Management Take Note
By Buck Fuller
This is a two-part article because audits can be complicated. And the results of this year’s audit deserve a deeper dive. There is good discussion to be had because the City finally hired a new auditor. The Portsmouth residents had a new set of eyes looking at the City’s finances.
Part I will look at the auditor’s “clean” opinion. Part II will look at the Management Letter.
While a clean auditor’s opinion may seem opaque and arcane, the Management Letter is much more down-to-earth and filled with practical issues.
The Difficult World of Auditing
Appreciate that auditors are in a potentially compromised position. If they are too hard on a client and find problems throughout the business, they will gain a reputation as being unreasonably rigorous. They might not get future jobs and the current job could be terminated. But if they are too forgiving and easy-going, or if they are too cozy with the client, the public may complain that the auditor is not doing its job. Worse, if the auditor sees problems but says nothing, the client’s culture may deteriorate further, and fraud and accounting errors may become prevalent.
Now let us turn to the Management Letter.
Management Letter: An Important Signal to the Taxpayer
This is where things get more interesting.
An auditor uses what is called a “management letter” to convey to management (City Manager, City Council, Audit Committee) areas the auditor has found in its financial audit that were of concern to the auditor.
The management letter becomes a useful way to highlight issues that might not rise to the level of issuing a qualified opinion. But the auditor knows corrective action is needed.
It’s almost as if CLA wanted to say that “clean” is not quite “all-clear.” We read between the lines and find points of concern. Take a look at what CLA says.
Two Areas of Concern
CLA found two major areas worthy of highlight. A third area was addressed just for informational purposes. The first area was in Accounts Payable. The second was in Information Technology (IT).
Accounts Payable: Who’s Guarding the Hen House?
Accounts Payable is a critical bastion against fraud. It is where checks are issued, vendor invoices are paid and where fraudulent claims for payment are stopped. In other words, Accounts Payable must exert a tight control on how the taxpayers’ money is spent.
CLA’s Management Letter raised concerns about Accounts Payable. “Some individuals within the Finance Department had the ability to create new vendors, enter invoices, prepare cash disbursement files, and process cash disbursements. In best practice, some of these responsibilities should be performed by different individuals.”
This Is Scary!
“Some individuals” could issue cash payments without anyone else knowing what was being done.
In other words, CLA wanted additional staff involved in these activities in order to create checks and balances to prevent one person from issuing payments without someone else signing off on the disbursement.
The City says these responsibilities are done primarily by a part-time person due to “limited resources.” This is not reassuring!
This is the old saw of being penny-wise and pound foolish! The City was now been warned publicly. CLA will want to check this during next year’s audit to make sure the situation has been rectified.
Information Technology: Loosie Goosy Internal Controls
One of the reasons the Audit Committee and the City wanted to hire CLA was due to its expertise and experience in auditing information technology operations in municipalities.
The Audit Committee was aware that IT was growing rapidly due to rapidly increasing budget commitments. It can be difficult to manage rapid growth and CLA found plenty of evidence of this difficulty when it looked at the City’s IT operation.
Five Significant Areas of Little Adequate Controls
There were five major areas cited by CLA that needed immediate attention:
- The key IT policies and procedures which guide the management of the IT area had yet to be formalized, adopted and implemented. This is like a boat not yet having a secure rudder for steering even though the boat has been launched.
- There’s no periodic review of users’ rights over the City’s networks and applications. That means that access to the City’s IT is open, available and not controlled.
- Fourteen terminated employees are still listed as active users on the IT system.
- The City’s ticketing system for tracking IT services is not being fully utilized. This means there is no tracking for managing changes to the IT services. This results in inadequate authorization, testing, documentation and monitoring of changes required for the IT system.
- New user access is not adequately controlled for consistency or documentation prior to access being granted. That means that being able to gain entry into the IT system is not supervised or controlled.
“We’re Working on This”
The City says it is working to address these issues. Some of the simpler issues, such as the 14 terminated employees, have been fixed. But other, more demanding issues remain outstanding.
The City’s response included little in terms of specifics for what it will do, how it will do it and, importantly, when these corrective actions will be taken.
IT receives huge budget allocations that require these basic issues to be addressed. There’s a lot of taxpayer money at stake.
Next Year
These Management Letter issues are very worrisome. They represent significant shortfalls in how the City is managed. CLA will have its hands full when it returns for the fiscal year 2024 audit. It will need to make sure these matters are fully resolved before it can move on to other pressing issues, such as the City’s management of bond proceeds or shifting of cash between departments or between CIP projects or requiring “percentage of completion” accounting for City construction jobs …
You get the picture.
Thank goodness CLA is on the scene! Thank goodness Melanson is gone.
Buck Fuller is one of the Pulse’s staff writers. He is a close observer of the Portsmouth scene and is knowledgeable about an array of issues, including financial matters. His local email address is: buck@portsmouthpulse.com.
