Stockton Homepage  For Residents  For Visitors  For Businesses  Helpful Resources  Contact Us  SEARCH

  Auditor Office
  Links
  Annual Audit Plan
  Audit Committee
      Minutes
  Audit Authority
  Audit Process
  Audit Trails
Newsletter
  External
Quality Control
  Reports
  Meet the Staff
  Mission Statement

  Service Efforts
    and Accomplishments

  Audit
  Organizations
  AGA
  AICPA
  ALGA
  GAO
  GFOA
  IIA
  ISACA
  Yellow Book

  Sitemap
  Site Search

Office of the City AuditorAudit Management Information Services,
Internal Audit Report
June 2001

Stockton City Council

INTERNAL AUDIT SUMMARY: MANAGEMENT INFORMATION SERVICES

We have completed an audit of Management Information Services (MIS) in response to information received by the City Auditor from City employees. Our audit was conducted in accordance with Generally Accepted Government Auditing Standards. Due to the nature of the issues under review, we coordinated our efforts with the Personnel Services Department and the City Manager's Office.

Our audit was not a complete review of MIS operations; rather, the objectives were to determine whether the employees' concerns were verifiable, quantify the impact to the City, identify weaknesses in related internal controls, and offer recommendations for improvements. We expanded the scope of our work to address other areas of concern encountered during the course of the audit.

We concluded from our work that many concerns of the employees who came forward were verifiable. We observed violations of the Fair Labor Standards Act, City Charter, City policies and procedures, and contract terms with service vendors. In addition, we noted a number of areas where the inadequacy of policies and procedures increased the City's risk exposure. While the financial impacts of the discrepancies observed were not material, they highlighted the City's increased potential for loss related to the inadequacy or lack of internal controls. Correction of these control weaknesses will reduce the City's risk exposure.

During the course of the audit, we offered suggestions to strengthen internal controls. Management was receptive to our suggestions, and in some areas took steps to make immediate improvements. We would like to thank the staff of MIS, Personnel Services, and the City Manager's Office who assisted us during the audit.

Additional information about our audit can be found in the attached INTERNAL AUDIT REPORT.

ORIGINAL SIGNED BY:

F. MICHAEL TAYLOR, CIA
CITY AUDITOR

ORIGINAL SIGNED BY:

JIM HENTHORN, CIA
SENIOR INTERNAL AUDITOR

TABLE OF CONTENTS
Management Information Services
Internal Audit Summary
Internal Audit Report

Management Information Services

We have completed an audit of Management Information Services (MIS) in response to information received by the City Auditor from City employees. Our audit was conducted in accordance with Generally Accepted Government Auditing Standards. Due to the nature of the issues under review, we coordinated our efforts with the Personnel Services Department and the City Manager's Office.

BACKGROUND

Like most organizations, the City of Stockton has increased its dependence on computer technologies to perform many of the tasks of daily operations. In recent years, the City's computer environment has moved towards a centralized structure. The implementation of a citywide document management system has further shifted the burden of managing the City's data to MIS.

The mission of MIS is to enable the City to effectively provide services by utilizing computer and internet information resources, telecommunications and radios. MIS is responsible for the purchase, replacement, repair and support of all City computer hardware and related software. MIS maintains the City's computer network, AS/400 systems, Geographic Information Services systems, and systems critical to public safety including computer aided dispatch. The array of requested technical services continues to change the purpose, function, and responsibilities of MIS.

For fiscal year 2001 - 2002, MIS expenditures are budgeted to be $8.4 million. Thirty-two staff positions have been allocated, of which 26 were filled as of March 2001. To meet the increasing demand for resources, MIS has relied on the use of temporary agency workers (temp workers). Approximately 11 temp workers are assigned to MIS performing a variety of functions from clerical to technical. Some of these temp workers have served the City for several years, performing tasks critical to the City's operations.

OBJECTIVES AND SCOPE

The objective of our audit was to determine whether the concerns raised by the employees were verifiable. Where verifiable, we sought to quantify the impact to the City and to identify related weaknesses in internal controls.

The scope of our audit work focused on the issues and timeframes addressed by the information received. We did not attempt to gain a thorough understanding of entire systems or processes. Rather, we attempted to gain sufficient understanding to plan our work, and to assess the information reviewed.

We addressed issues related to contract compliance, payroll time reporting for MIS employees and temp workers, the safeguarding of City property, and the existence of documented policies and procedures. We reviewed documentation and transactions through March 31, 2001. Where it was determined to be applicable to understanding the issues under review, we examined documentation of transactions from prior years. Our report does not address the City employees' concerns that could not be substantiated through the audit work performed. However, the audit report does include other related issues that came to our attention during the course of our work.

METHODOLOGY
We began by reviewing the communications and the supporting documentation received by the City Auditor to identify the issues. We then followed a limited scope methodology in which our work was primarily a preliminary survey to gain a basic understanding of the process under review. We then performed detailed testing of transactions.

To gain an understanding of the processes, we interviewed City staff and vendors, and reviewed applicable statutes, City policies and procedures, contracts, and transaction documentation. Based on auditor judgement, transactions were selected for testing. We compared what was observed during transaction testing with the applicable criteria for the purpose of assessing compliance. Where weaknesses in internal controls were observed, we communicated them to management with our recommendations for improvement.

RESULTS
The scope of our audit work was limited, and did not address all aspects of MIS operations. Based on our observations, interviews, and field testing, we conclude that the lack of documented policies and procedures, and lack of compliance with existing policies and procedures led to violation of the Fair Labor Standards Act, noncompliance with the City Charter, and the loss of City funds as follows:

1. Inaccurate Time Sheets and Violation of the Fair Labor Standards Act
During the period from 12/10/99 to 4/30/00, MIS management allowed a City employee to work at home while recovering from an illness. Initially, the employee worked less than 8 hours per day and less than 40 hours per week. However, no exceptions were noted on the Exception Time Sheets and the employee received full pay. By signing the Exception Time Sheets, which stated that there were no exceptions, the employee and supervisor knowingly submitted inaccurate payroll records.

In later pay periods, the employee made up the time by working in excess of a 40-hour workweek. Again, the time was not reflected on the Exception Time Sheets submitted. The employee created an unofficial record to document the actual hours worked and the hours that were owed or made up on a particular day. According to the Fair Labor Standards Act, regardless of the agreement between the employer and the employee, overtime compensation is required for the hours worked in excess of 40 hours per week.

Management Action Plan: The employee referred to in this finding will be paid for the overtime worked on the July 7, 2001 payday. In addition we are scheduling staff in the MIS Division of Administrative Services for training on FLSA rules and requirements in an effort to assure overtime of the nature described in your report is not incurred in the future. We are also working to produce and distribute to staff procedures for payroll and work time. These procedures are projected to be completed by September of this year.

2. Temporary Agency Workers were Paid for Hours not Worked
Three temporary agency workers performing clerical tasks were paid for hours not worked totaling a minimum of 66.75 hours and $1,030.26. We observed additional instances where it was questionable whether the hours were worked. The discrepancies were attributed to gifts of time, math errors, and failure to detect obvious inconsistencies in the time reporting documentation as follows:

3. Inadequate Policies and Procedures
The policies and procedures maintained by MIS do not address a number of issues including: the department's position regarding the use of City computer resources and data by MIS staff; the granting and use of system access; the handling of confidential data; segregation of incompatible duties or compensating controls; documentation of system changes; controlling the work of contractors; and periodic monitoring processes to ensure that system security has been maintained. In addition, we observed only minimal documentation of desk procedures, which increases the department's dependence on key individuals.

Management is responsible for assessing the risk exposures to information systems and establishing reasonable control policies and procedures to ensure a secure information system environment. The extent of management controls considered reasonable is dependent on the complexity of the systems, the number of users, and the critical nature of the application to the organization. To ensure consistent application, policies and procedures should be in writing.

Management Action Plan: A plan has been developed that lists the procedures and policies related to the division that need to be reviewed and created or updated. The plan lists the policies and procedures that need attention in a priority that addresses security first. This plan projects these procedures and policies to be developed and distributed by September 2001. These policies and procedures will be included in division wide training and orientation upon their finalization and distribution.

4. Payments Continue on an Expired Contract
Contract Number C-98-185 for Document Management Enhancements expired on July 30, 1999. According to Section 5 of the contract, "the term of this Agreement shall be for one (1) year, with CITY reserving the right to extend this Agreement for two (2) one (1) year period(s) from the original contract expiration date. PROJECT MANAGER must request in writing, at least thirty (30) days prior to the end of the terms of the Agreement, as may be extended, an extension of the original agreement and CITY must agree to said extension. If such a request is made… the City Manager may allow an extension of the original or mutually agreed upon modified terms of the agreement for a period of one (1) year."

Since the Project Manager did not request a contract extension in writing and obtain the City Manager's approval as required, the $42,407 expended after the contract expired in 1999, were made without City Council authorization.

Management Action Plan: Contract C-98-185 has been prepared for ratification at the City Council meeting of July 10, 2001.

5. MIS Delayed Recording the Receipt of Computer Equipment
MIS did not consistently report the receipt of computer equipment to the City's Administrative Services Accounting Division in a timely manner. MIS would wait until the equipment was assigned to an employee before communicating receipt of the asset to the Accounting Division. Until the Accounting Division is notified, computer equipment is not recorded as an asset in the City's accounting records. Management is responsible for implementing internal controls to ensure the reliability and integrity of financial information, and the safeguarding of assets.

Management Action Plan: Receipt and inventory of computer and other equipment by MIS is now accomplished on an on-going and routine basis. Accounting and MIS have worked to develop procedures that are in effect and have been operational since April 2001. Equipment is reported and inventoried immediately upon receipt and before assignment to departments for use.

6. The City does not have a Nepotism Policy
Aside from language in the Stockton City Charter addressing specific elected and appointed officials, the City does not have a written policy addressing nepotism. An MIS administrative staff person is related to a lower level MIS employee. Although not able to authorize personnel actions independently, the supervisor participated in the hiring of the relative as a temporary agency worker and later as a regular City employee. The supervisor also participated in performance evaluations, salary step increases, and promotion of the relative. MIS management was aware of the relationship.

Management Action Plan: A draft Nepotism Policy has been forwarded to the City Attorney from the Director of Personnel Services. This policy is anticipated to be approved and distributed within the next week.

7. The City does not have a Telecommuting Policy
We observed three instances where MIS administrative staff worked from home during periods of recuperation from illness or injury. The lack of guidelines for documenting telecommuting agreements hinders an external reviewer's ability to determine whether these arrangements served a business need and the work was properly supervised, or whether these were merely accommodations solely for the benefit of the employees.

An established policy would define telecommuting and provide guidelines for the terms and conditions of an agreement. The policy would clarify issues related to authorization, supervision, timekeeping, business need, and specific goals and deliverables.

Management Action Plan: A draft Telecommuting Policy has been prepared by the Director of Personnel Services and is anticipated to be distributed within the next two weeks.

8. The City has been Over-billed for Temporary Worker Services
The Personnel Services Department was the administrator of the contract between the City of Stockton and Availability Personnel Services (Availability). Prior to February 2001, MIS was allowed to hire temp workers directly with Availability and increase temp worker pay rates without Personnel's input. Consequently, Availability has been billing the City in excess of contracted rates for clerical and computer operator temp workers since the agreement date of August 4, 1998.

Based on the contract rates and categories provided in the agreement, we computed an estimated overpayment of $228,283. Of this amount $200,029 related to computer operators and $28,253 related to clerical workers. When Personnel disclosed the discrepancy in the rates to Availability, both parties agreed that the issue with the computer operators was one of mistaken terminology. The computer operators, a classification listed on the rate schedule, were actually performing work of computer technicians, a classification not listed on the rate schedule. Exhibit A of the contract allows for other temp worker classifications and billing rates as agreed to by the City and the Temporary Agency.

In addition to the clerical temp workers being paid in excess of contract rates, we noted the MIS clerical temps were paid in excess of rates the City pays for regular full-time employees performing the same duties. Our review disclosed that the temp worker's rates corresponded with the City's Office Specialist category rather than the Office Assistant I & II categories in which the temp workers were classified. In comparing the rate billed with the top pay scale for the City's Office Assistant I & II category for each year, we computed the following estimated overpayment.