audit committee agenda

Audit Committee Agenda

Friday, October 22, 2021 12:30 p.m.

**Teleconference Meeting**

MEETING ANNOUNCEMENT AMIDST COVID-19 PANDEMIC:

The Audit Committee meeting scheduled for Friday, October 22, 2021, will be conducted virtually in accordance with Governor Newsom’s State of Emergency declaration regarding the COVID-19 outbreak, Government Code Section 54953(e), Assembly Bill 361 (Rivas 2021), and the Guidance for Gatherings issued by the California Department of Public Health. Committee members will primarily participate in the meeting virtually, while practicing social distancing, from individual remote locations.

To participate via Zoom webinar, click the link to join the meeting: https://zoom.us/j/95987074762 Webinar ID: 959 8707 4762

To participate via Telephone, dial a number based on your current location in the US:

+1 (669) 900-6833

+1 (253) 215-8782

+1 (346) 248-7799

+1 (929) 205-6099

+1 (301) 715-8592

+1 (312) 626-6799

International numbers available: https://zoom.us/u/adOHU881Nv

SANDAG relies on commercial technology to broadcast the meeting via Zoom. With the increase of virtual meetings, platforms such as Microsoft Teams, WebEx, GoToMeeting, and Zoom are working to scale their systems to meet the new demand. If we experience technical difficulty or you are unexpectedly disconnected from the broadcast, please close and reopen your browser and click the link to rejoin the meeting. SANDAG staff will take all possible measures to ensure a publicly accessible experience.

Public Comments: Persons who wish to address the members on an item to be considered at this meeting, or on non-agendized issues, may email comments to the Clerk at [email protected] (please reference “Friday, October 22, 2021, Audit Committee Meeting,” in your subject line and identify the item number(s) to which your comments pertain). Comments received by 4 p.m. on Thursday, October 21, will be provided to members prior to the meeting. If you desire to provide live verbal comment during the meeting, please join the Zoom meeting by computer or phone and use the “Raise Hand” function to request to provide public comment. On a computer, the “Raise Hand” feature is on the Zoom toolbar. By phone, enter *9 to “Raise Hand” and *6 to unmute. Requests to provide live public comment must be made at the beginning of the relevant item, and no later than the end of any staff presentation on the item. The Clerk will call on members of the public who have timely requested to provide comment by name for those joining via a computer and by the last three digits of for those joining via telephone. All comments received prior to the close of the meeting will be made part of the meeting record. Please note that any available chat feature on the Zoom meeting platform should be used by panelists and attendees solely for procedural or other “housekeeping” matters as comments provided via the chat feature will not be retained as part of the meeting record. All comments to be provided for the record must be made via email or orally per the instructions above.

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fzoom.us%2Fj%2F95987074762&data=04%7C01%7CLinda.Cimmino%40sandag.org%7C438ddc1a9cf74dd8190508d97250a4ae%7C2bbb5689d9d5406b8d02cf1002b473e7%7C0%7C0%7C637666512971957059%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=p8csJfuVyeVWogTojkLox8Dz7TJHQYgg%2BUIdWb7LI8E%3D&reserved=0

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fzoom.us%2Fu%2FadOHU881Nv&data=04%7C01%7CLinda.Cimmino%40sandag.org%7C438ddc1a9cf74dd8190508d97250a4ae%7C2bbb5689d9d5406b8d02cf1002b473e7%7C0%7C0%7C637666512971967013%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=53e%2BC%2Bezv2o5x6cr3OkebC8c1TkFE8SQPUDculcuiBw%3D&reserved=0

mailto:[email protected]

In order to keep the public informed in an efficient manner and facilitate public participation, SANDAG also provides access to all agenda and meeting materials online at sandag.org/meetings. Additionally, interested persons can sign up for email notifications at sandag.org/subscribe.

SANDAG operates its programs without regard to race, color, and national origin in compliance with Title VI of the Civil Rights Act. SANDAG has developed procedures for investigating and tracking Title VI complaints, and the procedures for filing a complaint are available to the public upon request. Questions concerning SANDAG nondiscrimination obligations or complaint procedures should be directed to the SANDAG General Counsel, John Kirk, at (619) 699-1997 or [email protected]. Any person who believes himself or herself or any specific class of persons to be subjected to discrimination prohibited by Title VI also may file a written complaint with the Federal Transit Administration.

In compliance with the Americans with Disabilities Act (ADA), SANDAG will accommodate persons who require assistance in order to participate in SANDAG meetings. If such assistance is required, please contact the Clerk of the Board at [email protected] or at (619) 699-1985, at least 72 hours in advance of the meeting. To request this document or related reports in an alternative format, please call (619) 699-1900 or (619) 699-1904 (TTY), or fax (619) 699-1905 at least 72 hours in advance of the meeting.

SANDAG agenda materials can be made available in alternative languages. To make a request, call (619) 699-1900 in advance of the meeting.

Los materiales de la agenda de SANDAG están disponibles en otros idiomas. Para hacer una solicitud, llame al (619) 699-1900.

如有需要, 我们可以把SANDAG议程材料翻译成其他語言.

请在会议前至少 72 小时打电话 (619) 699-1900 提出请求.

Vision Statement Pursuing a brighter future for all.

Mission Statement We are the regional agency that connects people, places, and innovative ideas by implementing solutions with our unique and diverse communities.

Our Commitment to Equity We hold ourselves accountable to the communities we serve. We acknowledge we have much to learn and much to change; and we firmly uphold equity and inclusion for every person in the San Diego region. This includes historically underserved, systemically marginalized groups impacted by actions and inactions at all levels of our government and society.

We have an obligation to eliminate disparities and ensure that safe, healthy, accessible, and inclusive opportunities are available to everyone. In 2021, SANDAG will develop an equity action plan that will inform how we plan, prioritize, fund, and build projects and programs; frame how we work with our communities; define how we recruit and develop our employees; guide our efforts to conduct unbiased research and interpret data; and set expectations for companies and stakeholders that work with us.

We are committed to creating a San Diego region where every person who visits, works, and lives can thrive.

2

San Diego Association of Governments 401 B Street, Suite 800, San Diego, CA 92101-4231 × (619) 699-1900 × Fax (619) 699-1905 × sandag.org

3

Audit Committee Friday, October 22, 2021

Item No. Action

+1. Approval of Meeting Minutes Approve

The Audit Committee is asked to review and approve the minutes from its September 24, 2021, meeting.

2. Public Comments/Communications/Member Comments

Public comments under this agenda item will be limited to five public speakers. Members of the public shall have the opportunity to address the Audit Committee on any issue within the jurisdiction of the Committee that is not on this agenda. Public speakers are limited to three minutes or less per person. If the number of public comments under this agenda item exceeds five, additional public comments will be taken at the end of the agenda. Subjects of previous agenda items may not again be addressed under public comment.

3. Chief Executive Officer’s Report Hasan Ikhrata, SANDAG

Discussion

An update on key programs, projects, and agency initiatives will be presented.

4. Update on the Office of The Independent Performance Auditor Activities Mary Khoshmashrab, SANDAG

Discussion

The Independent Performance Auditor will present an update on the Office of the Independent Auditor's activities and other information sharing events.

Reports

+5. Office of the Independent Performance Auditor Review Results for State Route 125

Mary Khoshmashrab and Toufic Tabshouri, SANDAG

Discussion/Possible Action

The Audit Committee is asked to discuss and provide input on the State Route 125 Review, and other required next steps, and move to the Board of Directors for consideration.

+6. Office of the Independent Performance Auditor Review Results for the Vendor Operational and System Controls

Mary Khoshmashrab and Lloyd Carter, SANDAG

Discussion/Possible Action

The Audit Committee is asked to discuss and provide input on the revew results, and other required next steps, and move to the Board of Directors for consideration.

7. Upcoming Meetings Information

The next Audit Committee meeting is scheduled for Friday, November 19, 2021, at 12:30 p.m.

8. Adjournment

+ next to an item indicates an attachment

Audit Committee Item: 1 October 22, 2021

September 24, 2021, Meeting Minutes Chair David Zito (Board Member) called the meeting of the Audit Committee to order at 12:30 p.m.

1. Approval of Meeting Minutes (Approve)

Action: Upon a motion by Ed Musgrove (Alternate Board Member) and a second by Robert Monson (Public Member), the Audit Committee approved the minutes from its January 22, 2021, meeting.

The motion passed.

Yes: Chair Zito, Vice Chair Racquel Vasquez (Board Member), Agnes Wong Nickerson (Public Member) Stewart Halpern (Public Member), and Robert Monson.

No: None.

Abstain: None.

Absent: None.

2. Public Comments/Communications/Member Comments

None. Reports

3. Chief Executive Officer’s Report (Discussion)

Chief Executive Officer Hasan Ikhrata provided an update on key programs, projects, and agency initiatives .

Chair Zito expressed his appreciation for the Chief Executive Officer’s plans to improve the Bike Program.

Action: Discussion only.

4. Update on the Office of the Independent Performance Auditor Activities (Discussion)

Independent Performance Auditor Mary Khoshmashrab provided an update on the Office of the Independent Performance Auditor’s (OIPA) activities including the vendor review process and system control and the State Route 125 reviews nearing completion; the upcoming purchase card review; working with SANDAG staff on various performance measures and strategic goals; and introduced the new Principal Management Internal Auditor Toufic Tabshouri.

Toufic Tabshouri introduced himself to the Audit Committee.


7. Matters to be Communicated in Accordance with Auditing Standards (Information)

Kathrine Lai and Jennifer Richards, Crowe LLP, presented the item.

An overview of the FY 2021, SANDAG Financial Audit Plan was presented.

Katherine Lai discussed the engagement objectives, to express an opinion on financial statements; scope of the audit, that includes four phases, its deliverables such as the Auditor’s Report for all financial audits

Action: Approve

The Audit Committee is asked to approve the minutes from its September 24, 2021, meeting.

2

conducted, as well as Independent Accountant reports for their compliance and other audits; and other required communications under professional standards.

Jennifer Richards discussed the required deliverables for Transportation Development Act Claimants. An Independent Auditor’s report and a report on internal controls will be submitted.

Chair Zito asked about the audit team’s efforts, and if they are participating in audits for other organizations or are they fully committed to SANDAG’s audit. Katherine Lai responded saying their core team is solely dedicated to this audit during the fieldwork timeline. However, partners and senior managers have other clients, but it is helpful because it allows them to have other perspectives of other transportation agencies across the state and country.

Chair Zito also asked when they are auditing agencies like SANDAG, how often are they finding issues or statements that are not materially correct and need to be corrected, and if they are able to provide context for how they think SANDAG is doing against other agencies. Katherine Lai responded by saying SANDAG management has been very helpful and responsive and has acted positively on their recommendations.

Action: Information only

5. Discussion on Procedures that the Audit Committee and Office of the Independent Performance Auditor Agreed Upon; Process in Communicating and Web Posting (Discussion)

Independent Performance Auditor Mary Khoshmashrab presented the item.

The OIPA is asked to discuss, familiarize, and address questions regarding procedures that the Audit Committee and the OIPA agreed upon for the communication and web posting process to Audit Committee members.

Independent Performance Auditor Mary Khoshmashrab noted that this would be an internal reporting process on how the report will go from the OIPA to the Audit Committee and then to the Board. If there are any discrepancies or discussions and those will be dealt with. We want to put in writing the audit report distribution process. The intent is to ensure past mishaps do not happen again. It was approved by the Audit Committee in July 2020.

The basic changes highlighted at the time the draft report is issued to SANDAG’s management, Mary Khoshmashrab will brief them each individually to ensure everyone has a general understanding. Mary Khoshmashrab reached out to John Kirk to ensure there were no violations to the Brown Act. There will be no joint, or group, discussions and no removing of material based on any discussions; Proposed Audit Committee members post presentation process; and a vote on accepting the report, then it moves onto the Board of Directors. In case the vote is not unanimous, the minorities will be given the opportunity to have included in the report an explanation to why there was a disagreement. This allows the perspective of the minorities so there is a full, transparent perspective.

Robert Monson said it is always good for there to be guidelines on how a process works. Robert Monson asked about the timing of posting the final report to the website. Would it be better to wait until the Audit Committee has seen the report before putting it on the website in case any modifications are made? Mary Khoshmashrab responded by saying once the report is put on the Audit Committee agenda it is public, however she will hold off on posting a report until it is finalized and ready to go to the Board of Directors.

Robert Monson also asked when talking about modifications to recommendations, the recommendations are the Auditor’s and should not be changed. Mary agreed and said despite what management believes or decides to do, it does not change her report. The modifications Mary Khoshmashrab was talking about would be from discussions with the Audit Committee and management on adding reasonable things to the action plan. These modifications do not change what was found.

3

Stewart Halpern clarified the findings are findings and do not change, but there can be differing points of view between the Auditor and management; does the alternative take into account the possibility of the Audit Committee requesting both parties to form a bridge between differing points of view. Mary Khoshmashrab responded by saying we have a draft and a discussion with management at the Exit Conference, management has time to review and to respond.

Stewart Halpern proposed the committee votes to adopt these procedures as practice. John Kirk stated the agenda item 5 for the meeting was discussion. John said the process sounded administrative and administrative processes do not generally rise to the level of formally adopted board policies because it is not dictating the processes of the board. John Kirk cautioned if it voted to be a board process, the OIPA must monitor and update it. Mary Khoshmashrab responded by saying it is in her audit plan which is updated annually.

Chair Zito asked if we can add it into the audit plan vote. Mary Khoshmashrab replied it is in her audit plan. Chair Zito commented that when the committee approves the audit plan it should be noted they are indirectly approving this procedure. John Kirk said that is appropriate.

Stewart Halpern replied he wants to make sure everyone is aware of this. Mary Khoshmashrab stated she had briefed Agnes Wong Nickerson, who said she was comfortable with the process.


6. Salaries and Compensation Audit (Information)

A progress report on the Corrective Action Plan that was approved by the Board of Directors in November of 2020, regarding the Salaries and Compensation Audit conducted by OIPA will be provided.


+6A. Salaries and Compensation Audit Action Plan Progress Report (Information)

Director of Organization Effectiveness Melissa Coffelt presented the item.

An update on progress achieved to date regarding the Compensation Audit Action Plan was presented.

There are 27 items to be completed by June 2022. Eleven items were completed between April and June, including revisions to the SANDAG bylaws and Board Policies; an increase in the transparency and robustness in preparation and communication of salaries and benefits information provided to the Board; and the market salary range study.

General Counsel John Kirk shared his team’s accomplishments. They completed four actions regarding the SANDAG bylaws and board policies. Revisions were made to article 5 of the SANDAG bylaws, section 4D clarified the Chief Executive Officer’s responsibility for the Employee Handbook and the administrative policies used for the administration of SANDAG’s personnel policy. 4E was added to the bylaws providing direction to the Director on fulfilling responsibilities consistent with the requirements of the bylaws, board policies and employee handbook. Two board policies were changed, Board Policy No. 001 and Board Policy No. 017. Updates were also made to Board Policy No. 011, based on collaborations between Management and Mary based on best practices.

Melissa talked about the six actions taken based on communication of salaries and benefits information and the Market Salary Range Study. The study found most of the positions were at market, others in finance, communications, data, and technology positions were low relative to market. The changes were approved by the Board for the FY 2022 budget. Due to budget constraints not all the recommendations could be fully implemented but will be added to the FY 2023 budget proposal.

Two actions are due by September 30 and eleven actions are due by December 31.


4

+6B. Salaries and Compensation Audit Corrective Action Plan Reporting Results (Information)

Independent Performance Auditor Mary Khoshmashrab presented the item.

The Audit Committee was asked to comment on the progress and testing results of the actions in the Corrective Action Plan that have been taken this quarter.

Mary said the report available if someone wants to read it. Mary made recommendations about how the budget looked so it was easier for Board Members to understand. The compensation calculations for FY 2021 have been consistent.

Bob Monson asked about the status change from April. There were three recommendations status changes that went backwards from complete/auditor review to underway, why did it occur? Melissa noted that symbol meanings were changed when making the report in June.

Chair Zito asked an item that is completed or pending OIPA review that could hypothetically go back to ‘underway’ if Mary provided information needing to be changed or incorporated. Mary responds yes but said it is Melissa’s document for clarification.

Stewart Halpern said it is helpful to come up with symbology showing clarification between management and the Auditor.

Chair Zito recommended summarizing statuses and asked if they were looking at comparable pay scales and not actual compensation. Melissa replied yes, they are only looking at the salary ranges.

Action: Information only.

8. Upcoming Meetings (Information)

The next Audit Committee meeting is scheduled for Friday October 22, 2021, at 12:30 p.m.

9. Adjournment

Chair Zito adjourned the meeting at 2:13 p.m.

Meeting Start Time: 12:30 p.m. Meeting Adjourned Time: 2:13 p.m.

5

Confirmed Attendance at SANDAG Audit Committee Meeting

September 24, 2021

Jurisdiction/Organization Name Member/

Alternate Attended

Board Member David Zito (Chair) Primary Yes

Board Member Racquel Vasquez (Vice Chair) Primary Yes

Public Member Robert Monson Primary Yes

Public Member Agnes Wong Nickerson Primary Yes

Public Member Stewart Halpern Primary Yes


Office of the Independent Performance Auditor Review Results for State Route 125

Overview

A review of State Route 125 (SR 125) was performed at the request of Board Member Mayor Salas. The review consists of six questions relating to expenditures and uses of SR 125 revenues that Mayor Salas asked that the Office of the Independent Performance Auditor (OIPA) address. In response, the OIPA performed an Agreed Upon Procedure (AUP) engagement and prepared a report of results based on the review. The Audit Committee is asked to review, discuss, and provide input on the results and move it for review and consideration by the Board of Directors.

Key Considerations

At the March 26, Board meeting, Board Member Mayor Salas requested that the Audit Committee direct OIPA to perform an audit on the SR 125. Additionally, on March 26, OIPA received a letter formally requesting that an audit be performed. After reviewing the request, the Independent Performance Auditor (IPA) determined that an AUP review would be more appropriate, take less audit resources, and provide all the answers to Mayor Salas’s questions as described in the March 26 letter.

At its April 23, 2021, Audit Committee meeting, the Committee accepted the request and directed the IPA to allocate 300 hours of auditor resources to perform a review that covers the following.

Mayor Salas’s request includes the period covering 2017 to 2020, and to determine the following:

• A review all positions charged to the SR 125 fund.

• Determination of personnel costs being charged to the SR 125 fund and if the charges are reasonable and appropriate.

• Determination if there is an appropriate allocation of CalPERS and Other Post-Employment Benefits pension cost allocated to the SR 125 fund.

• A review of overhead allocations to the SR 125 to determine appropriate share of costs.

• Identification of expenditures and compliance for allocations to Capital Improvement Program projects outside of the SR 125 site, if any.

• Determination of proper allocation of interest earned to the SR 125 fund.

The review would cover 2017 through 2020.

Based on this request, the OIPA auditors performed and the AUP and prepared a report, which provides the results of the review. An AUP engagement is not an audit, the auditor does not express an opinion, have findings, or include recommendations or a formal management response. The engagement is designed to provide an independent answer to questions asked by an interested party. The Committee is asked to review the report, discuss the results, and direct the IPA to move it to the Board for discussion and consideration.

Action: Discussion/Possible Action

The Audit Committee is asked to discuss and provide input on the State Route 125 Review, and other required next steps, and move to the Board of Directors for consideration.

Fiscal Impact:

None.

Schedule/Scope Impact:

FY 2022

Next Step

The IPA will accept comments from the Committee and move the AUP report to the November Board meeting for discussion and consideration.

Mary Khoshmashrab, Independent Performance Auditor

Key Staff Contacts: Mary Khoshmashrab, (619) 595-5323, [email protected] Toufic Tabshouri, (619) 595-5382, [email protected]

Attachment: 1. SR 125 Final Report

2

THE OFFICE OF THE INDEPENDENT PERFORMANCE AUDITOR

October 22, 2021

Chair Zito,

SANDAG Audit Committee

Mayor Casillas Salas,

SANDAG Board of Directors Member

Subject: Independent Performance Auditor’s Report on Applying Agreed Upon Procedures

for SR 125

Dear Chair Zito and Mayor Casillas Salas:

As a member of the SANDAG Board of Directors, you requested that the Office of the

Independent Performance Auditor (OIPA) review all monies collected and expended by

the SR 125 Fund in 2017 through 2020 and determine whether they were reasonable,

appropriate, and proportionately allocated. The request resulted from efforts to find

additional savings that could be applied toward paying off related debt earlier than

currently scheduled.

Objective

The overall objective of this Agreed-Upon Procedures (AUP) engagement is to determine

whether SR 125 Fund charges and expenditures from July 1, 2017 to June 30, 2020 are

appropriate, reasonable, and proportionately allocated.

This AUP engagement was conducted in accordance with attestation standards

established by the American Institute of Certified Public Accountants. The sufficiency of

these procedures is solely the responsibility of those parties specified in this report. The

OIPA makes no representation regarding the sufficiency of the procedures for the purpose

of which this report has been requested or for any other purpose.

This AUP does not constitute an audit, and we do not express an opinion on the specified

elements, accounts, or items. In addition, we have no obligation to perform any

procedures beyond those listed in the report that were designed to address your request.

Attachment 1

3

Mayor Casillas Salas SANDAG Board of Directors Member Agreed Upon Procedures SR-125 Results October 22, 2021

AN EMPHASIS ON ACCOUNTABILITY AND TRANSPARENCY Page 2 of 12

Procedures and Results Auditors performed procedures to obtain the information for the six specific items

requested in your memo. The results of these procedures, as well as any professional

judgements the auditors rendered regarding the appropriateness and reasonability of

allocations or charges, are presented after each procedure.

Request Item 1:

Identify all positions charged to the SR 125 Fund.

Procedure:

Auditors identified the positions charged to SR 125 from payroll files provided by SANDAG.

Results :

Table 1 below shows the number of employees working at the Toll Operations Center (TOC),

as well as the number of employees working at other locations who charged time to the SR

125 Fund.

Table 1 – Employees Billed to SR 125 Fund

Fiscal Year

2018

Fiscal Year

2019

Fiscal Year

2020

Employees Located at TOC1

72

75

73

Employees at Other Locations who Charged Time to SR 125

65

74

78

Employees working on SR 125 are located at TOC, whereas employees who work at other

locations only devote a portion of their time to SR 125 matters. The figures shown in Table

1 do not include temporary employees whose costs were billed to the SR 125 Fund.

Temporary employees were hired through staffing companies, and their costs are included

in Table 2.

1 Note that these figures may be overstated due to a limitation in SANDAG’s hiring and payroll system: Employees who initially worked at TOC but later transferred to other locations retain TOC as their coded work location. However, OIPA confirmed that the status does not impact the cost element of SR125.

4



Request Item 2: Determine all personnel costs being charged to the SR 125 Fund and if the charges are

reasonable and appropriate.

Procedure:

Auditors totaled all personnel costs charged to the SR 125 Fund from payroll files provided

by SANDAG. Auditors compared personnel costs to those reported in South Bay

Expressway’s2 audited financial statements to determine if charges are reasonable and

appropriate; as a reminder, auditors did not perform an audit on documents provided by

SANDAG management or staff.

Results :

Table 2 below presents labor expenses charged to the SR 125 Fund for SANDAG employees

working at the TOC and at other SANDAG locations. It also identifies expenses for

temporary employees who are hired through staffing agencies, as well as labor charges that

are capitalized.

Table 2 – Labor Costs Charged to the SR 125 Fund

Fiscal Year

2018

Fiscal Year 2019

Fiscal Year 2020

Labor Expenses for Employees at TOC $4,595,117 $5,111,477 $5,274,630

Labor Expenses for Employees at Other Locations

$790,603

$1,089,112

$1,693,846

Costs for Temporary Employees

$262,086

$176,614

$72,958

Capitalized Labor Charges

$494,513

$532,497

$438,466

Labor expenses for SANDAG employees include salaries and fringe benefits. Fringe benefits

2 Although SR125 and the South Bay Expressway differ, their financial information is similar in that the financial statements are prepared and audited separately before being combined into SANDAG's financial statements as enterprise funds.

5



encompass pension and other postemployment benefit costs, and they are addressed in the

procedure for Request Item 3.

According to SANDAG management, temporary employees are mainly used to support the

customer service and toll operations work areas. Temporary employees frequently fill

positions for regular employees who have taken a leave of absence, and also fill vacant

positions until permanent candidates are hired. Less frequently, temporary employees are

retained to help address increases in administrative workload and clear work backlogs.

While employee salaries and related costs are usually classified as period costs according to

generally accepted accounting principles, they can be classified as capital costs if they are

related to the construction of an asset. In such a case, these costs are not expensed; rather,

they are added to the cost of the asset, and later depreciated over the life of the asset.

Table 3 compares the figures in Table 2 to those from audited financial statements for the

SR 125 Fund.

Table 3 – Variance Between Payroll and Financial Statement Figures for Labor

Costs Charged to the SR 125 Fund

Fiscal Year 2018

Fiscal Year

2019

Fiscal Year 2020

Payroll and Other Compensation Expenses (per Audited Financial Statements)

$6,106,156 $6,705,241 $7,698,183

Totals from Payroll files

$6,142,319

$6,909,700

$7,479,901

Variance amount

$36,163

$204,459

$218,282

Variance percentage

0.6%

3.0%

2.9%

While there are variances between the total amounts in the payroll files and the audited

6



financial statements, these differences can be explained by timing differences3.

Based on the auditors’ review of payroll files, the comparison in Table 3, and discussions

with SANDAG management, it appears that personnel costs charged to SR 125 are

appropriate.

3 The start and end dates for the first and last pay period in a fiscal year generally do not coincide with the start and end dates of the fiscal year. A payroll period is two weeks long and runs from Sunday to Saturday. The start and end dates for SANDAG’s fiscal year are July 1 and June 30, respectively.

7



Request Item 3:

Determine appropriate allocation of CalPERS and Other Post-Employment Benefit (OPEB)

pension cost allocated to the SR 125 Fund.

Procedure:

Auditors totaled fringe benefit amounts (which include pension and OPEB costs) from

payroll reports provided by SANDAG, reviewed fringe benefit rates, and reviewed audited

financial statements and related actuarial reports.

Results :

Table 4 below presents fringe benefit costs charged to the SR 125 Fund for employees

working at the TOC and at other SANDAG locations.

Table 4 – Fringe (Pension and OPEB) Costs Charged to the SR 125 Fund Per Payroll Reports

Fringe Rate or Range

Percentage of Fringe Benefits Paid at This

Rate

Fringe Amount

Fiscal Year 2018 5.36% - 28.70% 0.44% $9,324

67.47% - 67.66% 22.37% $474,000

73.67% - 73.68% 77.19% $1,635,155

$2,118,479

Fiscal Year 2019 1.80% - 42.39% 0.68% $17,924

75.71% - 76.47% 24.56% $645,973

88.68% 74.75% $1,965,859

$2,629,756

Fiscal Year 2020 1.51% - 40.95% 0.08% $2,295

75.65% - 75.76% 29.87% $855,985

88.29% - 88.39% 70.05% $2,007,737

$2,866,018

Although the audited financial statements for SR 125 (AKA and titled SBX) include payroll

and other compensation expenses, these expenses are aggregated and do not separately

show pension and OPEB payments.

8



Management also provided us with two actuarial reports for SANDAG. The first is GASB No.

75 Actuarial Valuation that pertains to OPEB liabilities, and the second is GASB No. 68

Actuarial Valuation that pertains to pension liabilities. GASB No. 75 report was prepared by

an actuarial consulting firm, and GASB No. 68 report is issued by CalPERS. These reports are

required by the respective Government Accounting Standards Board (GASB) statements.

SANDAG management also provided the OIPA’s office with supporting schedules for those

reports. However, a review of these schedules was not possible due to the budget hours

allotted for this AUP engagement.

Based on the auditors’ review and assuming the unaudited Indirect Cost Rate Proposal

(ICRP) and Overhead rate calculations are accurate and reliable, the fringe benefit amounts

appear appropriate.

Request Item 4:

Review overhead allocations to the SR 125 Fund to determine appropriate share of costs.

Procedure:

Auditors reviewed payroll reports provided by SANDAG, totaled overhead costs, and

verified overhead rates charged to the SR 125 Fund.

Results :

Table 5 below presents overhead costs charged to the SR 125 Fund for employees working

at the TOC and at other SANDAG locations.

Table 5 – Overhead Cost Allocations Charged to the SR 125 Fund

Fiscal Year 2018

Fiscal Year 2019

Fiscal Year 2020

Overhead Expenses4

$267,890

$434,268

$692,552

4 The payroll files provided by SANDAG showed overhead charges for eleven employees located at the TOC. The OIPIA’s office reviewed these charges to understand why there were overhead charges associated with employees working at the TOC. Eight of these employees had worked at the TOC but later moved to different positions at other SANDAG locations; the remaining three were managers who had divided their time between the TOC and other locations. SANDAG’s current payroll system is not configured to recode employees who initially worked at TOC but later transfer to other locations.

9



Overhead rates represent an allocation of general and administrative costs. According to

SANDAGs’ management, they are computed as a fixed percentage of an employee’s hourly

pay (excluding fringe benefits). As noted below, the TOC is specifically excluded from the

ICAP. However, SANDAG uses the same overhead rate as the Indirect Cost Allocation Plan

(ICAP) for purpose of internal cost recovery. The overhead rates in the ICAP for fiscal years

2018, 2019, and 2020 were 76.87 percent, 78.26 percent, and 78.65 percent, respectively.

The OIPA’s office verified that these were the rates used in the payroll file which SANDAG

provided.

Note that most indirect costs that SANDAG recovers are through reimbursements from

federal grants. To recover indirect costs, SANDAG is required to prepare and submit an ICAP.

The ICAP establishes indirect cost rates – which encompass employee pension and benefit

costs – and provides a detailed report of SANDAG’s methodology for calculating indirect

costs. The ICAP is intended to ensure compliance with federal cost allocation requirements.

In the past, the ICAP has been self-prepared and reported, reviewed, and approved by the

California Department of Transportation (Caltrans), but it has not been audited by Caltrans

or another external party. The ICAP was identified as a high-risk area during the

organization-wide risk assessment conducted by the OIPA and included in the FY 2021

annual audit plan. Although the OIPA did not have sufficient resources to audit the ICAP

this fiscal year, SANDAG management informed the OIPA that the Federal Transit

Administration is currently auditing the ICAP.

Based on the auditors’ review of overhead charges, these charges appear appropriate.

10



Request Item 5:

Identify expenditures and compliance for allocations to CIP projects outside of the SR 125

site, if any.

Procedure:

Auditors reviewed budget documents, expenditure reports, and project agreements for

Capital Improvement Projects (CIP) allocated to the SR 125 Fund.

Results :

SANDAG management provided auditors with a listing of five projects funded from SR 125

revenues, as well as a summary of expenditures from these projects. As a reminder these

projects and associated cost were not audited by OIPA. These projects are presented in Table

6.

Table 6 – Capital Improvement Project Costs Charged to the SR 125 Fund

Project No.

Project Name

Budgeted Funding from SR 125 Revenues

Total Expended5

1130102

Financial System Upgrade – Contract Management System

$50,000

$37,332

1142600

Joint Transportation Operations Center

1,553,000

$64,382

1201103

SR 11 and Otay Mesa East Port of Entry: Segment 2A and SR 905/125/11 Southbound Connectors Construction

$16,700,000

$5,324,410

1280504

South Bay Bus Rapid Transit (BRT)

$6,500,000

$6,500,000

1390505

SR 905/125/11 Southbound Connector

$19,200,000

$5,893,951

5 As of June 30, 2020.

11



CIP projects are funded by a combination of federal, state, and local revenues. Federal

grants and some state funding programs impose a matching requirement on grant

recipients. The matching requirement obligates recipients to contribute a percentage of

project costs as a condition of grant funding. Table 7 shows the percentage of funding from

SR 125 revenues for each project as a percentage of total project cost.6

Table 7 – Percentage of Capital Improvement Project Costs Budgeted From the SR

125 Fund

Project No.

Project Name

Budgeted Funding from SR

125 Revenues

Total Project

Cost

Percent from

SR 125

1130102

Financial System Upgrade – Contract Management System

$50,000

$1,052,000

4.8 %

1142600

Joint Transportation Operations Center

$1,553,000

$14,518,000

10.7 %

1201103

SR 11 and Otay Mesa East Port of Entry: Segment 2A and SR 905/125/11 Southbound Connectors Construction

$16,700,000

$132,047,000

12.6 %

1280504

South Bay Bus Rapid Transit (BRT)

$6,500,000

$123,672,000

5.3 %

1390505

SR 905/125/11 Southbound Connector

$19,200,000

$68,947,000

27.8 %

For several federal funding programs, the State’s role is to simply pass federal funds to local

agencies through grants or according to apportionment formulas. However, on some CIP

projects, the State receives local funds from SANDAG. A Master Agreement between

SANDAG and Caltrans provides a framework for collaborative agreements between the two

6 Note that the percentages in Table 7 do not correspond to federal match requirements, as additional local funding may also be provided by other local agencies or from other SANDAG sources.

12



agencies. The Master Agreement allows for the transfer of funding between the two

agencies and defines the working relationship between them. Specific agreements are

effected through Project Implementation Orders.

According to SANDAG management, grants that impose a matching requirement on

SANDAG do not specify SANDAG’s revenue source.

OIPA auditors attempted to gather evidence that supports the percentage allocated to

SR125 and was unable to obtain support. According to SANDAG management the

proportion of funding allocated to the SR 125 Fund and other SANDAG revenue sources is

a SANDAG management decision, made within funding eligibility requirements and based

on levels of funding available.7

SANDAG’s compliance with federal grant funding requirements is audited annually as part

of SANDAG’s Comprehensive Annual Financial Report audit. Auditors reviewed these audit

reports and noted no compliance issues.

Request Item 6:

Determine proper allocation of interest earned to the SR 125 Fund.

Procedure:

Auditors reviewed budget documents and audited financial statements.

Results :

Interest income for fiscal yeas 2018, 2019, and 2020 is show in Table 8.

Table 8 – Interest Earned by SR 125 Fund

Fiscal Year 2018

Fiscal Year 2019

Fiscal Year 2020

Interest Income as Reported on the South Bay Expressway’s Audited Financial Statements

$1,077,968

$1,856,826

$1,310,907

SANDAG’s management asserted that the SR 125 Fund does not allocate its interest income

7 The decision is implicitly approved by SANDAG’s Board of Directors (Board) when the Board approves SANDAG’s Program Budget.

13



to other locations; that interest income generated by SR 125 bank and trustee accounts is

entirely allocated to the SR 125; and that the SR 125 cash is segregated to the specific

roadway alone. All interest income generated stays in the trustee and bank accounts and is

utilized for future purchases solely related to the SR 125 roadway.

Restricted use: This report is intended solely for the information and use as determined

by the Mayor Casillas Salas and the SANDAG Board of Directors and is not intended to be

and should not be used by anyone other than the specified parties.

The OIPA would like to thank the Chief Executive Officer, Hasan Ikhrata and SANDAG

management and staff for their professionalism, responsiveness, and cooperation during

this inquiry.

If you have additional questions, please contact me at (619) 595-5323 or

[email protected].

Respectfully,

MARY E. KHOSHMASHRAB, MSBA, CPA

Independent Performance Auditor

Office of the Independent Performance

Auditor SANDAG

cc: Members of the Board of Directors (SANDAG)

Members of the Audit Committee (SANDAG)

Hasan Ikhrata, Executive Director (SANDAG)

Andre Douzdjian, Chief Financial Officer (SANDAG)

OIPA Files/Website

14




Office of the Independent Performance Auditor Review Results for the Vendor Operational and System Controls

Overview

A Review of SANDAG’s vendor operational and system controls process was performed as part of the Office of the Independent Performance Auditor’s (OIPA) approved Annual Audit Plan (plan). The review objective was to review SANDAG’s operational processes and system controls to ensure policies are consistent with federal and state regulations and other applicable governing laws, rules, and regulations; to verify that controls are sufficient and consists of supporting documentation, and other relevant data; and to assess SANDAG’s ability to track, obtain sufficient documentation, and keep adequate records of process and controls that supports adherence to policies and procedures. The report provides the objective of the audit, the methodology, scope, and results that include three findings of which OIPA provides recommendations for improvement.

Key Considerations

At its June 28, 2021, meeting, the Audit Committee (Committee) approved the OIPA’s plan. The Committee agreed with the Independent Performance Auditor (IPA) in that the Plan’s reviews would focus on SANDAG’s operational processes and system controls. Prior to the approval of the Plan and the redirected focus, the review was initially planned for a full contracts and procurement audit. After the IPA and the Committee changed focus, the review was sectioned off by overall processes and the auditors first review consisted of SANDAG’s vendor operational process and system controls.

The attached report identifies three system control weaknesses of which the auditors provide details and examples of what resulted or impacted SANDAG’s operational processes due to the weakness. Further, the auditors provide recommendations that can help to eliminate the control deficiencies and provided SANDAG management with additional guidance on creating a Corrective Action Plan (CAP) that would bring improvement to SANDAG’s vendor operational process and system controls.

The OIPA auditors will continue to provide guidance to SANDAG management and staff upon their request. Further, once the Committee moves the matter to the Board of Directors and the Board accepts the report and any corrective actions, OIPA will work with management to ensure that the CAP is implemented, and that on a quarterly basis OIPA reports the results to the Committee.

The Committee is asked to review the report and CAP, discuss the results, and direct the OIPA to move the matter to the Board for consideration.

Action: Discussion/Possible Action The Audit Committee is asked to discuss and provide input on the review results, and other required next steps, and move to the Board of Directors for consideration.

Fiscal Impact:

None.

Schedule/Scope Impact:

FY 2022

Next Step

The OIPA will accept comments from the Audit Committee and move the Report to the November Board meeting for discussion and consideration.

Mary Khoshmashrab, Independent Performance Auditor

Key Staff Contacts: Mary Khoshmashrab, (619) 595-5323, [email protected]

Lloyd Carter, (619) 595-5328, [email protected]

Attachments: 1. OIPA Vendor Operational and System Control Review for the period of July 1, 2015 to June 30, 2021 – Final

2. SANDAG’s Management Response/Corrective Action Plan

2

THE OFFICE OF THE INDEPENDENT PERFORMANCE AUDITOR

October 22, 2021

Chair Blakespear SANDAG Board of Directors

Audit Committee Chair Zito SANDAG Audit Committee

Dear Chair Blakespear and Audit Committee Chair Zito:

Subject: Results – Vendor Operational and System Control Review for the period of July 1, 2015 to June 30, 2021

The review objective was to review SANDAG’s operational processes and system controls to ensure policies are consistent with Federal and State regulations and other applicable governing laws, rules, and regulations; to verify that controls are sufficient and consists of supporting documentation, and other relevant data; and to assess SANDAG’s ability to track, obtain sufficient documentation, and keep adequate records of process and controls that supports adherence to policies and procedures.

The auditors did not perform an audit of relative financial statements or other financial data, or the objective to provide an expression of an opinion regarding the financial statements in part or taken as a whole, and, accordingly, we do not express such an opinion on them.

The review primarily consists of gaining an understanding of the relevant laws, rules, regulations; inquiries of management and staff; and observations of the vendor system processes. A review does not provide assurance that we will become aware of all significant matters that would be disclosed in an audit or attestation engagement.

The Office of Independent Performance Auditor’s (OIPA’s) office reviewed the vendor process and system controls including a review of the vendor database and the process of adding, deleting, and approving entries in the vendor database from July 1, 2015 to June 30, 2021.

The audit was conducted in accordance with the Generally Accepted Government Auditing Standards as required by federal and state governing code and under Assembly Bill 805.

Restricted use: Though this report is a public report, this report is intended solely for the information and use as determined by the SANDAG Chair and is not intended to be and should not be used by anyone other than the specified parties as determined by the SANDAG Chair.

Attachment 1

3

October 22, 2021 Transmittal Letter Vendor Operational and System Control Review Report Audit ID. 2022-02

The OIPA would like to thank the Chief Executive Officer, Hasan Ikhrata and SANDAG management and staff. If you have additional questions, please contact me at (619) 595- 5323 or [email protected].

Respectfully,

MARY E. KHOSHMASHRAB, MSBA, CPA Independent Performance Auditor Office of the Independent Performance

cc: Members of the Board of Directors Members of the Audit Committee Hasan Ikhrata, Chief Executive Officer Senior Leadership Team OIPA Website OIPA Files

Enclosure: Vendor Operational and System Control Review Report – Audit ID. 2022-02

AN EMPHASIS ON ACCOUNTABILITY AND TRANSPARENCY 4


Office of the Independent Performance Auditor

VENDOR OPERATIONAL AND SYSTEM CONTROL REVIEW AUDIT No. 2022-02

September 2021

Independent Performance Auditor, Mary Khoshmashrab, MSBA, CPA

5

Intentionally Left Blank

6

TABLE OF CONTENTS

REVIEW FINDING HIGHLIGHTS ..................................................................................................... 3

REVIEW OBJECTIVES .................................................................................................................... 5

UNDERSTANDING THE VENDOR PROCESS ......................................................................................... 5

GENERAL REVIEW OBJECTIVES .......................................................................................................... 5

REVIEW RESULTS ......................................................................................................................... 6

FINDING I – SANDAG’s SEGREGATION OF DUTIES MATRIX IS OUTDATED AND INEFFECTIVE.............. 6

FINDING II – THE VENDOR DATABASE IS INCOMPLETE, INACCURATE AND LACKS QUALITY CONTROLS ........................................................................................................................................ 8

FINDING III – ACCOUNTS PAYABLE SUMMATIONS DO NOT HAVE ENOUGH ROOM TO FULLY DISPLAY TOTALS OF $1 BILLION OR MORE ...................................................................................... 13

BACKGROUND, SCOPE, AND METHODOLOGY ........................................................................... 15

AGENCY BACKGROUND AND CREATION OF THE OFFICE OF THE INDEPENDENT PERFORMANCE AUDITOR ......................................................................................................................................... 15

SCOPE ............................................................................................................................................. 15

METHODOLOGY ............................................................................................................................. 16

7

Report 2022-02

Fact Sheet

Mary Khoshmashrab Independent Performance Auditor (619) 595-5323 [email protected]

VENDOR OPERATIONAL AND SYSTEM CONTROL REVIEW

The Office of the Independent Performance Auditors Review Objectives


The review primarily consists of gaining an understanding of the relevant laws, rules, regulations; inquiries of management and staff; and observations of the vendor system processes. A review does not provide assurance that we will become aware of all significant matters that would be disclosed in an audit or attestation engagement.

REVIEW FINDING HIGHLIGHTS

SANDAG’S SEGREGATION OF DUTIES MATRIX LACKS CONTROLS AND IS NOT BEING FOLLOWED (Report page no. 6)

Auditors were provided a segregation of duties matrix that specified the duties of staff relating to the vendor database and the ability to make entries and perform a validation of vendor information into the database. Through inquiries, auditors found that staff was not adhering to the matrix, which lead to improper segregation of duties as one staff member could both make entries and was also responsible for the validation and integrity of the vendor table. Upon further review of the matrix, auditors also found that one person is responsible for critical functions such as posting payables, approving check runs, vendor setup approval, and verifying vendor data.

8


THE VENDOR DATABAS E IS INCOMPLETE, INACCURATE, AND LACKS QUALITY CONTROLS (Report page no. 8)

Auditors found that the database system does not require the data field for designating vendors as “active” or “inactive” to be completed. Specifically, the status field can be left blank or have the word “null” written in the field. Auditors also found that many vendor names were incomplete, and that some vendors did not have a taxpayer identification number or address listed. Auditors also found payees listed as vendors that do not conform to SANDAG’s definition of a vendor. Auditors found cases of duplicate vendors due to misspellings, different naming conventions, or exact copies of the vendor’s name. Auditors were provided a document titled “Vendor Setup Instruction” which according to management is always followed when inputting entries into the vendor database, however based our review this document was not followed.

ACCOUNTS PAYABLE SUMMATIONS DO NOT HAVE ENOUGH ROOM TO FULLY DISPLAY TOTALS OF $1 BILLION OR MORE (Report page no. 13)

During the auditors’ review of the accounts payable (AP) general ledger, auditors noted that the AP summations did not have enough space for totals that are at or over $1 billion. For example, the total for FY 2015-16 was approximately $1.185 billion, but the total shown on the general ledger AP summary documents is approximately $185 million.

Staff: Lloyd Carter, Auditor-in-Charge

Michael Ryan, Management Internal Auditor I

9

REVIEW OBJECTIVES

UNDERSTANDING THE VENDOR PROCESS

SANDAG’s Procurement Manual defines a vendor as “any third-party firm, contractor, or consultant to SANDAG”. The vendor process refers to the process from selecting a vendor to managing the vendor database. For large dollar agreements (over $100,000), SANDAG will seek out request for proposals and choose which vendor to contract with based on an evaluation of factors. Selection is based on a “best value” determination which is defined in SANDAG Board Policy 16 as a “value determined by objective criteria” such as “price, features, functions, life-cycle costs, and other criteria deemed appropriate”.

SANDAG staff provided auditors with a document titled “Vendor Setup Request” which are the instructions that staff follows once they receive a request to add a vendor to the ONE Solution database. Once a request to set up a vendor is made, contracts staff submits, via email, a signed W-9 which is stamped “Vendor Set Up approved by:” which is then signed and dated by a Senior Contracts or Contracts Manager. Through inquiries with staff, auditors were told that only a designated staff member has access to enter vendor information into the database.

GENERAL REVIEW OBJECTIVES


The auditors did not perform an audit of relative financial statements or other financial data, or the objective to provide an expression of an opinion regarding the financial statements in part or taken as a whole, and, accordingly, we do not express such an opinion on them.

The review consists primarily gaining an understanding of the relevant laws, rules, regulations, inquiries and observations from management, staff, and vendors. A review does not provide assurance that we will become aware of all significant matters that would be disclosed in an audit.

10

REVIEW RESULTS

FINDING I – SANDAG’s SEGREGATION OF DUTIES MATRIX LACKS CONTROLS AND IS NOT BEING FOLLOWED

The Department of Finance has a “segregation of duties matrix” which maps out the duties of employees’ various tasks, a couple of which pertain to the vendor database (see Table 1). During our inquiries, auditors noted that SANDAG staff do not adhere to the segregation of duties matrix and that the matrix does not adequately segregate duties.

The segregation of duties matrix shows one staff member (labeled employee D in Table 1) approves and posts payables, approves check run, vendor setup approvals, and is responsible for the validation and integrity of the vendor database. Having one staff member responsible for all of the listed duties creates improper segregation of duties because one person is responsible for critical functions such as posting payables and approving check runs.

Through inquiries with SANDAG staff, auditors identified that the matrix was not being followed. Auditors found that employee H actually conducts the following tasks:

1. Receives notification from contract manager to setup a new vendor 2. Receives a stamped or signed W-9 for vendor information and approval from

contractor 3. Conducts a search if the vendor requested to be setup is in the system 4. Receives all contractor information to prepare for the vendor setup 5. Reviews the contract information for setup 6. Enters the data into the system and the same staff verifies vendor data 7. Authorized to make vendor inactive/place vendor on the do not use

The above staff member’s tasks do not conform to their duties as listed in the segregation matrix as they are not supposed to be validating the vendor data.

Table 1: Segregation of Duties Matrix

User

Role(s)

Enter Payables (OS)

Approve/Post Payables (OS)

Process Checks (OS)

Approve check run (OS)

Vendor Setup Approval (W-9)

Enter /Edit Vendors (OS)

Verify Vendor Data (OS,W-9)

Admin Rights (enter /edit users) (OS)

DBO Access (OS)

Server Access (OS)

Employee A/B/C AP Processing Yes No Yes No No No No No No No Employee D/E/F Inv review/approval No Yes No Yes No No No No No No Employee D/G System payable posting No Yes No No No No No No No No Employee D/H Vendor setup approval No No No No Yes No No No No No Employee I Vendor setup No No No No No Yes No No No No Employee D Vendor review No No No No No No Yes No No No

OS System Admin - IT Senior/Manager* - - - - - Yes Yes Yes

* IT has access to System Admin within ONESolution to create and edit users, groups, menus,

and performs functions found in system admin. and system server and system interface.

11

Internal control is the principal mechanism for preventing and/or deterring fraud or illegal acts. Illegal acts, misappropriation of assets or other fraudulent activities can include an assortment of irregularities characterized by intentional deception and misrepresentation of material facts. Effective internal control provides reasonable assurance that operations are effective and efficient, that the financial information produced is reliable, and that the organization complies with all applicable laws and regulations.

SANDAG follows the State Controller’s Office (SCO) 2015 Internal Control Guidelines. These guidelines assist local agencies in establishing a system of internal control to safeguard assets and prevent and detect financial errors and fraud.

In addition, SANDAG’s Board adopted Policy No. 041 – Internal Control Standards Policy – in September 2019. The primary purpose of this policy is to establish internal control standards for management and staff that are governed by the Board of Directors. The policy reflects and conforms to the Internal Control – Integrated Framework (2013) issued by the Committee on Sponsoring Organization of the Treadway Commission (COSO). The five elements of internal control are:

1. Control Environment 2. Risk Assessment 3. Control Activities 4. Information and Communication 5. Monitoring

Effective segregation of duties is a control activity. It is designed to prevent the possibility that a single person could be responsible for diverse and critical functions in such a way that errors or misappropriations could occur and not be detected in a timely manner, in the normal course of business processes.1

SANDAG staff stated that they are performing multiple functions within the Finance Department. A SANDAG staff member who conducts vendor setup into the system also conducts encumbrances, bankruptcy, and provide audit support.

A possible reason for SANDAG staff not adhering to the current matrix could be due to current understaffing, an issue that was raised by a SANDAG manager. SANDAG’s current “segregation of duties matrix” will need to be updated to ensure proper segregation of duties.

1 U.S. Government Accountability Office.

12

Improper segregation of duties creates an increase in the risk of fraud. The understaffing also contributes to vendor database information being incomplete, inaccurate, and duplicated.

Recommendations:

1. SANDAG should review and update its segregation of duties matrix so it adheres to SANDAG Board Policy 41, the State Controller’s Office’s Internal Control Guidelines, and other best practices. The OIPA encourages that SANDAG seek guidance from the OIPA when designing the new segregation of duties matrix to ensure compliance with SANDAG Board Policy 41.

2. SANDAG should implement controls to ensure that staff adhere to the updated segregation of duties matrix.

FINDING II – THE VENDOR DATABASE IS INCOMPLETE, INACCURATE AND LACKS QUALITY CONTROLS

SANDAG uses a database, ONE Solution, to track vendor activities. During the review of ONE Solution, auditors noted that there are 8,619 vendors inputted into the system. Auditors found erroneous records such as incomplete vendor information, duplicate vendors, and vendors that do not meet SANDAG’s definition of vendors. These errors indicate that there is lacking quality controls over the management oversight of the vendor database such as input controls or periodic reviews of vendor names.

INADEQUATE VENDOR DATABASE MANAGEMENT

Of the 8,619 vendors, there were 4,337 with missing status, 3,927 active status, 14 inactive and 341 vendors with null status. The “PE_ID_ Status2” data field is not adequately designed to ensure that the status fields of vendors are filled or updated. Specifically, auditors found that the status field can be left blank or have the word “null” written in the field but according to the vendor setup instruction guide provided to staff, step 12 says to activate the record when the vendor setup review is completed. Consequently, this data field cannot be used by SANDAG to identify the population of “active” and “inactive” vendors.

Auditors also found that the Finance Department does not have a process to ensure that the status of vendors is accurate in the system. In addition, SANDAG is manually annotating vendor names with some form of “do not use” to indicate that the vendor is inactive. However, staff does not ensure that vendor status is updated consistently.

2 The PE_ID_Status data field in ONE Solution is used to designate vendors as active or inactive by entering “AC” or “IN” respectively.

13

Of the 71 vendors marked as “do not use”, auditors found that only 12 vendors are marked as inactive status. In contrast, 2 of the 14 vendors marked as inactive were not updated to state “do not use”. Auditors noted that SANDAG staff is not consistently deactivating vendors.

INCOMPLETE AND INACCURATE VENDOR INFORMATION, AND DUPLICATE VENDORS IN THE DATABASE.

After review of the ONE Solution vendor database, auditors found the following:

• There are 3,100 entries that have no Taxpayer Identification Number. • There are 218 vendor IDs that have no address listed in any field in the vendor master

file. • There are 212 vendor IDs that have no address listed and no Taxpayer Identification

Number. • Staff was provided a document with instructions on vendor setup, and it includes an

instruction to add vendor information such as taxpayer identification and address. • Auditors found names in the PE_Vendor field that do not meet SANDAG’s Procurement

Manual’s definition of vendors, specifically: o Fxxxx,, Kxxxx [Former City of San Diego Mayor] o Cxxxx, Lxxx [Current SANDAG Employee] o Chips and Salsa o Printing Place

• 32 vendor names contained an asterisk, but staff could not provide a reason for the asterisk’s use.

• Finance staff could not provide a reason for why some employees and board members had an ID with a V as the first letter.

• SANDAG and ARJIS are listed as vendors.

14

Table 2 below provides a sample of vendors within the ONE Solution database that have incomplete vendor titles.

Table 2: Incomplete Vendor Names

Vendor Name Vendor ID

Center for Applied V06230

Congress for the V00407

G* V06682

Int’l Conference of V00713

Maxwell Properties LP & V03856

Moore & * V04246

National Association of V03764

Print V02075

San Diego Convention and V01202

San Diego Valet & V01505

15

Table 3 below provides samples of vendors with more than one vendor ID.

Table 3: Vendors with Multiple Vendor IDs



Reason for Duplication

Bacons Multivision V04124 Bacon’s Multivision Inc. V04124 (a)

Borgwardt, Dianne V07706 Borgwardt, Dianne V05591 (a)

Ferrer, Enrique V07361 Ferrer, Enrique V05355 (a)

Sergio Pallares V03967 Pallares, Sergio V06248 (b)

Siemens Energy & Automation Co

V02975 Siemens Energy & Automation Inc.

V02975 (a)

Administrative Serv SD LLC

V03914 Administrative Serv SD LLC

V03914 (a)

Booz Allen Hamilton Inc V03576 Booz-Allen & Hamilton V03576 (a)

CA Dept of Insurance V04446 California Dept of Insurance

V04668 (b)

S.D. Railroad Museum V01184 San Diego Railroad Museum

V02481 (b)

U S Postal Service V04596 United States Postal Service

V06189 (b)

(a) Duplicate vendor name – slight difference in spelling of vendor name, misspelled

vendor name. (b) Duplicate vendor name – inconsistent naming convention for vendor name, i.e.,

reverse of first and last names, acronyms of San Diego, California.

• Numerous vendors have multiple vendor IDs despite the name being an exact copy

in both format and spelling.

• Auditors also noted that the inconsistent placement of the word ”The” for vendors could potentially lead to more duplicates.

16

VENDOR RECONCILIATION

Based on the information listed above and through inquiries with staff, auditors noted a lack of quality control over the vendor database.

SANDAG’s Procurement Manual defines a vendor as “any third-party firm, contractor, or consultant to SANDAG”.

Through our research, we identified the following quality control measures for maintaining accurate records in a vendor database:

1) Consolidate and Validate: Consolidate all vendor data, standardize company names, addresses, and other vendor information. Once a vendor is consolidated, verify addresses, banking information, and other critical data with external sources to ensure accuracy. Taxpayer Identification Number (TIN) validation and vendor name matching should be performed using the Internal Revenue Service’s TIN matching system.

2) Remove Duplicate Vendor Names.

3) Archive Inactive Vendors: Archive Inactive vendors that have not recently been used. If a vendor has not been used in the past 15-18 months, remove from vendor list.

4) Fill in the Gaps: Make sure all files are complete and accurate by obtaining any missing data from the vendor. Add missing contact names, phone numbers and email addresses, and identify related vendors.

According to the SANDAG staff, when a new vendor is entered into the system, staff conducts a search to see if the vendor is already in the database, but some duplicates can happen due to different spellings of the vendor’s name. The example staff provided was United States and USA. However, it appears the ONE Solution software does not automatically prevent exact duplications. In addition, SANDAG does not appear to have a consistent naming convention or a process to ensure that the same vendor is entered into the system more than once other than conducting a search.

There is no control to ensure that vendors in the database have a taxpayer identification number and a listed address.

According to SANDAG staff, staff are conducting multiple duties which could be a contributing factor to the vendor list not being updated or inaccurate.

Inconsistent vendor management increases the risk of duplicate payments and the risk of potential fraud.

17

Recommendations:

To ensure that the vendor list is both accurate and complete, SANDAG should:

1. Review all vendors and classify them as active or inactive, and label them as such. 2. Replace or update the current vendor management software to prevent creating

duplicate vendors. 3. Standardize naming conventions to avoid near duplicate vendors, such as “U S Postal

Service” and “United States Postal Service”. 4. Add the missing information such as the Taxpayer Identification Numbers and addresses

for existing and active vendors. 5. Reconcile the vendor list to ensure that incomplete, inaccurate, or duplicated vendors

are removed from the vendor list. 6. Consider hiring additional staff to ensure ease of staff multiple job duties. 7. Ensure that only entities conforming to SANDAG’s definition of a vendor are included in

the vendor list. 8. Provide training to staff for managing the database to ensure consistency in entering

vendor information.

FINDING III – ACCOUNTS PAYABLE SUMMATIONS DO NOT HAVE ENOUGH ROOM TO FULLY DISPLAY TOTALS OF $1 BILLION OR MORE

During the auditors’ review of the vendors account payable (AP) general ledger, staff noted that the AP summations did not have enough space for totals that are at or over $1 billion. For example, the total for FY 2015-16 was approximately $1.185 billion but the total shown on the general ledger AP summary documents is approximately $185 million. Another indication that supports the summary total in the AP general ledger is incorrect is the entry for VO1294-SANDAG shows approximately $271 million while the grand total shows $185 million as stated above.

In addition, AP general ledger for FY 2018-19 shows a total of $279 million, however, when the AP general ledger was converted into an excel file the true amount is $2.279 billion. This shows that staff cannot just assume the billions digit to be a one.

A basic tenant of financial reporting is the reliability of the information reported. Reliability3 is the quality of information that assures that information is reasonably free from error and bias and faithfully represents what it purports to represent.

SANDAG staff stated that the current system is old, inadequate, and that it was implemented when SANDAG was a smaller agency.

3 As defined in the Financial Standards Accounting Board’s Statement of Financial Accounting Concepts No. 2 and referenced in the Government Accounting Standards Board’s Concept Statement No. 1.

18

If summations are not carefully reviewed, staff could underreport the total AP Summary summations by at least a billion.

Recommendation:

The OIPA recommends SANDAG either update or replace the current accounting software so that the totals can be fully displayed in the vendors AP ledger.

19

BACKGROUND, SCOPE, AND METHODOLOGY

AGENCY BACKGROUND AND CREATION OF THE OFFICE OF THE INDEPENDENT PERFORMANCE AUDITOR

Founded in 1980, San Diego Association of Governments (SANDAG) was created by local governments as a long-range planning agency within the San Diego County government as a state-authorized joint powers authority. Currently SANDAG is defined by the State Controller’s Office as an Independent Special District. This public agency serves as the forum for regional decision-making. The agency builds consensus; makes strategic plans for the region; obtains and allocates resources; plans, engineers, and builds public transportation; conducts criminal justice research; and provides information on a broad range of topics pertinent to the region's quality of life.

SANDAG is governed by a Board of Directors composed of mayors, council members, and county supervisors from each of the region's 18 cities and County. Supplementing these voting members are advisory member representatives from Imperial County, the U.S. Department of Defense, California Department of Transportation, Metropolitan Transit System, North County Transit District, San Diego County Water Authority, San Diego Unified Port District, San Diego Regional Airport Authority, Southern California Tribal Chairmen's Association, and Mexico.

SANDAG currently has approximately 380 employees. The agency’s program budget for fiscal year 2021-22 was $1.13 billion. This budget includes $52.1 million in projected costs forthe overall work program, $60.8 million for regional operations, and the annual portion ofthe capital program is projected to be $686.7 million, of which $317 million will be passed through to Caltrans District 11 and local agencies. The SANDAG financial outlook is tied to the health of the regional, state, national, and global economy. Economic performance can impact sales tax receipts and other sources of revenue that the agency depends on to carry out its projects and programs. Sales tax-based revenues such as Transportation Development Act and TransNet are a significant source of funding for both the Capital Program and the Overall Work Program (OWP).

On January 1, 2018, a new California Assembly Bill (AB 805) required the creation of the SANDAG Audit Committee, and an independent performance auditor (IPA) position. The Audit Committee is responsible for making recommendations to the SANDAG Board of Directors regarding the hiring and oversight of the work of the SANDAG independent performance auditor, the SANDAG annual audit plan, the external financial auditors for SANDAG, and internal control guidelines for the agency. The Audit Committee also is responsible for monitoring the implementation of any corrective actions arising from the audits. Prior to the creation of the Audit Committee and IPA, SANDAG had only 1.5 full-time equivalent internal audit positions reporting directly to management.

20

https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fleginfo.legislature.ca.gov%2Ffaces%2FbillTextClient.xhtml%3Fbill_id%3D201720180AB805&data=01%7C01%7CLloyd.Carter%40sandag.org%7Cb45a1945d27243474cc608d7e623340a%7C2bbb5689d9d5406b8d02cf1002b473e7%7C0&sdata=DvNYgFUaogGTCv6tl4G7m3C9%2Fg3XQxacxi6%2BFZSv21Y%3D&reserved=0

SCOPE

The Office of Independent Performance Auditor’s (OIPA’s) office reviewed the vendor process and system controls including a review of the vendor database and the process of adding, deleting, and approving entries in the vendor database from July 1, 2015 to the present.

METHODOLOGY

Auditors reviewed internal controls and their components to gain a sufficient understanding of the internal control structure and documented their understanding. Gaining an understanding of internal controls consisted of reviewing, verifying, interviewing, and identifying internal controls strengths and weaknesses by way of a questionnaire, narratives, flowcharting processes, and performing a walk-through of transactions as necessary, to develop appropriate auditing procedures. This understanding is necessary for planning the review engagement and determining the nature, timing, and extent of tests to be performed. Auditors adhered to Statement of Auditing Standards (SAS) No. 122 and SAS 99, which require performing a brainstorming session regarding potential fraud as it relates to the review.

The substantive review procedures consisted of an examination of the evidence that supports the recording, authorizing, approving, reviewing, and reporting, and the relevant monitoring and maintenance processes and procedures. The examination was based on a judgmentally selected sample of the population. We designed our review procedures to meet our review objectives.

21

PROPOSED ACTION PLAN FOR IMPLEMENTING

Operational – Process and System Control Review of Vendors AUDIT RECOMMENDATIONS

The SANDAG Office of the Independent Performance Auditor (OIPA) Operational – Process and System Control Review of Vendors (Review) in September of 2021. The report will be presented to SANDAG Audit Committee and Board of Directors in October and November This proposed Action Plan (Plan) has been prepared by OIPA in response to the 3 findings with recommendations identified from the review. OIPA has prepared this document to assist management in completing a Corrective Action Plan. Management may choose to use this document or prepare their own. Management should insert their proposed actions and assign a responsible party for each task. Please complete this document and provide it to OIPA with Management’s written response by October 8, 2021. Finding I: SANDAG’s Segregation of Duties Matrix is Outdated and Ineffective

Finding Description

Management Agrees/Disagrees with the Finding OIPA Recommendations

SANDAG Management’s Proposed Action

Responsible Official and Estimated Completion Date

Auditors were provided a segregation of duties matrix that specified the duties of staff relating to the vendor database and the ability to make entries and perform a validation of vendor information into the database. Through inquiries, auditors found that staff was not adhering to the matrix, which lead to improper segregation of duties as one staff member could both make entries and was also responsible for the validations and integrity of the vendor table. Upon further review of the matrix, auditors also found that one person is

Agree 1. SANDAG should review and update its segregation of duties matrix so it adheres to SANDAG Board Policy 41, the State Controller’s Office’s Internal Control Guidelines, and other best practices. The OIPA encourages that SANDAG seek guidance from the OIPA when designing the new segregation of duties matrix to ensure compliance with SANDAG Board Policy 41.

1.Management has been performing annual review of internal control measures as part of the financial audit requirement. However, due to staffing constraints, perfect segregation of duties in certain areas could not be obtained. Management has established segregation controls as the resources permit, as well as put in place mitigating controls to minimize any potential risks.

Leeanne Wallace

By the end of November 2021

Attachment 2

22

Operational Process and System Control Review of Vendors - Proposed Action Plan 2

Finding Description




responsible for critical functions such as posting payables, approving check runs, vendor setup approval, and verifying vendor data.

2. SANDAG should implement controls to ensure that staff adhere to the updated segregation of duties matrix.

Management will seek guidance from OIPA to further improve on internal controls. 2.The department has been understaffed in some critical functions for a long time. Some staff members have been performing multiple functions and responsibilities and overworked. With the constraint in obtaining additional resources, in the past, segregation of duties was sometimes compromised to meet operational and business needs. Management was aware of the issue and obtained approval to add a new position to support the vendor set up process. The position was filled recently, and the person will be starting in mid- October 2021. This person will be trained on Vendor Set up process and will perform the vendor setup duties. Another designated staff will be verifying, and validating vendor information entered in the system to ensure accuracy and approving it for use. Management will perform periodic reviews of internal

23


Finding Description




control measures including segregation duty matrix. Management is in the process of evaluating current department structure to ensure it properly supports internal controls and operation efficiency.

Finding II: The Vendor Database Is Incomplete, Inaccurate and Lacks Quality Controls

Finding Description

Management Agrees/Disagrees with the Finding OIPA Recommendation



Auditors found that the database system does not require the data field for designating vendors as “active” or “inactive” to be completed. Specifically, Auditors the status field can be left blank or have the word “null” written in the field. Auditors also found that many vendor names were incomplete, and that some vendors did not have a taxpayer identification number or address listed. Auditors also found payees listed as vendors that do not conform to SANDAG’s definition

Agree

To ensure that the vendor list is both accurate and complete, SANDAG should:

SANDAG active vendor data is accurate and has been used to support the disbursement processing which has been audited annually. However, due to the legacy issues from previous accounting system conversions, MTS vendors were uploaded to SANDAG vendor database in the initial data conversions, and the original data cleansing was not performed

Leeanne Wallace

By the end of December 2021

1. Review all vendors and classify them as active or inactive, and label them as such.

2. Replace or update the current vendor management software to prevent creating duplicate vendors.

24


of a vendor. Auditors found cases of duplicate vendors due to misspellings, different naming conventions, or exact copies of the vendor’s name. Auditors were provided a document titled “Vendor Setup Instruction” which according to management is always followed when inputting entries into the vendor database, however based our review this document was not followed.

3. Standardize naming conventions to avoid near duplicate vendors, such as “U S Postal Service” and “United States Postal Service”.

during the previous system implementations. The current vendor database stored a lot of non-SANDAG vendors and ONESolution has limitations to accurately purge the MTS vendor data, nor separating the active and inactive vendor info using current reporting features.

1. A thorough review and update if needed of the vendor database including active and inactive status, any missing or duplicate information will be conducted when the newly designated staff is on board.

2. Vendor management software is a module of the current accounting system which will be replaced when SANDAG starts the new ERP system implementation anticipated by the beginning of the calendar year 2022. Finance will work with system implementation team to make sure accurate vendor data is installed into the new system.

3. The vendor naming conventions will be

4. Add the missing information such as the Taxpayer Identification Numbers and addresses for existing and active vendors.

5. Reconcile the vendor list to ensure that incomplete, inaccurate, or duplicated vendors are removed from the vendor list.

6. Consider hiring additional staff to ensure ease of staff multiple job duties.

7. Ensure that only entities conforming to SANDAG’s definition of a vendor are included in the vendor list.

8. Provide training to staff for managing the database to ensure consistency in entering vendor information.

25


further reviewed in the new ERP system implementation process to prevent potential duplications.

4. See list # 1 5. See list # 1 6. Management is

evaluating staffing structure for internal control support and will seek additional resources as needed.

7. See list # 1 8. Vendor process and data

management training will be provided to staff.

Staff will continue to work with ONESolution to explore options to segregate invalid data and alternative reports that can generate active vendor listings. While working with ONESolution for system improvement on vendor data management, the interim solution to maintain an accurate active vendor list is to have designated staff to track active vendor information offline based on vendor payment information and perform periodic system review of the vendor data against the tracking sheet to ensure the information is complete and accurate.

26


Finding III: Accounts Payable Summations Do Not Have Enough Room To Fully Display Totals Of $1 Billion Or More

Finding Description

Management Agrees/Disagrees with Finding OIPA Recommendation SANDAG Management’s Proposed Action


During the auditors’ review of the accounts payable (AP) general ledger, auditors noted that the AP summations did not have enough space for totals that are at or over $1 billion. For example, the total for FY 2015-16 was approximately $1.185 billion, but the total shown on the general ledger AP summary documents is approximately $185 million.

Agree 1. The OIPA recommends SANDAG either update or replace the current accounting software so that the totals can be fully displayed in the vendors AP ledger.

Current system report has limitations embedded in displaying the summations of $1 billion or more in PDF file format. Please note the data source stored in the financial system is reliable and when the data was converted into an excel file format, the summations are displayed correctly.

Our current software in version16.2 has been outdated, and the software provider ended their technical enhancement support on March 31, 2021, and no longer provides fixes after the date passed. We can still receive the functional support from the same provider through March 31, 2023, with access to the support desk and self-service portal.

Leeanne Wallace

By new ERP system implementation completion date (Financial/Budget)

27


There was a business decision made not to proceed with the current software upgrade to 19.2 and will remain on 16.2. Therefore, the reporting deficiency cannot be resolved with the current software.

Management is focusing on replacing the current accounting software with a new ERP solution. The ERP project implementation is managed by our IT Department.

28

audit committee agenda

Documents