tax assessor-collector downtown branch …...the office sells registration stickers for passenger...

19
AUDITOR’S REPORT TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH AUTOMOBILE ON-SITE COLLECTION CONTROLS AS OF MAY 31, 2019 December 6, 2019 Michael Post, C.P.A., M.B.A. Harris County Auditor

Upload: others

Post on 23-Sep-2020

4 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

AUDITOR’S REPORT

TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH

AUTOMOBILE ON-SITE COLLECTION CONTROLSAS OF MAY 31, 2019

December 6, 2019

Michael Post, C.P.A., M.B.A.

Harris County Auditor

Page 2: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

Leslie Wilks Garcia, C.P.A., C.F.E. First Assistant County Auditor

Errika Perkins, C.P.A., C.I.A. Chief Assistant County Auditor Audit Division

1001 Preston, Suite 800 Houston, Texas 77002-1817

(832) 927-4600

Fax (713) 755-8932 Help Line (832) 927-4558

1

MICHAEL POST , C.P.A., M.B.A.

HARRIS COUNTY AUDITOR

December 6, 2019

Ms. Ann Harris Bennett

Tax Assessor-Collector & Voter Registrar

1001 Preston Street

Houston, Texas 77002

RE: Tax Assessor-Collector Downtown Branch Automobile On-site Collection Controls

Engagement as of May 31, 2019

The Audit Services Department performed procedures relative to the Harris County Tax

Assessor-Collector Downtown Branch automobile onsite collections. The objective of the

engagement was to evaluate whether internal controls relative to the Office’s on-site collection

processes were adequately designed and operating effectively. Our procedures included the

following:

1) Documented internal controls and procedures related to the collection and deposit of

funds received.

2) Performed observations to determine whether collections received were properly

safeguarded and whether the collections facility was physically secure.

3) Selectively tested collections for compliance with County Accounting Procedure A.1,

Cash Handling Guidelines.

4) Selectively tested to determine whether collections received reconciled to sales

transactions recorded in the Registration and Title System (RTS) application.

5) Selectively tested to determine whether collections received were accurately and timely

deposited in the County Depository.

6) Selectively tested to determine whether the security of assigned user access rights in the

RTS application was adequate and appropriate.

7) Selectively tested to determine whether inventory (license plates, placards, etc.) on hand

agreed to the inventory population recorded in the RTS application.

The work performed required our staff to exercise professional judgment in completing the scope

procedures. As the procedures were not a detailed inspection of all transactions, there is a risk

that fraud, errors, or omissions were not detected during this engagement. The official therefore,

retains the responsibility for the accuracy and completeness of their financial records, and for

ensuring sufficient controls are in place to detect and prevent fraud, errors, or omissions.

The enclosed Auditor’s Report presents the issues identified during our procedures, our

recommendations, and any actions you will take to address the issues.

Page 3: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

Ann Harris Bennett

Tax Assessor-Collector & Voter Registrar

2

We appreciate the time and attention provided by you and your staff during this engagement.

Sincerely,

Michael Post

County Auditor

cc: District Judges

County Judge Lina Hidalgo

Commissioners:

R. Jack Cagle

Rodney Ellis

Adrian Garcia

Steve Radack

Kim Ogg

Vince Ryan

William J. Jackson

Page 4: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

3

TABLE OF CONTENTS

OVERVIEW ...................................................................................................................................4

SUMMARY OF RESULTS ..........................................................................................................5

ISSUES & RECOMMENDATIONS............................................................................................6

Non-Compliance with County Policy .......................................................................................8

Controls for Non-Routine Payments Need Improvement ....................................................11

Controls of System Access Administration Need Improvement ..........................................13

Collections Area Badge Access Controls Need Improvement ..............................................16

Collections Documentation Requires Improvement .............................................................18

Physical Safeguards of Collections Need Improvement .........................................................6

Page 5: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

4

OVERVIEW

The Harris County Tax Assessor-Collector’s Office (Tax Office) is responsible for the levy and

collection of property taxes, the issuance of vehicle registrations and license plates, the issuance

of certain permits and collection of special taxes, as well as voter registration. The Tax Office

conducts business at 16 locations throughout Harris County and at approximately 200 vehicle-

license renewal satellite locations and via mail or online.

The Vehicular Division of the Tax Office is responsible for the issuance of the following: 1)

Vehicle registrations and renewals, 2) License plates, 3) Vehicle titles and transfers and, 4)

Disabled placards. The Office sells registration stickers for passenger cars, motor cycles and

small trucks (pickups, vans, and sport utility vehicles). Employees record transactions in an

online database which is administered by the Texas Department of Motor Vehicles. This

database, RTS, is utilized by the Tax Office to track funds received and consumed inventory.

Reports are generated from RTS on a daily basis and are utilized for a daily reconciliation. Once

the balances have been reconciled, a deposit is prepared and retrieved by an armored courier.

Each year, the Tax Office performs approximately 3.7 million vehicle registrations and 1.1

million vehicle title transfers in Harris County. Harris County has approximately 2,800

automobile dealers, which includes 395 franchise dealers. The Tax Office coordinates its efforts

with the Texas Department of Motor Vehicles, the Houston Automobile Dealers Association, the

Houston Independent Automobile Dealers Association and the Texas Independent Automobile

Dealers Association.

Page 6: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

5

SUMMARY OF RESULTS

Based on the procedures performed, the Office’s internal controls relative to the collections

process need to be strengthened. Specifically, the following opportunities for improvement were

noted:

Physical Safeguards of Collections Need Improvement

1. The Office does not have adequate physical safeguards for cash and negotiable

instruments. The following issues were observed: 1) The combination to the vault has

not been changed since current Office Management began working in the office; 2) The

daily bank cash deposit is not secured; 3) A glass security door, which is located behind

the vault door, secures the vault during office hours; however, the key to the glass door

is not removed during office hours.

Non-Compliance with County Policy

2. The Office is not in compliance with some requirements of the County’s Accounting

Procedures related to cash and negotiable instruments. The following issues were noted:

1) Suspected counterfeit currency is not segregated from other currency prior to deposit;

2) Tax Office personnel are permitted to exchange personal currency for collections

received by the Office; 3) Change fund bags are not subject to dual verification at the

beginning of each teller’s shift; 4) Checks received by the Office are not restrictively

endorsed; and 5) The Office has not posted signage advising customers to obtain a

receipt with an accompanying example of a receipt.

Controls for Non-Routine Payments Need Improvement

3. The Office does not have sufficient controls in place to ensure that the receipt of non-

routine payments (i.e. mechanic liens, returned check payments) are tracked, securely

stored, and properly transferred.

Controls of System Access Administration Need Improvement

4. The Office is not in compliance with some requirements of the Harris County Access

Control Policy. The following issues were observed: 1) The Office does not have written

procedures which provide guidelines for the request and approval of new RTS users, or

the modification of existing users; 2) Forty-two user IDs for former employees were not

removed from the RTS application; 3) Ten RTS application users had multiple user IDs.

Collections Area Badge Access Controls Need Improvement

5. The Office has not removed the badge access to the collections area for 23 terminated

and/or transferred employees.

Collections Documentation Requires Improvement

6. Daily Cashier Cash Drawer Summary forms are not fully and accurately completed on

consistent basis.

These opportunities for improvement are discussed in more detail in the following Issues and

Recommendations section of this report.

Page 7: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

6

Physical Safeguards of Collections Need Improvement

Background County Accounting Procedure A.1, Cash Handling Guidelines, prescribes guidelines for

securing cash and cash equivalents. Pursuant to Accounting Procedure A.1, these guidelines

apply to and should be considered as the minimal requirements for establishing adequate internal

controls for processing cash and cash equivalent transactions and safeguarding County funds.

Pursuant to County Accounting Procedure A.1, Cash Handling Guidelines, petty cash funds,

change funds, bank account check stock and checkbooks, blank receipts, collections, etc., are to

be safeguarded at all times and secured in a safe or other locked storage place when not in use, as

well as when left in the closed office overnight. Access to the safe combination and/or keys

should be limited to as few staff members as possible.

Pursuant to County Accounting Procedure A.1, Cash Handling Guidelines, adequate physical

security should be provided for people handling cash such as closed cages, locked doors, etc.

Issue The Office does not have adequate physical safeguards for cash and negotiable instruments. The

following issues were observed:

1. The combination to the vault utilized by the Office has not been changed since current

Tax Office Management began working in the office. A failure to change the vault

combination could permit unauthorized access to the vault.

2. The daily bank cash deposit is not secured. The sealed daily bank cash deposit is stored

in a wall safe with a combination lock within the vault. However, the wall safe is not

locked, as the combination was lost. In addition, it was determined that although access

to the vault is procedurally restricted to authorized employees only, the vault door is left

open during business hours. This could potentially allow any County employee or

contractor, with access to the collections area, to enter the vault.

3. A glass security door, which can be opened with a single key, is located behind the vault

door. This glass door secures the vault during office hours, however, the key to the glass

door is not removed during office hours. Maintaining the key in the lock could lead to

unauthorized access.

Not having adequate physical safeguards for cash and negotiable instruments could result in

misappropriated funds and financial loss to the County.

Page 8: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

7

Physical Safeguards of Collections Need Improvement (Continued)

Recommendations Office Management should take steps to ensure that cash and negotiable instruments are

appropriately safeguarded at all times by taking the following actions:

1. Tax Office Management should retain the services of a qualified locksmith and request

that the combination to the vault door lock be changed. Going forward, consideration

should be given to changing the combination to the vault upon personnel changes, the

passage of time, or whenever deemed necessary by Tax Office Management.

2. Office Management should ensure that the daily bank cash deposit is secured subsequent

to preparation for pickup by the contracted armored carrier. This could be accomplished

by having a locksmith provide the combination to one or more of the wall safes located

within the vault, thereby providing a secure storage space. Alternatively, a drop safe

could be purchased and maintained within the vault.

3. The key to the vault glass door should be properly safeguarded and retained by a member

of Tax Office Management.

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to ensure that

cash and negotiable instruments are appropriately safeguarded. A qualified locksmith has

provided a new combination number for the vault door as well as the wall safes. Daily bank cash

deposits are secured in the wall safes subsequent to preparation for pickup by the contracted

armored carrier. In addition, our branch procedures manual has been updated to ensure that the

vault door combination will be changed as a result of any personnel changes. Furthermore, the

key for the vault glass door will not remain in the door; it is now properly safeguarded and

retained by a member of Tax Office Management.

Responsible Party Director of Automobile Services, Branch Locations

Agreed Upon Completion Date

Completed August 26, 2019

Page 9: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

8

Non-Compliance with County Policy

Background Pursuant to County Accounting Procedure C.1-2, Tax Office Counterfeit Currency, if the Tax

Office suspects that they have received counterfeit currency at the point of sale, they should

contact the United States Secret Service. If the Tax Office suspects that they have received

counterfeit currency after a receipt has been issued, the Tax Office should contact the United

States Secret Service or “remit the suspected counterfeit currency to the bank for further

investigation, and submit the currency to the bank in an envelope marked ‘Possible Counterfeit

Currency’ with normal daily collections.

Pursuant to County Accounting Procedure A.1, Cash Handling Guidelines, if County collections

by employees/officials, including funds collected by law enforcement personnel, such as from

confiscation, seizure, or similar, are suspected to include coins or bills of value greater than face

value, employees/officials may not make a personal exchange for the coins or bills.

As a best practice, change fund balances should be subject to dual verification when change fund

bags are unlocked prior to the beginning of a shift. Specifically, currency should be counted by

the custodian of the change fund in the presence of a member of Office Management.

Pursuant to County Accounting Procedure A.1, Cash Handling Guidelines, all checks and

money orders should be stamped “For Deposit Only” with the appropriate organization name,

organization number, and location number immediately upon receipt.

Pursuant to County Accounting Procedure A.1, Cash Handling Guidelines, a sign should be

posted advising the payee to obtain a receipt for payment. A sample receipt should also be

posted to indicate to the individual what he/she should expect to receive.

Issue The Office is not in compliance with some requirements of the County’s Accounting Procedures

related to cash and negotiable instruments. The following issues were noted:

1. Per discussions with Management, suspected counterfeit currency is not segregated from

other currency prior to deposit with the County’s financial institution. A failure

segregate suspected counterfeit currency results in noncompliance with County policy.

2. Per discussions with Management, Office personnel are permitted to exchange their

same-denomination personal currency for collections received by the Office that have a

collectible value. Permitting employees to exchange currency could provide

opportunities for the misappropriation of funds.

Page 10: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

9

Non-Compliance with County Policy (Continued)

3. Change fund bags maintained in the vault overnight are distributed to clerks, opened and

counted without a member of the Tax Office Management being present. The absence of

dual verification of the change fund balance results in a lack of accountability for the

funds and could result in misappropriation.

4. Although checks and other negotiable instruments received by the Office are deposited

electronically on the day of receipt, they are not restrictively endorsed “For Deposit

Only” with the appropriate organization name, organization number and location

number. A failure to restrictively endorse negotiable instruments could result in the

misappropriation of funds and financial loss.

5. The Office has not posted a sign advising the customer to obtain a receipt for sales

transactions, nor has the Office posted an example of the receipt. A failure to post

required notifications could result in the misappropriation of funds and financial loss.

Recommendations Office Management should adhere to the County’s Accounting Procedures related to cash and

negotiable instrument transactions by taking the following actions, respectively:

1. Suspected counterfeit currency should be segregated from all other currency ready for

deposit and placed in an envelope denoting that the contents are suspected counterfeit

currency. The envelope should be included with the regular daily deposit to the

County’s financial institution.

2. Office personnel should not exchange personal currency for collectible currency received

by the Office.

3. Office Management should consider implementing procedures for the dual verification

of change fund balances at the beginning of each clerk’s shift. Prior to the beginning of

a shift, each clerk should open their change fund bag and count the currency in the

presence of a member of Office Management. Any discrepancies should be resolved and

documented.

4. The Office should coordinate with the County Auditor’s Office Systems & Procedures

Department as well as the Budget Management Department to determine a process

whereby checks and negotiable instruments can be scanned (electronically deposited)

and secured from further negotiation. Research should be performed to determine

whether the checks should be restrictively endorsed, or whether the checks can be

secured through a different action. In addition, County Accounting Procedure A.1, Cash

Handling Guidelines, should be updated to reflect any changes to the current process.

Page 11: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

10

Non-Compliance with County Policy (Continued)

5. The Office should post a sign in the reception area where collections are taken. The sign

should advise the payee to obtain a receipt for funds delivered to the Office. In addition,

an example of the receipt provided to the payee should also be posted next to the sign.

Posting required signage enhances the control environment and mitigates the risk of

misappropriation of funds and financial loss to the County.

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to adhere to

the County’s Accounting Procedures related to cash and negotiable instrument transactions. As

of August 26, 2019, our branch procedures manual has been updated to require the segregation

of counterfeit currency and to prevent the exchange of personal currency for collected currency

received by the office. In addition, signs are in the process of being posted advising the customer

to obtain a receipt for the transaction that was conducted. Furthermore, our Office is

coordinating with the Budget Management Department and the County depository to determine

if the negotiable instruments can be scanned with a restrictive endorsement. We will report the

results of our research to the County Auditor’s Office upon completion.

As the office’s current procedures require dual verification of change fund balances at the end of

each clerk’s shift, we will not be implementing procedures which require the dual verification of

change fund balances at the beginning of each clerk’s shift. No one at the branch, even the

management team, has a key to the clerks change fund bag. The extra keys are retained by the

Auto Branch Services Director. As such, due to time constraints and the aforementioned

mitigating controls, this recommendation will not be implemented.

Responsible Party Director of Automobile Services, Branch Locations

Agreed Upon Completion Date

Completed August 26, 2019

Page 12: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

11

Controls for Non-Routine Payments Need Improvement

Background The Tax Office receives payment for services, which are non-routine in nature, and cannot be

input into the RTS system. These payment types can be categorized into the following:

1. Mechanic Liens and Title Services – Mechanic liens are lien holds on a vehicle,

primarily incurred by a mechanic who has serviced an automobile for which the

automobile owner has refused to make payment for the services, or has abandoned the

automobile. Title Services are issued to a business, which permits the business to

perform title services on behalf of a third party. These payments must be made with cash

or a check, and are recorded in the Tax Office Business Intelligence Environment

(TOBIE) system. These payments are stored in an unlocked wall safe in the vault, prior

to being transferred to the Office’s Property Tax group for deposit.

2. Cash Payments for Returned Checks: When checks provided by customers to the Tax

Office are not honored by the issuing bank, they are returned to the County’s financial

institution as an unpaid check. Tax Office internal policy specifies that customers who

pay for services with an unpaid check can only remit a cash payment for the original

transaction at the downtown Tax Office branch. Automotive collections personnel

receive these cash payments and record the receipt in the TOBIE system. The cash is

then stored in an unlocked wall safe in the vault. Periodically, Tax Office Accounting

personnel will retrieve the cash from the vault and deposit the funds.

County Accounting Procedure A.1, Cash Handling Guidelines, prescribes guidelines for

securing cash and cash equivalents. Pursuant to Accounting Procedure A.1, these guidelines

apply to and should be considered as the minimal requirements for establishing adequate internal

controls for processing cash and cash equivalent transactions and safeguarding County funds. In

addition, petty cash funds, change funds, bank account check stock and checkbooks, blank

receipts, collections, etc., left in the office overnight should be secured in a safe or other locked

storage place when the office is closed. Access to the safe combination and/or keys should be

limited to as few staff members as possible.

Issue The Office does not have sufficient controls in place to ensure that the receipt of non-routine

payments are tracked, securely stored, and properly transferred. Specifically, funds received are

stored in an unlocked wall safe within the vault, and they are transferred to other Departments

within the Office without formal chain of custody documentation, such as signature

acknowledgement from both parties and a transaction report or log. A failure to adequately

secure and track funds received could result in misappropriation and financial loss to the

County.

Page 13: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

12

Controls for Non-Routine Payments Need Improvement (Continued)

Recommendation Office Management should improve the controls surrounding the tracking, storage, and transfer

of non-routine payments. Upon the completion of the non-routine transactions, payments

received should be secured with the vault. When these funds are retrieved by an employee from

another Division within the Tax Office, the employee retrieving the funds should perform a dual

count of the funds with a member of Office Management. Both parties should sign and date a

transfer of custody document which should be a system generated report or manual log of the

receipts which captures the transferred amounts and transaction details. Lastly, this process

should be formally documented within the Tax Office operations manual.

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to ensure that

the receipt of non-routine payments are tracked, securely stored, and properly transferred. As of

August 26, 2019, a transfer of custody document is completed and signed by both parties after

funds are balanced. In addition, the deposit is securely stored inside the wall safe, and the Tax

Office operations manual has been updated to reflect the changes.

Responsible Party Director of Automobile Services, Branch Locations

Agreed Upon Completion Date

Completed August 26, 2019

Page 14: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

13

Controls of System Access Administration Need Improvement

Background The Harris County Universal Services Department created the Harris County Access Control

Policy, which provides guidance regarding information security for systems utilized within

Harris County. Per Universal Services, “the Access Control Policy defines the identification,

authentication, authorization and other relevant user access safeguards that are designed to

protect users, systems and data. Pertinent sections of the policy are as follows:

Pursuant to Harris County Access Control Policy:

Section A.1, Unique User Identification, “Each individual must have a unique ID. Each

computer and communication system user ID must be unique and connected solely with

and used only by the user to whom it has been assigned.”

Section C.1.2, Access Requests, “the process for requesting, provisioning and approving

access to each system and application on the Harris County network must be

documented.”

Section C.1.3, Access Requests Audit Trail, “every access request process must include

an audit trail mechanism to track and report (1) who was granted access, (2) who granted

the access, (3) who approved the access, and (4) to which system(s) and/or application(s)

was the access allowed. The department requesting access and the department

provisioning access must be able to produce this evidence.”

Section C.1.4, Granting Access, “system administrators and other personnel must not

grant access outside of the access request processes.”

Section C.1.9, User Termination, “All user access privileges to Harris County systems

and applications must be disabled immediately or, in any event, no later than 24 hours

after an employee or non-employee termination.”

Section C.1.12, Inactive Accounts, “System administrators must review and disable all

inactive user accounts on the systems and applications that they manage at least every 90

days.

Issue The Office is not in compliance with some requirements of the Harris County Access Control

Policy. The following issues were observed:

Page 15: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

14

Controls of System Access Administration Need Improvement (Continued)

1. The Office does not have written procedures which provide guidelines for the request

and approval of new RTS users, or the modification of existing users. In addition, the

Office does not have a system in place to historically track who was granted access and

who approved the access.

2. The Office does not have a process in place to ensure that user access privileges are

disabled immediately or no later than 24 hours after an employee’s or contractor’s

termination. Specifically, 42 user IDs for former employees were not removed from the

RTS application. Due to RTS system limitations, it could not be determined whether the

former employees accessed their account subsequent to their employment with Harris

County.

3. The Office does not have a process in place to ensure that RTS users do not have

multiple user IDs. Specifically, during a review of 69 RTS Users, it was noted that 10

(14%) users had multiple IDs, which is prohibited by County policy. Due to RTS system

limitations, it could not be determined whether RTS users with multiple user IDs

performed unauthorized transactions.

A failure to adhere to the Access Control Policy can result in the misappropriation of County

assets, financial misstatement, and the inability to identify individuals who performed and/or

authorized transactions in the RTS system.

Recommendation Tax Office Management should deactivate the RTS user IDs associated with former employees

and contractors, and should deactivate multiple user IDs.

Tax Office Management should develop and maintain procedures which provide guidelines for

the addition of new RTS users, modification of user rights and privileges and the deactivation of

user IDs. A form should be created which documents the establishment, modification and

deactivation of user IDs. In addition, an activity log should be created and maintained which

details the history of RTS user creation, modification and deletion. The Office should ensure

that user IDs are deactivated immediately or within 24 hours of an employee or contractor

termination, and should ensure that multiple user IDs are not being utilized.

Lastly, Tax Office Management should periodically review Office procedures related to the RTS

application to ensure they comply with all relevant aspects of the Harris County Access Control

Policy.

Page 16: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

15

Controls of System Access Administration Need Improvement (Continued)

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to adhere to

the County’s Access Control Policy. As of July 31, 2019, all former employee user IDs and

duplicate user IDs have been removed from RTS. Duplicate RTS employee ID’s existed for the

same employees due to a clerical error during a training class. In addition, an exit checklist will

be used to ensure that employees who are no longer employed by the Office are deactivated in

RTS. When a user is added to RTS or deleted this information will be captured in a log as well.

The Tax Office operations manual has been updated to reflect these changes. Furthermore, area

managers will check every 3 months to ensure the branches are in compliance with the Harris

County Access Control Policy.

Responsible Party Director of Automobile Services, Branch Locations

Agreed Upon Completion Date

Completed July 31, 2019

Page 17: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

16

Collections Area Badge Access Controls Need Improvement

Background The Universal Services Department initiates, changes, and deactivates facility badge access for

all Harris County Departments. County Department Heads or authorized personnel complete and

sign Universal Services’ Access Card Request Form when an employee or contractor requires

access or their access needs change. County Department Heads or authorized personnel

complete and sign Universal Services’ Deactivation Authorization form when an employee or

contractor is no longer employed by the County or if a badge is lost. Completed forms are

submitted to Universal Services for review prior to processing.

Each County department is responsible for ensuring that only appropriate individuals are granted

badge access to facilities necessary to perform their job function. In addition, departments are

responsible for requesting the removal of badge access when an individual no longer requires

access to a County facility.

The Office uses an Employee Exit Check List form when an employee is terminated or

transferred to another department. This checklist includes a requirement that the employee’s

badge access to the Tax Office be deactivated.

Issue The Office uses an Employee Exit Check List form, requiring badge access deactivation, for all

terminated and transferred employees. However, the Office does not perform a periodic review

of all employees with badge access to ensure former employees and employees not requiring

access have been deactivated. As such, it was noted that 23 of the 116 (20%) individuals who

have badge access to the collections are terminated and/or transferred employees that have not

been removed.

A failure to remove badge access of terminated and/or transferred employees could result in the

misappropriation of County assets.

Recommendation Office Management should ensure terminated and/or transferred employees do not have access

to the collections area by taking the following steps:

1. Office Management should contact Universal Services and request that the badge access

for the 23 identified terminated/transferred employees be deactivated.

2. Office Management should ensure that an Employee Exit Check List is completed for all

terminated/transferred employees.

Page 18: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

17

Collections Area Badge Access Controls Need Improvement (Continued)

3. Office Management should perform a quarterly review of all employees with badge

access to ensure former employees and employees not requiring access have been

deactivated.

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to ensure

former employees and employees not requiring badge access have been deactivated. As of

August 1, 2019, the access for all employees that no longer work in the automobile/customer

service area has been removed. In addition, an Employee Exit Check List, which includes the

removal of badge access, will be completed for all terminated/transferred employees.

Furthermore, HR will complete a quarterly review to ensure former employees have been

deactivated.

Responsible Party Chief Deputy

Agreed Upon Completion Date

Completed August 1, 2019

Page 19: TAX ASSESSOR-COLLECTOR DOWNTOWN BRANCH …...The Office sells registration stickers for passenger cars, motor cycles and small trucks (pickups, vans, and sport utility vehicles). Employees

ISSUES AND RECOMMENDATIONS

18

Collections Documentation Requires Improvement

Background Pursuant to Harris County Tax Assessor-Collector’s Office Branch Management (Automobile

Services) Procedures, a Daily Cashier Cash Drawer Summary form (RTS-022) should be fully

and accurately completed at the close of each teller’s shift. In addition, the form should be

signed by the window teller and the balancer.

Issue Daily Cashier Cash Drawer Summary forms are not fully and accurately completed on a

consistent basis. It was noted that 48 of 121 (40%) Cash Drawer Summary forms were not

thoroughly and/or accurately completed. Specifically, it was noted that 13 packets were not

signed by a member of Management; 30 did not total; 2 contained overages or shortages in an

inappropriate section of the form and 3 did not reconcile to the supporting documentation.

Inaccurate and/or incomplete documentation on the Daily Cashier Cash Drawer Summary form

could result in errors, financial misstatement and financial loss to the County.

Recommendation Office Management should ensure that employees complete the Daily Cash Drawer Summary

form in accordance with Harris County Tax Assessor procedures. The requirement that form

RTS-022 be accurately and thoroughly completed and signed by the preparer and management,

should be communicated to employees using the form. Going forward, a periodic review of

these forms should be performed to verify compliance with required procedures.

Management Action Plan We agree with the Auditor’s comments and the following actions have been taken to ensure

Daily Cashier Cash Drawer Summary forms are fully and accurately completed on a consistent

basis. As of August 26, 2019, the requirement to accurately and thoroughly complete the Daily

Cashier Cash Drawer Summary form was enforced. This includes the requirement that the

forms be signed by the preparer and a member of management. Going forward, Area Managers

will periodically review a sample of RTS-022 forms while conducing branch visits to ensure all

branches are in compliance.

Responsible Party Director of Automobile Services, Branch Locations

Agreed Upon Completion Date

Completed August 26, 2019