facilities services surplus department audit report# 17-04 faciliti… · office of auditing and...

Facilities Services Surplus Department

Audit Report# 17-04 January 4, 2017

The University of Texas at El Paso Institutional Audit Office

"Committed to Service, Independence and Quality"

0 THE UNIVERSITY of TEXAS SYSTEM

January 4, 2017

Dr. Diana Natalicio

President, The University of Texas at El Paso

Administration Building, Suite 500

El Paso, Texas 79968

Dear Dr. Natalicio:

UTEP Institutional Audit Office 500 West University Ave. El Paso, Texas 79968 915-747-5191

The Office of Auditing and Consulting Services has completed a limited scope audit of the Facilities Services Surplus Department Operations. During the audit, we identified opportunities for improvement and offered the corresponding recommendations in the audit report. The recommendations are intended to assist the department in strengthening controls and help ensure that the University's mission, goals and objectives are achieved.

We appreciate the cooperation and assistance provided by the Facilities Services Surplus Department during our audit.

Sincerely,

Lori Wertz

Chief Audit Executive

The University of Texas at Arlington · The University of Texas at Austin 'The University of Texas at Dallas· The University of Texas at Et Paso ·

The University of Texas of the Permian Basin · The University of Texas Rio Grande Valley 'The University of Texas at San Antonio· The University of Texas at

Tyler 'The University of Texas Southwestern Medical Center· The University of Texas Medical Branch at Galveston ·

The University of Texas Health Science Center at Houston · The University of Texas Health Science Center at San Antonio ·

The University of Texas MD Anderson Cancer Center · The University of Texas Health Science Center at Tyler ·

University of Texas al El Paso

Office of Auditing and Consulting Services

Audit Report #17-04 Facilities Services Surplus Department

Report Distribution:

University of Texas at El Paso:

Mr. Richard Adauto Ill , Executive Vice President

Mr. Gregory McNicol, Associate _VP Business Affairs, Facilities Services

Ms. Jenny Fraire, Director, Facilities Management, Business Operations

Mr. Gerard Cochrane Jr., Chief Information Security Officer

Ms. Sandra Vasquez, Assistant Vice President for Equal Opportunity (EO) and Compliance

University of Texas System (UT System):

System Aud it Office

External:

Governor's Office of Budget, Planning and Policy

Legislative Budget Board

Internal Audit Coordinator, State Auditor's Office Sunset Advisory Commission _

Audit Committee Members:

Mr. David Lindau

Mr. Fernando Ortega Mr. Steele Jones

Mr. Benjamin Gonzalez

Dr. Gary Edens

Dr. Stephen Riter

Dr. Roberto Osegueda

Auditors Assigned to the Audit:

Lorenzo Canales, Project Manager

Mirna Naylor, Auditor

University of Texas at El Paso



Table of Contents

EXECUTIVE SUMMARY ....................... .................. ... ............. .. .................. ........ ..... ....... 1

BACKGROUND .. .............. .. ............. ..... ... .. .......... ..... .......... ... ....... ......... ......... ...... ..... ...... 2

AUDIT OBJECTIVES ........ ... ........ .. ............ ... .. .... ..... .......... .... ... ... ....... .. .......... ..... ........... 2

SCOPE AND METHODOLOGY ...... ...... ............. ....... ......... ....... .... .......... ..... ....... ....... .... . 3

RANKING CRITERIA ..... ..... ............. ... ............... ..... ............. .. ..... ... ...... ........ ... .... ........... . 3

AUDIT RESULTS ......... .... .... ...... ... .. .. ....... ............ ... .. ..... ... ...... ..... .. ..... ......... ..... ...... ........ 4

A. LEVEL OF INTERNAL CONTROL. ...................................................................... .. .. 4

A.1 Policies and Procedures ...... .... .. ........... ... .. ................. ................... .. ....... ..... ..... .. 4

B. SURPLUS INVENTORY: ADMINISTRATIVE AND FISCAL OPERATIONS ........ .... 5

B.1 Lack of Periodic inventory Counts of Controlled Surplus Items .............. ......... ... 5

B.2 Removal of Confidential Data from Systems Transferred to Surplus ...... .. .. ........ 7

B.3 Post-Auction Inventory and Sales Reconciliation .. ... ....... ..... ... .... ...... ..... ............ 8

CONCLUSION ...... .......... ........... .. .. ... ... .. ... .. ...... ....... ....... .. -... .. .... .... ... ... ........... .. .. .. ....... ... 9

Universily of Texas at El Paso

Office of Aud1!ing and Consulting Services

.i\udil Report #17-04 Facilities Services Surplus Department

EXECUTIVE SUMMARY

The Office of Auditing and Consulting Services has completed a limited scope audit of the Facilities Services Surplus Department Operations at The University of Texas at El Paso. The audit scope was limited to selected fiscal and administrative activities for the period of September 1, 2015 through August 31, 2016. The objectives of this audit were to determine whether the Department is operating in a control-conscious environment, to verify that the audited areas are in compliance with University policies and procedures, and to identify opportunities for improvement.

During the audit we noted that the Surplus Department:

• does not have updated policies and procedures that document its day-to-day operations, identify key controls and provide easily understood guidelines required to carry out organizational operations,

• does not conduct periodic physical inventory counts of the surplus controlled items stored in the Surplus warehouse; therefore, if items go missing, losses might not be detected in a timely manner,

• does not have a documented process for the removal of sensitive and confidential information from surplus computers and other data processing systems, and

• does not perform post-auction reconciliations of revenues versus items sold at auction.




BACKGROUND

The Surplus Department (Surplus) collects, redistributes or disposes of unneeded property from departments on campus, and holds auctions when property is no longer useful to the University.

University departments transfer property to Facilities Services using the Surplus Property Transfer Form. Once the form is completed, the departments contact Surplus to arrange pick-up of the surplus property. After the property has been transferred, Facilities Services is responsible for safeguarding the property and maintaining an accurate inventory until the items are re-distributed, disposed of or sold at auction.

Currently, there are two UTEP Surplus warehouses. One is located within the University grounds, another is located outside of the University within the city limits.

AUDIT OBJECTIVES

The objectives of this audit were to determine:

• the level of internal control awareness, and

• if the University's controls and processes provide reasonable assurance that surplus property is properly safeguarded, utilized and/or disposed of in compliance with relevant laws and policies. Specific responsibilities include:

o warehouse inventory tracking,

o physical security of assets,

o disposal of surplus computers and other data processing equipment,

o appropriateness of auction contract terms, and

o post-auction reconciliation.

2


Office of Audit ing and Consulting Serv ices

Audit Report #17-04 Faci lities Services Surplus Department

SCOPE AND METHODOLOGY

The audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors .

Audit procedures included performing a risk assessment, reviewing departmental policies and procedures, interviewing personnel, assessing Surplus forms for completeness and compliance with University regulations, and conducting walk-throughs of the University's on-campus warehouse. In addition, we examined the sales receipts from an auction held in February 2016 and the corresponding post-auction settlement document. The scope of the audit is September 1, 2015 through August 31, 2016.

RANKING CRITERIA

All findings in this report are ranked based on an assessment of applicable qualitative, operational control and quantitative risk factors, as well as the probability of a negative outcome occurring if the risk is not adequately mitigated. The criteria for the rankings are as follows:

Priority - An issue identified by an internal audit that, if not addressed timely, could directly impact achievement of a strategic or important operational objective of a UT institution or the UT System as a whole.

High - A finding identified by internal audit that is considered to have a medium to high probability of adverse effects to the UT institution either as a whole or to a significant college/school/unit level.

Medium - A finding identified by internal audit that is considered to have a low to medium probability of adverse effects to the UT institution either as a whole or to a college/school/unit level.

Low - A finding identified by internal audit that is considered to have minimal probability of adverse effects to the UT institution either as a whole or to a college/school/unit level.

3




AUDIT RESULTS

A. LEVEL OF INTERNAL CONTROL

According to the Committee of Sponsoring Organizations of the Treadway Commission (COSO), internal control is "a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance."

A.1 Policies and Procedures

Policies and procedures are part of an organization's internal controls. They are the strategic link between the institution's vision and its day-to-day operations. They also help to identify key controls and to provide guidance for the processes required to carry out organizational operations.

According to Texas Government Code §2175.304(b):

"The governing board of each university system or institution or agency of higher education included within the definition of "state agency" under Section 2151.002 shall establish written procedures for the disposition of surplus or salvage property of the system, institution, or agency. The procedures shall allow for the direct transfer of materials or equipment that can be used for instructional purposes to a public school or school district, or an assistance organization designated by the school district, at a price or for other consideration to which the system, institution, or agency and the public school or school district or the assistance organization agree or for no consideration as the system, institution, or agency determines appropriate."

Although Surplus has developed business process maps as the basis to identify the processes and controls of the surplus operations, the office has not updated departmental written policies and procedures to ensure that surplus operations are conducted in an efficient and effective manner.

Recommendation: To ensure consistency and effectiveness of the surplus process, Facilities Services should develop formal (documented and approved) internal control procedures for Surplus operations that address the five basic types of control activities: (1) separation of duties, (2) system of authorizations, (3) physical safeguards, (4) independent checks and reconciliations, and (5) documentation.

4



Audit Report # 17-04 F ac1\ities Services Surplus Department

These policies and procedures should be accessible to all corresponding personnel and the UTEP community.

Level: This finding is considered Medium risk since inventory records are not updated in a timely manner and the safeguarding of surplus items might be impaired.

Management Response: The intent of the department was to update the policies and procedures once a "hard drive destruction process" for surplused computers was established. The department has been working with the Information Technology department to shift this responsibility to the office of Information Security. The decision to delay updating these policies and procedures was made to simplify the process and avoid confusing our customers. The Surplus Department does however, have updated internal process maps that are in place and are followed.

Responsible Party: Director of Business Operations for Facilities Management and Chief Information Security Officer

Implementation Date: May 1, 2017

B. SURPLUS INVENTORY: ADMINISTRATIVE AND FISCAL OPERATIONS

Accurate inventory records are required for internal financial management purposes, safeguarding assets, and the timely identification of lost, stolen or damaged items. Both an inventory system and surplus disposition process require an effective recording and monitoring system to ensure University assets are properly safeguarded. The current Surplus inventory system does not ensure all assets are properly accounted for on a timely basis.

8.1 Lack of Periodic inventory Counts of Controlled Surplus Items

According to the UTEP Handbook of Operating Procedures Section VII, Chapter 3.1 Standard of Care:

"Accountable administrative officers must take all necessary precautions to assure that property is used only for official business and that property is secured and maintained in a manner to prevent theft, loss, damage or misuse. Departments must know where all assets are located at all times; should have a method of locating any inventory item whether on-site or off-side under their control; and should be able to locate a given item upon request. "

5

University of Tex as at El Paso


Audit Report #17-04 Facilities Services Surplus Departmenl

Changes in surplus inventory are not communicated to the UTEP Inventory office in a timely manner: Surplus administration waits until after the items have been disposed of before communicating changes in inventory to the University financial offices. On some occasions, it takes months before items are removed from the warehouse; therefore, the records in the warehouse do not match the records in the UTEP Inventory Office.

Surplus does not conduct periodic physical inventory counts of the controlled items stored in the Surplus Warehouse, limiting the ability to properly safeguard and account for transfers-in, record the disposition of surplus inventory accurately, and to detect lost or stolen items in a timely manner.

For example, an instrument that was transferred to Surplus has been missing since Fiscal Year 2010. The purchase price of the instrument was $52,000. There are no records showing transfer, sale or current location of the instrument. Additionally, a police report for the missing item was not filed, which is in violation of University policy. According to the Handbook of Operating Procedures, Section VII: Financial Services, Chapter 3 University-Owned Property and Equipment: "Property that is missing or stolen property must be reported immediately to the University Police Department."

Recommendation: Management should establish a policy that includes guidelines for the safeguarding and proper monitoring of surplus inventory in storage. The guidelines should address the receiving, storage and removal of equipment to include specific rules for authorized access to storage facilities, and for the recording and tracking of controlled equipment inventory while in storage.

Surplus should:

• communicate to UTEP's Inventory office changes in the departmental inventory database in a timely manner,

• conduct periodic physical inventory counts and reconcile results with the departmental surplus inventory database, and

• confirm with the UTEP Inventory Department that the changes in surplus inventory have been entered in PeopleSoft in a timely manner.

Level: This finding is considered Medium risk because of the possibility that missing inventory items and other discrepancies would not be detected and investigated in a timely manner.

6




Management Response: Effective immediately the department will modify the operating procedures to include:

• Timely notification (within one week) to UTEP's Inventory Office regarding inventory changes

• Perform monthly cycle counts and reconciliations against the surplus inventory database

• Advise customers to confirm that the UTEP Inventory Department has made the necessary inventory changes.

Responsible Party: Director of Business Operations for Facilities Management, General Services Supervisor and Warehouse Coordinator

Implementation Date: February 1, 2017

B.2 Removal of Confidential Data from Systems Transferred to Surplus

According to Texas Government Code§ 2054.130. Removal of data from data Processing Equipment:

"(a) A state agency shall permanently remove data from data processing equipment before disposing of or otherwise transferring the equipment to a person who is not a state agency or other agent of the state.

(b) The department shall adopt rules to implement this section. The rules must include rules that:

• specify what types of data processing equipment are covered by this section, including computer hard drives and other memory components;

• explain the acceptable methods for removal of data; and

• adopt appropriate forms for use by state agencies in documenting the removal process, including forms for documenting completion of the process. "

Surplus does not have a systematic process in place to ensure proper removal or destruction of sensitive data from computer hard drives when processing computer surplus transfers. The lack of standardized procedures for the removal of confidential information could result in the exposure of restricted data to unauthorized parties.

Recommendation: Surplus, in collaboration with IT Security, should develop a consistent and effective process for the removal of confidential information from data processing systems that have been transferred to their department.

7

Un1vers1ty of Texas at El Paso



Level: This finding is considered High risk, due to the possibility that confidential data can be exposed to unauthorized third parties.

Management Response: The department has been working with the Office of Information Security to develop a process where they certify that all information has been removed from computer hard drives before computers are turned in to the Surplus Department.

Responsible Party: Director of Business Operations for Facilities Management and Chief Information Security Officer

Implementation Date: May 1, 2017

B.3 Post-Auction Inventory and Sales Reconciliation

The purpose of auction settlement reports is to document the reconciliation of auction sale proceeds. In addition, post-auction reconciliation reports that provide financial settlement information on auction revenues and inventory items not sold should be included in the reconciliation process.

A reconciliation was not performed for the February 2016 auction settlement documents provided by the auctioneer.

The following items were noted:

• The Auction Settlement document was not signed by any of the parties involved, • A reconciliation of items sold and revenues collected from the auction was not

performed, • One receipt listed four items sold at $280 each; however the total collected, per

books, was $260 instead of $1, 120. As the discrepancy was not detected in a timely manner, no explanation was requested from the auctioneer, resulting in a possible loss of $860.

• The total proceeds from sales and the auctioneer's fee amounts were not recalculated by Surplus. Minor differences were noted during the recalculation and review of the post-auction documentation.

Recommendation: A reconciliation should be performed after each auction to determine the accuracy of all funds received from sales. Also a reconciliation of inventory items sold versus items left after the closing of the auction should be completed.

8

University of Tex as at El Paso


Audit Report #17 -04 Facilities Services Surplus Department

Level: This finding is considered Medium risk due to the fact that errors and possible fraudulent activities may go undetected because of a lack of timely reconciliation of documents.

Management Response: Effective immediately, the department will modify the post auction operating procedures to include:

• Reconciliation of inventory items sold, against the surplus database

• Reconciliation of all monetary transactions against the "Settlement Documents" provided by the Auctioneer

Responsible Party: Director of Business Operations for Facilities Management

Implementation Date: February 1, 2017

CONCLUSION

Audit results show weaknesses in control processes which we believe can be strengthened by implementing the recommendations detailed in this report.

We wish to thank the Facilities Services personnel for their assistance and cooperation provided throughout the audit.

9