CityNet (Procurement) Audit August 2009

Patrice Randle, City Auditor Craig Terrell, Assistant City Auditor Michelle Brown, Staff Auditor

CityNet (Procurement) Audit Table of Contents

Page Executive Summary............................................................................................................................1 Audit Scope and Methodology ...........................................................................................................3 Background.........................................................................................................................................5 Detailed Audit Findings......................................................................................................................7

CityNet (Procurement) Audit

Office of the City Auditor
Patrice Randle, CPA City Auditor

Project #07-15.2

August 21, 2009 As part of the Fiscal Year 2007 Annual Audit Plan, the City Auditors Office conducted an audit of the CityNet procurement module. The audit was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The objectives of the audit were to determine whether: information contained within the system is accurate and properly safeguarded; systematic and manual controls are working properly to ensure compliance with applicable City policy as well as state and federal law; and, the implementation of Lawson has increased the efficiency of the procurement process and the system has the ability to effectively work with other information systems within the City.

Executive Summary
Overall efficiency in procurement process has increased Contracts and expenditures can be easily tracked and monitored in real time System controls, including approvals, work properly

Opportunities for Improvement

Monitor professional service contracts Reduce the use of purchase orders after the fact Establish monitoring procedures for the vendor database

The City Auditors Office noted that system controls are working properly and that, overall, the efficiency of the procurement process has increased with the implementation of Lawson. The City Auditors Office noted that requisitions under $3,000 were approved properly by departmental approvers. Additionally, sole source and quote information along with requisitions over $3,000 were properly approved by Purchasing Agents. Contract information and pricing were also found to be accurate. The City Auditors Office noted that employee information in the system is correct, controls are in place to ensure that users have only one active user identification and terminated employees are promptly removed from the system. The implementation of Lawson has automated the requisition and purchase order (PO) processes, increasing the overall efficiency of the procurement process. This has made tracking of 1

CityNet (Procurement) Audit

August 21, 2009

expenditures and contracts easier and more efficient. The procurement process now has a systematic three-way match that allows for a more secure payment process. Ordering and receiving on contracts has also become more secure, through price control in the shopping cart. The Purchasing Agents spend less time monitoring contracts since the system will notify agents if contract expiration or limits are approaching. While the implementation of Lawson has lead to many process improvements, there were areas where weaknesses were identified including the recording of professional service contracts, the use of after-the-fact purchase orders, and monitoring of the vendor database. These findings and recommendations are discussed in the Detailed Audit Findings section of this report.

CityNet (Procurement) Audit

August 21, 2009

Audit Scope and Methodology

This audit focused on procurement activities and transactions for Fiscal Year 2008, including requisitions, POs, invoices, and payments. The audit was conducted in accordance with generally accepted government auditing standards. The following methodology was used in completing the audit. Interviewed Purchasing and Accounts Payable staff. Reviewed system information for accuracy and compliance with City policy and state and federal law. Reviewed system and manual controls for proper safeguards. Reviewed payments and the use of purchase orders to ensure compliance with City policy and applicable law. Reviewed vendor set-up and maintenance of the Citys vendor database. Reviewed the Smart Data Online (SDOL) procurement card interface and increased efficiencies that resulted from the implementation of the Lawson system.

The City Auditors Office attempted to determine if the City is in compliance with the State of Texas Prompt Payment Law. Prompt payment law states that a payment is late on the 31st day after the goods/services are received/completed or the invoice is received, whichever is later. This is applicable to orders that are correct and are not being disputed with the vendor. The majority of invoices appear to have been paid on time. However, since invoices are sent to departments prior to being sent to the Accounts Payable Division, the City Auditors Office was not able to determine whether payments made beyond 30 days of the invoice date were timely. Departments that receive invoices do not document when invoices are received and also do not appear to be receiving items in the system when they arrive. The following chart shows how quickly payments are being made from the date of invoice.

CityNet (Procurement) Audit

August 21, 2009

Invoice to Payment Date

12,000 10,640 10,000

8,000

6,000

4,000

2,044 2,000 669 8 0 Prior to Invoice Date 0-30 Days 31-60 Days 61-90 Days 91-120 Days Over 121 Days 289 348

Source: Lawson Financial System Fiscal Year 2008 invoices

CityNet (Procurement) Audit

August 21, 2009

Background
In February 2006, the City moved from an all manual procurement system to a mostly automated one through the implementation of the Lawson Financial System procurement module. The procurement module allows commodity and service contract information and pricing to be entered and tracked in the system. It also allows for the creation of requisitions and approval of those requisitions which results in POs. The bid process as well as approval of quotes, sole source documentation and contracts approved by City Council are not automated and cannot be tracked on the system. Lawson does offer a separate module, the sourcing module, which will allow these activities to be automated. According to the Purchasing Division, the City will purchase the sourcing module and implement it, in part, in the spring of 2010. The implementation will include an external supplier database that will allow potential suppliers to register their business information and products whether or not they have ever done business with the City. This database can eventually be used to obtain quotes and notify suppliers of bid opportunities. The Citys basic procurement process, as seen in the diagram below, begins with a requisition for an item or service and once the requisition is approved it becomes a purchase order. When the item arrives or the service is completed it is received on the system. When an invoice arrives and is entered into the system, a three-way match between the purchase order, receiver and invoice occurs and payment is made. Purchase Requisition Purchase Order Receipt of Goods/Services Vendor Invoice Payment of Invoice

The steps in the procurement process described above are completed by various Lawson users. These roles are as follows. Requisitioner Identifies the need for an item or service and creates a requisition in the system for that purchase. Level One Approver Approves the purchase requisition created by the Requisitioner. Level Two Approver - This is an additional level of departmental approval available for use at the discretion of the Department Head. The only department that has determined a need for this level of approval is the Community Services Department. Level Three Approver Approves purchase requisitions over $3,000 and under $50,000 after receiving level one approval. Level three is only available to Purchasing Agents within the Purchasing Division. Purchases over $3,000 and under $50,000 require quotes or sole source justification that must be reviewed by the Purchasing Agent prior to system approval. Auto Approver Identifies the need for an item or service and creates a requisition in the system for that purchase. An auto approver is also a level one approver. If the purchase is below $3,000, the requisition will become a PO with no required approval. Receiver Receives the items or services in the system once the items have been received or the services completed.

CityNet (Procurement) Audit

August 21, 2009

Accounts Payable Clerk Enters the invoice and instructs the system to perform a three-way match to ensure accuracy prior to payment. Once the three-way match occurs, payment on the invoice is made.

Beginning November 2009, the Financial and Management Resources Department will outsource the accounts payable function to a third party, SourceNet. SourceNet will have a software application that integrates with Lawson. According to the Financial and Management Resources Department, SourceNet will receive most invoices directly from vendors, convert paper invoices to electronic images, and then route the electronic images to the department initiating the purchase. After necessary coding and approval has been obtained, SourceNet will forward a payment file to the City where a three-way match will be performed. Accounts payable checks will then be printed and disbursed. SourceNet will also assume responsibility for vendor database maintenance and managing a portion of the procurement card process, including ordering procurement cards, user set-up and database maintenance.

CityNet (Procurement) Audit

August 21, 2009

Detailed Audit Findings

1. City Departments do not use service purchase orders within the Lawson financial system to record professional service contracts. Lawson has the ability to track expenditures on professional service contracts through the use of service POs. However, most City departments are not utilizing this feature to track their professional service contracts. According to the Purchasing Manual, the Citys Purchasing Division does not handle or monitor professional service contracts. This responsibility lies with each department. The Purchasing Division has suggested the use of service POs as a best practice for the City and includes step-by-step instructions on how to use them on the Purchasing portal. The use of service POs would allow the City to easily track the number of professional service agreements and associated contract expenditures to ensure that contract limits have not been exceeded and that contract payments are in compliance with applicable law and City policy. The City currently maintains a list of professional service contracts under $25,000 but does not keep a listing of those requiring council approval (over $25,000). Because professional service contracts are not separately identified in the Lawson financial system, the City Auditors Office was unable to confirm the number of current professional service contracts in use. Recommendation: The City Manager should require that departments using professional service contracts utilize the service PO function in Lawson to track their contracts and expenditures. Managements Response: Concur. [The Purchasing Division will:] a. Add a statement in the Purchasing Manual, requiring that Professional Services (engineering, personal, etc.) be entered into Lawson as a PO to facilitate payment tracking; b. Continue with current quarterly training to end users on how to enter Professional Services POs in such a way that they can be easily identified and distinguished from goods/services POs; and, c. Continue tracking quarterly goods/services expenditures and breaking apart Professional Services PO data. Will forward Professional Services portion to the City Managers Office for review and compliance with known professional services contracts. Target Date: 11/15/2009 Responsibility: Debra Carrejo, Purchasing Manager

CityNet (Procurement) Audit 2. Purchases are made prior to initiating a purchase order.

August 21, 2009

City purchasing policy states that, No orders are to be placed with vendors prior to the issuance of a PO in the automated system. However, approximately 14% of the invoices paid during calendar year 2008 (4,675 out of 34,393) were dated before the creation date of the requisition, suggesting that a purchase was made prior to creating a requisition. The following chart shows these invoices by department. The use of this practice was most prevalent in the Parks and Recreation Department.

Invoices by Department
Department Parks Police Community Services Water Public Works Financial & Management Resources Environmental Services Fire Workforce Services Community Development & Planning Information Technology Library Convention Center City Attorneys Office Municipal Court Judiciary TOTALS
Source: Lawson Financial System, CY 2008 invoices

Number of Invoices 1,756 576 537 341 325 241 175 144 117 106 99 88 79 65 14 12 4,675 Total Value $1,256,061 $399,044 $342,677 $1,682,907 $711,705 $1,132,069 $521,879 $349,133 $132,713 $18,944 $1,411,785 $201,315 $103,794 $179,999 $3,769 $440 $8,448,234

The Purchasing Manager indicated that the Citys purchasing policy does not apply to purchases that are exempt from bidding requirements under Texas Local Government Code 252. Exempt purchases include items for resale, postage, and emergency purchases, which could explain some of the invoices shown in the table. According to the Parks and Recreation Department, the practice of making an order before a PO is created is common due to the high number of purchases made for resale items. Parks staff indicated that because these items are often ordered on an estimate or from vendors that substitute products, POs created ahead of time would not match the invoice. In an effort to decrease the number of PO modifications, the Purchasing Department authorized this practice for resale items. The Lawson financial system does not specifically identify purchases exempt from Texas Local Government Code 252. Therefore, the City Auditors Office was not able to determine 8

CityNet (Procurement) Audit

August 21, 2009

the number of invoices that were exempt from the Citys purchasing policy. Although the financial system does not utilize a specific field to identify exempt purchases, the Purchasing Division has requested that departments identify exempt items in a description field. For purchases that are not exempt from Texas Local Government Code 252, the City Auditors Office feels that purchasing controls would be enhanced if purchases were required to have a PO prior to placing an order. The use of POs after a purchase has been made results in the City being held responsible for purchases for which budgetary funds may not be available. Recommendation: The Financial and Management Resources Director should establish controls to monitor the use of after-the-fact purchase orders for non-exempt purchases and should notify Department Heads of continued noncompliance. Managements Response: Concur. [The Purchasing Division will:] a. Work with IT to modify the existing PO254 quarterly tracking report to add column of Invoice Date for comparison with PO date. If this option is not viable, then create new report to be run/evaluated quarterly; b. Update Purchasing Manual to incorporate specific exemptions such as resale/aborted p-card transactions; and, c. Formally notify directors when their department is habitually posting non-exempt afterthe-fact POs. Target Date: 11/30/2009 Responsibility: Debra Carrejo, Purchasing Manager

3. No monitoring controls exist to ensure that current vendors are not debarred after being entered into the system. City procurement procedure requires that vendors be checked against the Excluded Parties List System (EPLS) when they are entered into the database to ensure they have not been debarred by the federal government from receiving federal contracts or federally-approved subcontracts. Good business practice would suggest that they should be rechecked at some point in the future and researched to ensure validity. The City does not currently have controls in place beyond checking the vendors against EPLS records at the time they are entered into that database. The responsibility for entering vendors and maintaining the database lies with the Purchasing Assistant who indicated that there are too many vendors in that database to check against the EPLS more than one time or conduct extensive research, like internet searches or comparisons to employee name/address information, to ensure validity. At the time of this audit, there were approximately 70,000 debarred vendors listed on the EPLS. A listing of vendors debarred by the federal government is available for download from the EPLS website, EPLS.gov.

CityNet (Procurement) Audit

August 21, 2009

It should be noted that the responsibility for entering vendors and maintaining the database will shift at the beginning of Fiscal Year 2010 to the third party vendor handling the Citys Accounts Payable function. During testing, the City Auditors Office did not identify any sampled vendors that were invalid or debarred according to the EPLS. Recommendation: The Financial and Management Resources Director should ensure that a download of debarred vendors is obtained via EPLS.gov and periodically compared to the Citys vendor database to ensure that current vendors have not been debarred after being entered into the system. Managements Response: Concur. [The Purchasing Division will:] a. Continue current Purchasing Division practice of checking all vendors prior to initial set-up in Lawson AP10 screen; b. Continue current Purchasing Division practice of re-checking any vendors as contracts are implemented, renewed, or modified; c. Require that documentation verifying a recheck of vendor status will be formalized as part of the renewal process; and d. Staff will review the EPLS download capabilities and evaluate the cost/benefit and feasibility of comparing the two databases; noting areas that stop such an attempt (Tax-IDs unavailable in federal download). Target Date: Ongoing Responsibility: Debra Carrejo, Purchasing Manager

10