2006 rbar

Washington State Auditor’s Office

Accountability Audit Report

Whatcom County

Report Date July 12, 2006

Report No. 71332

Issue Date September 8, 2006

September 8, 2006 Council Whatcom County Bellingham, Washington Report on Accountability for Public Resources Please find attached our report on Whatcom County’s accountability for public resources and compliance with state laws and regulations and its own policies and procedures. In addition to this work, we also audit the County’s financial statements and compliance with federal laws and regulations. The results of that audit will be included in a separately issued audit report. Sincerely,

BRIAN SONNTAG, CGFM STATE AUDITOR

Washington State Auditor Brian Sonntag

Insurance Building, P.O. Box 40021 Olympia, Washington 98504-0021 (360) 902-0370 (866) 902-3900 TDD Relay (800) 833-6388 FAX (360) 753-0646 http://www.sao.wa.gov

Insurance Building, P.O. Box 40021 Olympia, Washington 98504-0021 (360) 902-0370 (866) 902-3900 TDD Relay (800) 833-6388 FAX (360) 753-0646 http://www.sao.wa.gov

Table of Contents

Whatcom County July 12, 2006

Audit Summary.............................................................................................................................................. 1

Description of the County.............................................................................................................................. 2

Audit Areas Examined................................................................................................................................... 4

Schedule of Audit Findings ........................................................................................................................... 5

Washington State Auditor’s Office 1

Audit Summary


ABOUT THE AUDIT

This report contains the results of our independent accountability audit of Whatcom County. We performed audit procedures to determine whether the County complied with state laws and regulations and its own policies and procedures. We also examined County management’s accountability for public resources. Our work focused on specific areas that have potential for abuse and misuse of public resources. Areas examined during the audit were selected using financial transactions from January 1, 2005, through December 31, 2005.

RESULTS

In most areas, the County complied with state laws and regulations and its own policies and procedures. However, we identified three conditions significant enough to report as findings: • The Planning and Development Services Department lacked sufficient management

oversight to ensure adequate internal controls were in place over cash-receipting, fee adjustments and permit fees.

• The Planning and Development Services Department lacked sufficient management

oversight over the plan review process and allowed an independent contractor (a former County employee) to use County facilities and equipment, giving the appearance that this individual was a County employee.

• The Treasurer’s Office did not have adequate internal controls, monitoring and oversight

over cash-receipting. RELATED REPORTS

Our opinion on the County’s financial statements and compliance with federal program requirements is provided in a separate report, which includes the County’s financial statements.

CLOSING REMARKS

We thank County officials and personnel for their assistance and cooperation during the audit.


Description of the County


ABOUT THE COUNTY

Whatcom County serves approximately 180,000 residents under its Home Rule Charter, adopted in 1978. The County has a legislative branch, composed of the County Council, and an executive branch, composed of an elected County Executive, Assessor, Auditor, Treasurer, Prosecuting Attorney and Sheriff. The County provides an array of services including health and human services, cooperative extension, Medical Examiner, parks and recreation, planning and development services, District Court, District Court probation, Superior Court, Juvenile Court (probation and detention), Law Library, Auditor’s Office (licensing and recording), Assessor’s Office, Hearing Examiner’s Office, jail, Sheriff (emergency management and patrol), Prosecuting Attorney’s Office (criminal and civil), Public Defender, Treasurer’s Office and Public Works (engineering, equipment rental, ferry and maintenances and operations). The County operated on a General Fund budget of $67.3 million in fiscal year 2005 and has approximately 800 employees.

AUDIT HISTORY

We audit the County annually. The past five audits have reported five findings: we reported one in 2002, three in 2003 and one in 2004. County officials have taken steps to make improvements and correct conditions noted in prior findings.

ELECTED OFFICIALS

These officials served during the audit period:

Council: County Executive Assessor Auditor Prosecuting Attorney Sheriff Treasurer

Seth Fleetwood Ward Nelson Dan McShane Laurie Caskey-Schreiber Sam Crawford Sharon Roy Barbara Brenner Pete Kremen Keith Willnauer Shirley Forslof David McEachran Bill Elfo Barbara Cory


ADDRESS

County 311 Grand Avenue Bellingham, WA 98225 (360) 676-6700 www.co.whatcom.wa.us


Audit Areas Examined


In keeping with general auditing practices, we do not examine every portion of Whatcom County's financial activities during each audit. The areas examined were those representing the highest risk of noncompliance, misappropriation or misuse. Other areas are audited on a rotating basis over the course of several years. The following areas of the County were examined during this audit period: ACCOUNTABILITY FOR PUBLIC RESOURCES

We evaluated the County’s accountability in the following areas:

• Cash receipting in the Courts, Planning and Development Services Department, Treasurer’s Office and Parks and Recreation Department

• Purchase of goods and services • Payroll • Property and equipment

We audited the following areas for compliance with certain applicable state and local laws and regulations:

• Use of restricted funds • Required financial schedules • Insurance and bonding • Budgeting requirements • Ethics/conflict of interest laws • Open Public Meetings Act • Compliance with debt covenants

• Competitive bidding requirements • Contracts and agreements • Interfund transactions • Legal and supported payments • State environmental policy

administration – Planning Department • Use of state grant funds

FEDERAL PROGRAMS

We evaluated internal controls and tested compliance with federal program requirements, as applicable, for the County’s major federal programs, which are listed in the Federal Summary section of the financial statement and single audit report.

FINANCIAL AREAS

Our opinion on the County’s financial statements is provided in a separate report. That report includes the County’s financial statements and other required financial information. We examined the financial activity and balances of the County including: • Cash and investments • Revenues • Expenditures

• Long-term debt • Overall presentation of the financial

statements


Schedule of Audit Findings


1. The Whatcom County Planning and Development Services Department did

not ensure adequate internal controls were in place over cash-receipting, fee adjustments, and permit fees.

Description of Condition The Department annually takes in approximately $4.6 million in permit fees. During our review of the Department’s internal controls over cash-receipting, fee adjustments and permits, we noted: • The Department did not always follow the Unified Fee Schedule adopted by the County

Council. • Permit applicants have the option of having building plans reviewed by an independent

reviewer who works with the applicant to expedite the permitting process. Beginning in March 2005, the County referred applicants to a former Department employee for this review. The Unified Fee Schedule requires a 25 percent reduction when an applicant uses an outside plan reviewer. In 94 percent of the plans reviewed, in which the applicant used the outside reviewer, the Department did not reduce the fee.

• The Department gave a 50 percent discount on plan review fees when a builder used a

plan already on file with the Department. However, this 50 percent reduction is not supported by the Unified Fee Schedule and is not in the permit software package. To provide a builder with this discount, an employee has to override the software default setting. We found no oversight or monitoring of this practice.

• Developers of commercial projects, exceeding $1.6 million paid no more than $5,000 to

have zoning review of project site. This limit is not supported by County Code or the Unified Fee Schedule.

• Employees, including cashiers, were sharing passwords to give themselves unauthorized

access to parts of the permitting system. Also, employees who no longer worked for the Department had active passwords that could be used by current employees.

• The Department did not adequately monitor fee adjustments. • An unknown number of County employees have access to the safe. The County could

not furnish us with the names or number of staff who knew the safe combination. Cause of Condition Due to lack of management oversight, the Department lacks adequate internal controls, monitoring and oversight over permits, cash receipting and fee adjustments. Effect of Condition The lack of adequate internal controls, monitoring and oversight caused the following:


• 751 plans were reviewed by an outside plan reviewer in 2005. This represented over half

of the 1,363 total permits issued that year. We estimate that by not giving the 25 percent reduction in plan check fees for permits reviewed by an outside party, the County overcharged permit applicants a total of $167,000. Also, from January through June 2006, applicants were overcharged an estimated $61,000.

• Employees adjusted the formula within the permit software to grant a 50 percent discount

to builders who used repeat plans and master plans, resulting in unauthorized discounts totaling $101,000 in 2005.

• By limiting certain commercial permit fees to $5,000, the County granted unauthorized

discounts exceeding $47,000 in 2005. • When employees use other employees’ passwords, responsibility for adjustments, fee

reductions and cash-receipting can not be determined.

Recommendation To ensure safeguarding of public resources, we recommend the Department: • Develop internal controls including management oversight and monitoring to ensure

permit fees as adopted by the County Council are followed. • Develop internal controls to ensure employees comply with County policy forbidding the

sharing of passwords. • Ensure all adjustments to permit fees are tracked and monitored for appropriateness. County’s Response Whatcom County will improve internal controls over cash receipting and permit fee collection. Whatcom County will perform a thorough review to ensure all fees and discounts are properly authorized by the unified fee schedule. Management will periodically review permit transactions to verify that the proper fees were charged. Effective July 7, 2006, the combination to the safe was changed and access is limited to seven managers and supervisors. Access to the permit system is now limited to active employees. On July 7, 2006, all employees were required to change their permit system passwords and employees have been reminded of the County’s policy prohibiting sharing passwords. Effective October 2006, employees will be required to change their password every three months. Whatcom County had large backlogs of building plans waiting for county staff review and approval. In response to this backlog, the County implemented a program to utilize independent contract plans examiners (IPEs). Use of an IPE required mutual agreement between building permit applicants and the County. Whatcom County only intended to authorize use of IPEs if the backlog of building plans became excessive. Many building permit applicants began using IPEs to expedite their building permit applications. Whatcom County did not agree to discount plan review fees unless the County’s review would exceed four weeks. We agree the County’s policy on use of an IPE should include better documentation, and that the unified fee schedule should be updated to better reflect County policy. We do not agree that Whatcom County overcharged permit applicants. In the unified fee schedule, Zoning - Site Plan Reviews Commercial are charged at .3% of building valuation not to exceed $5,000. This fee was properly reflected on the 2001 unified fee


schedule. Beginning in 2002 and continuing through 2005, the “not to exceed $5,000” was inadvertently left off the unified fee schedule. Our records show there was no intent to change the fee. We will correct this printing error on the 2007 unified fee schedule. Auditor’s Remarks We appreciate the County’s commitment to correct the condition identified. We note that the condition described is based on the documentation provided to auditors by the County. The documentation included the approved unified fee schedule, which included a discount for patrons utilizing an independent plan reviewer. The discounts were not consistently provided. We re-affirm the condition described. We will review the status of the finding in the next audit. Applicable Laws and Regulations RCW 43.09.200 Local government accounting – Uniform system of accounting, states in part:

The system shall exhibit true accounts and detailed statements of funds collected, received, and expended for account of the public for any purpose whatever, and by all public officers, employees, or other persons. The accounts shall show the receipt, use, and disposition of all public property, and the income, if any, derived therefrom; all sources of public income, and the amounts due and received from each source; all receipts, vouchers, and other documents kept, or required to be kept, necessary to be made, for the internal administration of the office to which they pertain; and all reports published or required to be published, for the information of the people regarding any and all details of the financial administration of public affairs.

RCW 43.09.240 Local government accounting--Public officers and employees--Duty to account and report--Removal from office--Deposit of collections, states:

Every public officer and employee of a local government shall keep all accounts of his or her office in the form prescribed and make all reports required by the state auditor . . . Every public officer and employee, whose duty it is to collect or receive payments due or for the use of the public shall deposit such moneys collected or received by him or her with the treasurer of the local government once every twenty-four consecutive hours.

Volume 1, Part 3, Chapter 1, Page 12 of the 2004 Budgeting, Accounting and Reporting System (BARS) Manual, issued by the State Auditor’s Office pursuant to RCW 43.09.230, states in part:

Each entity is responsible for establishing and maintaining an effective system of internal controls throughout their government . . . An internal control system should provide reasonable assurance that an entity will accomplish its objectives.

Whatcom County Policy Number AD152001Z--Using Computer Systems, states in part:

5. Whatcom County Prohibits Certain Activities

Users will NOT:

A. Use inappropriate language including obscenity, vulgarity, profanity or name-calling.

B. Express ill will or bias against individuals or groups.


C. Transmit offensive or sexually explicit material.

D. Visit pornographic or other inappropriate Internet sites.

E. Send or engage in harassing messages, derogatory comments, retaliation or other discrimination.

F. Use an alias, leaving anonymous messages or misrepresenting one’s position or authority.

G. Sign-on or use any other user’s access.

H. Disclose passwords to anyone.

I. Intentionally intercept, read, copy, or otherwise compromise information to a non-authorized person or entity.

J. Attempt to gain unauthorized access or otherwise intentionally disrupt the network.

K. Alter forwarded materials, unless indicated.

L. Access, view or forward confidential or privileged information unless the user has the same privilege or confidence or has obtained specific permission from the original sender.

M. Solicit for commercial activities, personal gain, religious causes, political causes, charitable solicitations, support for outside organizations or other personal causes or activities unless it has County Executive approval as a county-sponsored activity.

N. Advertise for the purchase or sale of any item or service.

O. Download items off the Internet or install programs that do not meet county standards.

P. Send mass email distribution without prior authorization. PRO AD253001A (Emphasis added.)

WCC 20.04.090 - -Application fees and other fees, states in part:

Fees for conditional use permits, variances, planned unit developments, initiated amendments and fees for other approvals and reviews as set forth in this title shall be as provided in the County’s Unified Fee Schedule.(Ord. 98-010§2, 1998)

Whatcom County Ordinance 2004-067 adopted the Unified Fee Schedule for 2005.



Whatcom County July 12 2006

2. Whatcom County Planning and Development Services Department did not

ensure adequate internal controls were in place over outside plan reviews.

Description of Condition The Department annually receives approximately 1,400 permit applications. During our audit of the Department’s plan check process, we noted an independent contractor, who was a former Department employee, performed a plan review on 711 of these applications in 2005. We noted the following concerns: • The independent contractor signed his name to reviewed plans using the Department

seal. Additionally, he signed the plans as approved by the Whatcom County Planning and Development Services Department. By doing so, he represented himself as a County employee rather than as an independent contractor.

• In some instances, the independent contractor was allowed to perform his reviews and

personally benefit from using County facilities. • The independent contractor had sign-on capabilities and a password to access the

Department’s computer system.

Cause of Condition The Department allowed an independent contractor to use County equipment and other facilities to conduct plan reviews. Effect of Condition The lack of adequate internal controls, monitoring and oversight within the Department allowed an independent contractor to be given access to facilities and the computer system and to approve plans while representing himself as a County employee.

Recommendation We recommend the Department: • Discontinue the practice of allowing an independent contractor to sign plans using the

County’s seal and approval stamp. • Revoke the independent contractor’s computer access. • Discontinue allowing an independent contractor the use of County facilities.


County’s Response Effective July 17, 2006 Whatcom County Planning and Development Services: 1) Discontinued the practice of allowing an independent contract plans examiner to sign plans using the County’s seal and approval stamp, 2) Revoked the independent contract plans examiner computer access to the County’s permit system, and 3) Discontinued the independent contract plans examiner’s use of staff areas within County facilities. By January 1, 2007, Whatcom County Planning and Development Services will implement a program to certify Independent Contract Plans Examiners. The certification program will require the independent plans examiner enter into an agreement with Whatcom County defining the plans examiner’s responsibilities and relationship with Whatcom County. Auditor’s Remarks We appreciate the County’s commitment to correct the condition identified. We will review the status of the finding in the next audit. Applicable Laws and Regulations Volume 1, Part 3, Chapter 1, Page 12 of the 2004 Budgeting, Accounting and Reporting System (BARS) manual, issued by the State Auditor’s Office pursuant to RCW 43.09.230, states in part:


Whatcom County Policy Number AD152001Z--Using Computer Systems, states in part:

5. Whatcom County Prohibits Certain Activities

Users will NOT:

A. Use inappropriate language including obscenity, vulgarity, profanity or name-calling.

B. Express ill will or bias against individuals or groups.

C. Transmit offensive or sexually explicit material.

D. Visit pornographic or other inappropriate Internet sites.

E. Send or engage in harassing messages, derogatory comments, retaliation or other discrimination.

F. Use an alias, leaving anonymous messages or misrepresenting one’s position or authority.

G. Sign-on or use any other user’s access.

H. Disclose passwords to anyone.


I. Intentionally intercept, read, copy, or otherwise compromise information to a non-authorized person or entity.

J. Attempt to gain unauthorized access or otherwise intentionally disrupt the network.

K. Alter forwarded materials, unless indicated.

L. Access, view or forward confidential or privileged information unless the user has the same privilege or confidence or has obtained specific permission from the original sender.

M. Solicit for commercial activities, personal gain, religious causes, political causes, charitable solicitations, support for outside organizations or other personal causes or activities unless it has County Executive approval as a county-sponsored activity.

N. Advertise for the purchase or sale of any item or service.

O. Download items off the Internet or install programs that do not meet county standards.

P. Send mass email distribution without prior authorization. PRO AD253001A (Emphasis added.)

WCC 20.04.090--Application fees and other fees, states in part:

Fees for conditional use permits, variances, planned unit developments, initiated amendments and fees for other approvals and reviews as set forth in this title shall be as provided in the County’s Unified Fee Schedule.(Ord. 98-010§2, 1998)

Whatcom County Ordinance 2004-067 adopted the Unified Fee Schedule for 2005.




3. The Whatcom County Treasurer’s Office does not have adequate internal

controls, monitoring and oversight over cash-receipting.

Description of Condition The Office collected $39.2 million in property tax revenue in 2005. The Office also collects other revenues such as gasoline and gambling taxes. In the 2004 audit, we reported concerns with internal controls over monitoring revenues and cash receipting. In the current audit, we found many of the same concerns. During our review of the Office’s internal controls over cash-receipting and account adjustments, we noted: • Management does not adequately monitor which functions each employee has access to

in the computer system or does not ensure that computer access is appropriately restricted.

• Employees who process payments received by mail also have computer access to make account adjustments in the computer system.

• Employees responsible for billings and adjustments of assessments are also responsible for processing payments received by mail.

• Employees who are responsible for monitoring a specific revenue stream also process payments received by mail.

• Mail is opened by one person at a time, with no log or other record of what is received or other compensating control ensuring accountability over revenues received in the mail.

• Money received by mail is transferred from person to person with no record of how much money was transferred, which ensures accountability and that funds are safeguarded at all times.

Cause of Condition Management has not actively monitored controls over system security and segregation of duties. Effect of Condition As a result of the lack of adequate internal controls, oversight and monitoring, the public cannot be assured the Office received all money due to it. In addition, if a loss occurred, it may not be identified in a timely manner and it would be difficult to determine who was responsible.


Recommendation We recommend the Office improve internal controls, oversight and monitoring over cash receipting. These improvements should include, but are not limited to: • Limit computer access and arrange job functions to provide segregation of duties. • Establish procedures to provide accountability for mail received and processed. • Provide accountability for money transferred from one person to another. • Actively monitor cash receipting and revenue activity. County’s Response The County recognizes and understands the need to internalize and improve our controls, oversight, and system access that support the segregation of job duties within the Treasurer’s office. The County will review job functions and make sure system access is consistent with those functions. Auditor’s Remarks We appreciate the County’s commitment to correct the condition identified. We will review the status of the finding in the next audit. Applicable Laws and Regulations

Volume 1, Part 3, Chapter 1, Page 12 of the 2004 Budgeting, Accounting and Reporting System (BARS) Manual, issued by the State Auditor’s Office pursuant to RCW 43.09.230, states in part:


RCW 43.09.200 Local government accounting – Uniform system of accounting, states in part:

The system shall exhibit true accounts and detailed statements of funds collected, received, and expended for account of the public for any purpose whatever, and by all public officers, employees, or other persons. The accounts shall show the receipt, use, and disposition of all public property, and the income, if any, derived therefrom; all sources of public income, and the amounts due and received from each source; all receipts, vouchers, and other documents kept, or required to be kept, necessary to be made, for the internal administration of the office to which they pertain; and all reports published or required to be published, for the information of the people regarding any and all details of the financial administration of public affairs.

2006 rbar

Documents