequate integrity, security,
confidentiality, and auditability of business transactions conducted using electronic commerce.
History.—s. 7, ch. 96-224.
Note.—Former s. 282.75.
Packet Page -58-
4/26/2016 10.E.
REPORT No.2013-085
JANUARY 2013
OKALOOSA COUNTY BOARD OF COUNTY
COMMISSIONERS' OVERSIGHT OF THE
TOURIST DEVELOPMENT COUNCIL
AND USE OF TOURIST DEVELOPMENT
TAXES AND FUNDS RECEIVED FROM
BRITISH PETROLEUM
Operational Audit
„*.
11,111
' WAR
STATE OF FLORIDA
•� AUDITOR GENERAL
DAVID W. MARTIN,CPA
Packet Page -59-
4/26/2016 10.E.
BOARD OF COUNTY COMMISSIONERS, COUNTY ADMINISTRATOR, CLERK OF THE
CIRCUIT COURT,TOURIST DEVELOPMENT COUNCIL,AND EXECUTIVE DIRECTOR
OF THE TOURIST DEVELOPMENT COUNCIL
The Okaloosa County Board of County Commissioners, County Administrator, Clerk of the Circuit Court,
Tourist Development Council, and Executive Director of the Tourist Development Council who served during
the period May 2010 through May 2012 are listed below:
Board of County Commissioners District
No.
Wayne Harris,Chair to 12-31-2010 1
John Jannazo to 11-15-2010 2
Dave Parisot from 11-16-2010,Vice Chair from 1-1-2012 2
Bill Roberts,Vice Chair from 1-1-2011 to 12-31-2011 3
Don Amunds,Vice Chair to 12-31-2010,Chair from 1-1-2012 4
James Campbell,Chair from 1-1-2011 to 12-31-2011 5
County Administrator
James D.Curry
Clerk of the Circuit Court
Don W.Howard
Tourist Development Council
Kathy Houchins,Chair from 10-1-2010
Robert"Bobby"Nabors,Vice Chair from 12-15-2010
Dennis"Nick"Nicholson,Chair to 9-30-2010
Warren Gourley,Vice Chair to 12-14-2010
Timothy M.Edwards
Patricia Hardiman
Larry Hines
Lino Maldonado
James Campbell,Board Liaison to 11-25-2011
Dave Parisot,Board Liaison from 11-26-2011
Executive Director of the Tourist Development Council
Darrel Jones to 5-31-2010
Mark Bellinger from 5-13-2010 to 5-4-2012(Deceased)
Greg Donovan,Interim from 5-5-2012
The audit team leader was Kenneth C. Danley, CPA,and the audit was supervised by James W.Ktedinger,Jr., CPA. Please
address inquiries regarding this report to Marilyn D.Rosetti,CPA,Audit Manager,by e-mail at marilynrosetti@aud.state.fl.us
or by telephone at(850)487-9031.
This report and other reports prepared by the Auditor General can be obtained on our Web site www.myflorida.corn and en;
by telephone (850) 487-9175; or by mail G74 Claude Pepper Building, 111 West Madison Street, Tallahassee, .Florida
32399-1450.
Packet Page -60-
4/26/2016 10.E.
JANUARY 2013 REPORT No.2013-085
entities,including a uniform classification of accounts, as it considers necessary to assure the use of proper accounting
and fiscal management techniques. To that end, the DES developed a Uniform Accounting System Manual for Florida
Counties (Manual) to be used as the standard for classifying and recording financial information. The Manual provides
for expenditures to be recorded and reported using object (e.g., personnel expenses, operating expenses, capital
outlay) and sub-object (e.g., salaries and wages,professional services, machinery and equipment) codes to identify the
types of the expenditures.
Our tests of 60 purchasing card transactions, totaling$37,000 and funded from tourist development taxes or BP grant
funds, disclosed 5 transactions (8.3 percent), totaling$4,180.68, that were incorrectly classified and recorded by object
or sub-object codes. Additionally, County records supporting many payments made to the two advertising and
marketing firms were inadequate to determine whether the payments were classified and recorded correctly.
However, based on available supporting documentation at the time of payment and additional documentation
subsequently obtained by the County, we noted several payments to the firms that were incorrectly classified and
recorded by object or sub-object codes. Examples of payments that were incorrectly classified and recorded included
the following:
➢ The County purchased two recreational vehicles for a total of $94,766. The recreational vehicles were
purchased for the TDC to use in advertising projects and marketing campaigns. These expenditures were
incorrectly classified and recorded as operating expenditures (contracted services—public relations) rather than
as capital outlay expenditures (machinery and equipment).
➢ The County purchased an exterior marquee for the convention center for $81,237.50 that was incorrectly
classified and recorded as an operating expenditure (contracted services — advertising) rather than as a capital
outlay expenditure (infrastructure).
➢ The County purchased two televisions for a total of$2,208.88. The televisions were purchased to be used in
the recreational vehicles noted above. These expenditures were incorrectly classified and recorded as
operating expenditures (motor vehicle repair and maintenance) rather than as capital outlay expenditures
(machinery and equipment).
County personnel indicated that payments made to the two advertising and marketing firms were often coded to
contracted services — advertising regardless of the purpose of the payments. When expenditures are not correctly
classified and recorded in the accounting records, management may draw incorrect conclusions about the activities
funded from restricted resources such as tourist development taxes and BP grant funds, and their ability to make
informed decisions based upon these records may be compromised.
Recommendation: The County should strengthen its procedures to ensure that expenditures are
properly classified and recorded in accordance with the Manual.
Electronic Funds Transfers
Finding No.23: Controls Over Electronic Funds Transfers
Section 668.006, Florida Statutes, requires the head of each agency to implement control processes and procedures to
ensure adequate integrity, security, confidentiality, and auditability of business transactions conducted using electronic
commerce. The County used electronic funds transfers (EFTs) to make certain types payments, including payments
to vendors and banking institutions, and had established a funds transfer agreement with a bank to provide these
services. County records indicated that 13 EFTs, totaling $15.5 million, were made during the period May 2010
25
Packet Page -61-
4/26/2016 10.E.
JANUARY 2013 REPORT No.2013-085
through May 2012 that involved tourist development taxes or funds received from BP. Our review disclosed that the
County needed to strengthen its controls over EFTs as follows:
➢ The BCC had not developed written policies and procedures regarding the authorization and processing of
EFTs,contrary to law.
➢ Employees that could initiate wire transfers also had the ability to record journal entries in the accounting
system,allowing them both access to County assets and the accounting records for these assets.
➢ The funds transfer agreement with the bank allowed authorized users designated by the CCC to electronically
initiate EFTs without the approval of another employee before the funds were transferred.
➢ The funds transfer agreement with the bank did not restrict the locations where County funds could be
transferred, allowed nonrepetitive EFTs up to $20,000,000, and allowed unlimited dollar amounts of repetitive
EFTs.
➢ The funds transfer agreement with the bank had not been updated to reflect changes in CCC personnel and
authorized an employee who terminated with the CCC in May 2005 to initiate and approve EFTs.
While our tests did not disclose any EFTs that were made for unauthorized purposes, such tests cannot substitute for
management's responsibility to establish effective internal controls. Without written policies and procedures and
effective controls governing EFT activities, the County is at an increased risk that unauthorized transfers could occur
and not be timely detected. In September 2012,the CCC updated its funds transfer agreement with the bank to delete
the terminated employee noted above.
Recommendation: The BCC should develop written policies and procedures addressing EFTs as
required by Section 668.006, Florida Statutes, including providing for an adequate separation of duties over
access to County assets and the related accounting records, and documenting independent approvals before
the funds are transferred. In addition, the CCC should revise its funds transfer agreement with the bank to
address the deficiencies noted above and timely update its funds transfer agreement with the bank when
changes in authorized personnel occur.
Information Technology Controls
Finding No.24: Access Controls
Access controls are intended to protect data and information technology(IT) resources from unauthorized disclosure,
modification, creation, or destruction. Effective access controls provide employees access to IT resources based on a
demonstrated need to view, change, add, or delete data. Further, effective access controls provide employees access
privileges that restrict employees from performing incompatible functions or functions outside of their area of
responsibility. Periodically reviewing the appropriateness of IT access privileges assigned to employees promotes
good internal control and is necessary to ensure that employees cannot access IT resources inconsistent with their
assigned job responsibilities.
As part of our review of the County's expenditure payment process,we noted certain deficiencies in access controls as
follows:
➢ All employees in the CCC's Finance Department, including accounts payable and payroll employees, had the
ability to record journal entries. However, CCC procedures did not provide for an independent review of all
journal entries recorded in the accounting system to determine that the journal entries were properly
authorized. County IT personnel indicated that, due to software limitations, an employee's ability to record
journal entries could not be limited without also limiting the employee's ability to view certain accounting
records.
26
Packet Page -62-