Loading...
HomeMy WebLinkAboutManagement LetterMcGladrey& Pullen Certified Public Accountants Management Letter Required By Chapter 10.550 of the Rules of the Auditor General of the State of Florida To the Honorable Mayor and Members of the City Commission City of Miami, Florida We have audited the financial statements of the govemmental activities, the aggregate discretely presented component units, each major fund, and the aggregate remaining fund information of the City of Miami, Florida (the "City") as of and for the fiscal year ended September 30, 2009, which collectively comprise the City's basic financial statements, and have issued our report thereon dated April 20, 2010. We did not audit the financial statements of the Southeast Overtown Park West Redevelopment Agency, the Omni Redevelopment Agency, the Miami Midtown Community Redevelopment Agency, the Gusman and Olympia Special Revenue Fund, the Virginia Key Beach Park Trust, the Liberty City Community Revitalization District Trusts, the Firefighters' and Police Officers' Retirement Trust and the General Employees' and Sanitation Employees' Retirement Trust and Other Managed Trusts which represent 91 % respectively, of the assets of the aggregate remaining fund information. These entities also represent 4% and 5%, respectively, of the assets and revenues of the govemmental activities balances. We also did not audit the financial statements of the Miami Sports and Exhibition Authority, Downtown Development Authority, Bayfront Park, and the Civil Investigative Panel, discretely presented component units of the City, which represents 15% of the total assets and 28% of the total revenues of the aggregate discretely presented component units. Those financial statements were audited by other auditors whose reports thereon have been fumished to us, and our opinions, insofar as it relates to the amounts included for the Southeast Overtown Park West Redevelopment Agency, the Omni Redevelopment Agency, the Miami Midtown Community Redevelopment Agency, the Gusman and Olympia Special Revenue Fund, the Virginia Key Beach Park Trust, the Liberty City Community Revitalization District Trusts, the Firefighters' and Police Officers' Retirement Trust, the General Employees' and Sanitation Employees' Retirement Trust and Other Managed Trusts, the Miami Sports and Exhibition Authority, Downtown Development Authority, Bayfront Park, and the Civil Investigative Panel, are based on the reports of the other auditors. We conducted our audit in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Govemment Auditing Standards, issued by the Comptroller General of the United States; and OMB Circular A-133 Audits of States, Local Governments, and Non-profit Organizations. We have issued our Independent Auditor's Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards, and Independent Auditor's Report on Compliance with Requirements Applicable to each Major Federal Program and State Project and on Internal Control over Compliance, and Schedule of Findings and Questioned Costs. Disclosures in those reports and schedule which are dated April 20, 2010, should be considered in conjunction with this management letter. Additionally, our audit was conducted in accordance with Chapter 10.550, Rules of the Auditor General, which govern the conduct of local govemmental entity audits performed in the State of Florida. This letter includes the following information which is not in the aforementioned auditor's reports or schedule: 1 Section 10.554(1)(i) 1., Rules of the Auditor General, requires that we determine whether or not corrective actions have been taken to address findings and recommendations made in the preceding annual financial audit report. Except as noted in Appendix B — Status of Prior Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls, corrective actions have been taken to address findings and recommendations made in the preceding annual financial audit report. Section 10.554(1)(1)2., Rules of the Auditor General, requires our audit to include a review of the provisions of Section 218.415, Florida Statutes, regarding the investment of public funds. In connection with our audit, we determined that the City complied with Section 218.415, Florida Statutes, relating to local govemment investment policies. Section 10.554(1)(1)3., Rules of the Auditor General, requires that we address in the management letter any recommendations to improve financial management, accounting procedures, and internal controls. See Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls. Section 10.554(1)(i)4., Rules of the Auditor General, requires that we address violations of provisions of contracts or grant agreements, or abuse, that have an effect on the financial statements that is less than material but more than inconsequential. See Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls. Section 10.554(1)(i)5., Rules of the Auditor General, provides that the auditor may, based on professional judgment, report the following matters that have an inconsequential effect on financial statements, considering both quantitative and qualitative factors: (1) violations of provisions of contracts or grant agreements, fraud, illegal acts, or abuse, and (2) control deficiencies that are not significant deficiencies. During the course of the audit, no such matters were noted. Section 10.554(1)(1)6., Rules of the Auditor General, requires that the name or official title and legal authority for the primary govemment and each component unit of the reporting entity be disclosed in this management letter, unless disclosed in the notes to the financial statements. This information is disclosed in Note 1 of the City's financial statements. Section 10.554(1)(1)7.a., Rules of the Auditor General, requires a statement be included as to whether or not the local governmental entity has met one or more of the conditions described in Section 218.503(1), Florida Statutes, and identification of the specific condition(s) met. In connection with our audit, we determined that the City did not meet any of the conditions described in Section 218.503(1), Florida Statutes. Section 10.554(1)(i)7.b., Rules of the Auditor General, requires that we determine whether the annual financial report for the City for the fiscal year ended September 30, 2009 filed with the Florida Department of Financial Services pursuant to Section 218.32(1)(a), Florida Statutes, is in agreement with the annual financial audit report for the fiscal year ended September 30, 2009. As of the date of this letter the annual financial report for the City was not filed. Pursuant to Sections 10.554(1)(i)7.c. and 10.556(7), Rules of the Auditor General, we applied financial condition assessment procedures. It is management's responsibility to monitor the City's financial condition, and our financial condition assessment was based in part on representations made by management and the review of financial information provided by same. 2 Pursuant to Chapter 119, Florida Statutes, this management letter is a public record and its distribution is not limited. Auditing standards generally accepted in the United States of America require us to indicate that this report is intended solely for the information and use of the Honorable Mayor, members of the City Commission, management of the City, federal and state awarding agencies, pass -through entities and the State of Florida Office of the Auditor General, and is not intended to be and should not be used by anyone other than those specified parties. Miami -Dade County, Florida April 20, 2010 3 City of Miami, Florida Index of Current Year Findings Fiscal Year Ended September 30, 2009 Significant Material Finding Number Description Deficiency Weakness Control Deficiencies IC 2009-01 Bank Reconciliations X IC 2009-02 Recording of Accruals and Accounts Payable X IC 2009-03 Payroll Processing X IC 2009-04 Oracle Human Resources Management System Implementation X IC 2009-05 Filing For Grant Reimbursements X IC 2009-06 Capital Asset Management X Compliance CF 2009-01 Other Comments ML 2009-01 ML 2009-02 ML 2009-03 ML 2009-04 ML 2009-05 ML 2009-06 ML 2009-07 ML 2009-08 ML 2009-09 Excess of Expenditures over Appropriations Grant Receivables Interfund Transfers Pension Plans Password Settings IT Policies and Procedures IT System Trail Timeliness of Financial Reporting Fund Balance Reserve Requirements Procurement Code Violation 4 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 IC 2009-01— Bank Reconciliations Criteria: Internal control policies and procedures require timely monthly reconciliation, proper recording and disposition of reconciling items, and supervisory review of all bank accounts. Condition: We noted the following deficiencies as it relates to bank reconciliations: • Bank reconciliations for the main depository account for the months of March 2009 through August 2009 were not prepared in a timely manner. • The September 2009 main disbursement account bank reconciliation included $110,000 of voided checks as other reconciling items. These checks were voided prior to year end, but were not removed from the outstanding checks listing. Context: The finding is considered systemic in nature. Effect: Failure to adhere to intemal control policies and procedures requiring the timely reconciliation and supervisory review of bank accounts could result in material misstatements to the financial statements and/or misappropriation of resources. Cause: Lack of proper tools and resources necessary to ensure bank reconciliations are performed in a timely manner and reconciling items are properly treated. Recommendation: We recommend that management adhere to the policy which requires that bank account reconciliations be prepared and reviewed by a supervisor on a monthly basis. In addition, all significant reconciling items should be properly investigated, recorded, and disposed of in a timely manner. Views of Responsible Officials and Planned Corrective Action: The City is currently developing an Oracle Cash Management Reconciliation Report aimed at automating the bank reconciliation process. The reconciliation of the Main Depository account, in particular, is currently a very tedious and manually intensive. The Finance Department initially deployed the Reconciliation Report in January 2009, and suspended the manual reconciliation process for a couple of months. However, a number of issues were noted during the period the City attempted to utilize the Reconciliation Report. When it became clear that the Reconciliation Report needed further refinement, Finance pulled the Report back into development, and resumed the manual process to finish the pending reconciliations before the fiscal year-end. It should be noted that throughout first roll -out period of the Reconciliation Report, partial reconciliations were being performed on a timely basis to ensure all bank activity was properly accounted for in the general ledger. The delay, unfortunately, resulted in the reconciliations for the months of July and August being prepared in October and November, respectively. As the Reconciliation Report is still in development, the Finance Department has been performing the reconciliation process using the manual method to ensure timely completion of the Main Depository account's reconciliation. As part of the monthly reconciliation of the Main Disbursement account, the City had properly removed the voided checks referenced in the finding from its records. However, the voided checks were not removed from the bank's listing of outstanding checks. This final step in the voiding process, notification to the bank, was not completed timely. This has since been corrected and intemal procedures have been modified to ensure communication with the bank is completed immediately upon the voiding of a check. The City does not believe this will be an issue in the subsequent fiscal year. 5 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 IC 2009-02 — Recording of Accruals and Accounts Payable Criteria: Internal control procedures should be established and complied with that enable the proper and timely recording of liabilities under the accrual or modified accrual basis of accounting, as defined. Condition: We noted expenditures that should have been accrued at fiscal year end were not recorded in the accounting year end closing process. This condition was exacerbated as a consequence of the decentralized nature of some aspects of the City's accounting function. Context: $4.3 million of year end accruals. Effect: The City's year end liability balance could be materially understated. Cause: The cause is due to a breakdown in the system of controls, lack of effective supervisory oversight, and untimely submission of information by various City departments. Recommendation: We recommend that the City comply with its establish a process, whereby outstanding invoices that have not yet been approved and entered into the system for payment are analyzed, reviewed, and manually recorded for financial reporting purposes. In addition, a time schedule should be established that require all applicable departments to submit the necessary information to the finance department to accommodate for timely recording. Views of Responsible Officials and Planned Corrective Action: The City Departments are responsible for providing information to the Finance Department at year-end regarding goods and services that need to be accrued for at year end. The Finance Department prepares and communicates year-end closing policies and procedures to all departments to ensure invoices are approved and received timely to be properly accrued for at year-end. During fiscal year 2010, the City manager sent additional communications to departments stressing compliance with the stated policies. Several departments were not responsive which led to liabilities not being recorded timely. Better coordination between City departments is necessary to ensure all year- end invoices are submitted timely. The Finance Department will continue its efforts to obtain relevant year-end financial information on a timely manner. 6 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 IC 2009-03 — Payroll Processing Criteria: Organizations should have adequate internal controls to properly record, summarize, and report accounting transactions, including those associated with the payroll process, to provide reasonable assurance that the financial statements are not materially misstated. Condition: We noted the following matters within the payroll process: • Formal internal control policies and procedures have not been established requiring review and approval of the individual pay period's payroll register. There is no 'system trail" to evidence supervisory review and approval of the payroll registers for final payment. • Payroll registers are reconciled to the general ledger on a monthly basis however; differences that are identified during this process are not analyzed, investigated, and corrected. Context: The finding is considered systemic in nature. Effect: Increase risk of misstatement of the financial statements. Reconciling exceptions that could include unauthorized payments could go undetected. Cause: Formal internal control policies and procedures have not been established requiring the review of payroll transactions by supervisory personnel. Recommendation: We recommend the City establish formal intemal control policies and procedures requiring review and approval of all payroll transactions to ensure that transactions are properly reconciled to the general ledger, recorded, and reported in the financial statements. Views of Responsible Officials and Planned Corrective Actions: The City accepts the recommendations of the auditors. Subsequent to year-end, management of the payroll function was moved from the Employee Relations Department to the Finance Department. Of primary focus is the documentation of policies and procedures. This process will take some time to complete as the City contends with the challenges of the implementation, and therefore expects completion of policy and procedure documentation to extend beyond fiscal year 2010. By moving Payroll under the management of the Finance Department, there will be centralization of the general ledger and payroll functions, which will allow for better follow-through and resolution of differences identified during the reconciliation process, however, due to the challenges encountered with the implementation, the City expects correction of this finding will extend beyond fiscal year 2010. 7 City of Miami, Florida Appendix A - Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 IC 2009-05 - Filing for Grant Reimbursements Criteria: The City's intemal control system should be designed to ensure that claims for reimbursements are filed in a timely manner, soon after the incurrence and payment of qualified related expenditures. Condition: As of September 30, 2009 the City had not received reimbursements for approximately $35 million of qualifying reimbursable grant expenditures. $14 million of the $35 million have been outstanding greater than one year. The $35 million balance is comprised of the following amounts: Unbilled Balances Greater than One Year FEMA - In fiscal year 2006, the City recorded a receivable of $16.5 million for reimbursable hurricane - related expenditures. As of September 30, 2009, $7.9 million had not been collected/reimbursed from the grantor (over 48 months since the expenditures were incurred). Other Grants - Excluding the FEMA $7.9 million discussed above, the City had approximately $6.0 million of other amounts that had not been billed or submitted to the grantor for reimbursement as of September 30, 2009 (over 24 months since the expenditures were incurred). Unbilled Balances Less than One Year In addition to the above amounts, the City had approximately $21 million of grant expenditures that had not been billed or submitted to the grantor for reimbursement that were at least 60 days old as of September 30, 2009. Reasons for the delay in the receipt of grant funding are the result from the following deficiencies in administering the grant programs of the City: • Delay in the compiling and filing of proper documentation necessary to receive reimbursements. • Incomplete/improper reimbursement packages submitted to grantors, which were subsequently rejected. • In certain instances management has decided not to submit for reimbursement until certain capital projects are 100% complete, even though the grantors did not impose such restrictions on the City. • The City's grant management process is decentralized format which has resulted in ineffective oversight over grant administrators. Context: Condition was noted during the testing of grant receivable balances. Effect: The delay in requesting for reimbursements does have an adverse effect on cash flows and may affect the collectability of the amount due. Cause: Individual departments administering grants did not compile and file the proper documentation needed to receive such reimbursements after the incurrence and payment of a qualified related expenditure. Recommendation: We recommend that the City establish a control system to ensure that amounts expended are timely submitted for reimbursement, all required forms are compiled and prepared in the format prescribed by the grantor, and reimbursement packages are reviewed and approved by supervisory personnel. 9 City of Miami, Florida Appendix A - Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 Views of Responsible Officials and Planned Corrective Actions: The City agrees with the recommendation of the auditors. The City's grants and awards processes are decentralized. Each department assigns program managers to their grants who are responsible for filing reimbursements with grantors and liaising with the Finance Department for reporting purposes. The Finance Department will continue to strengthen relationships with those program managers to help ensure timely submission of financial information. Additionally, the fire department, which is associated with this finding, plans to request additional fiscal staff to be able to more timely reconcile, compile, and submit reimbursement requests to FEMA and UASI (grantors), and therefore reduce the duration of the related receivable balances. 10 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 IC 2009-06 — Capital Asset Management Criteria: Organizations are required to adopt adequate internal controls to properly record, summarize, and report accounting transactions, including those associated with the acquisition and disposition of capital assets, to provide reasonable assurance that the financial statements are not materially misstated. Condition: We noted the City's capital asset detail schedules required significant adjustments to remove amounts improperly capitalized. We also noted the following conditions relating to capital assets: • individual depreciable assets (buildings, equipment, improvements, etc.) were misclassified on the capital asset detail schedule as construction in progress (CIP) items, • reconciliation of CIP balances to the Oracle Capital Asset Module is not performed on a periodic basis. While the City had policies and procedures in place to account for capital assets, the internal controls requiring timely recording and review of capital asset related transactions did not function effectively. Context: The finding is considered systemic in nature. Effect: Capital assets represent a significant account balance for the City and improper accounting could result in a material misstatement of the financial statements. Cause: The cause is due to a breakdown in the system of controls resulting from lack of effective supervisory oversight and review of capital asset balances. Recommendation: We recommend the City adhere to its internal control policies and procedures to provide reasonable assurance that the following occurs on a routine basis: • prepare periodic reconciliations of CIP balances to the Oracle Capital Asset Module to ensure that all amounts are properly captured and reported in the financial statements, • capital asset inventory is performed at least annually, • review detail schedules on an ongoing basis to ensure that balances recorded are capital in nature and individual assets are properly classified on the capital asset detail schedules. Views of Responsible Officials and Planned Corrective Actions: The City agrees with the recommendation of the auditors. During fiscal year 2009, the City had been working through many issues encountered with the reconciliation of the Capital Improvement Program to the data in the Oracle system. The City was able to address many of the concerns from the prior year. Through the process of continuous improvement, the City believes it can continue to address the issues noted and mitigate the findings in future periods. 11 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 CF 2009-01 — Excess of Expenditures over Appropriations Criteria: Section 241(2) of Chapter 166 of the Florida Statutes provides that the goveming body of each municipality shall adopt a budget each fiscal year. The Statutes further state that "the budget must regulate expenditures of the municipality, and it is unlawful for any officer of a municipal government to expend or contract for expenditures in any fiscal year except in pursuance of budgeted appropriations." Condition: The following special revenue funds exceeded their budgetary authorization as of September 30, 2009: Fund Names Exceeded Budget Authorization General Special Revenue Departmental Improvement Initiatives Public Service Tax Parks and Recreation Services Economic Development and Planning Services $ 1,194,764 764,000 422,946 667,254 207,496 Effect: The effect is that the City is not in compliance with Section 241(2) of Chapter 166 of the Florida Statutes. Cause: The City did not amend the individual fund budgets to avoid exceeding budgetary authorizations. Recommendation: Section 241(3) of Chapter 166 of the Florida Statutes provides the authority for the City to amend the budget. The City should have amended the budgets to avoid exceeding budgetary authorizations. We suggest that, in the future, all budgets be monitored by the Budget Department to ensure compliance with Florida Statutes. Views of Responsible Officials and Planned Corrective Actions: The City accepts the finding and recommendation of the auditors. This condition happened because transfers out were included within the operating expenditure line item of the budget instead of as a separate line item. Budgets for all special revenue funds are appropriated as one lump sum number, however, the budget to actual schedules are prepared with line item information drawn from the Oracle system. The System information was not timely updated, and therefore resulted in the presentation of these line item discrepancies. All items, with the exception of the Public Service Tax (PST) Fund, did not exceed their budget authorizations in total. Regarding the PST Fund, a budget amendment was made at the close of the fiscal year, but the amount was not sufficient to absorb the excess expenditures. This oversight, which occurred in the closing process, will be avoided through more thorough review in future periods. Going forward, the Budget Department will be sure to separate the transfers out from the operating expenditure line item, as well as update the budget in the system, to more clearly present the true financial results. 12 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-01— Grant Receivables Criteria: Internal control require that the City has adequate systems in place to properly record, summarize, and report grant receivable balances on an ongoing basis to ensure that the financial statements are not materially misstated. Condition: We noted that management does not have a system in place to track grant receivable balances on an ongoing basis. We noted that receivables were not being liquidated at time of collection which resulted in improper revenue recognition. Effect: Increase risk of misstatement of the financial statements. Cause: Ineffective system in place to account for grant receivable balances and lack of oversight and review by supervisory personnel to ensure that grant receivable and corresponding revenue balances are properly stated. Recommendation: We recommend that the City establish a control system to ensure that grant receivable balances are monitored on an ongoing basis and are properly liquidated at time of collection. Additionally, client should prepare an aging analysis and determine if balances are properly recorded at their net realizable amounts. Views of Responsible Officials and Planned Corrective Actions: The City agrees with the finding and recommendation of the auditors. The City has subsequently implemented control procedures which will allow for proper recognition of receivables and revenues. Additionally, supervisory review and periodic monitoring will further ensure the control is working effectively. The City does not believe this finding will repeat in the subsequent fiscal year. 13 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-02 — Interfund Transfers Criteria: Internal control policies and procedures should establish a review and approval mechanism to help ensure compliance with applicable laws, agreements, and City ordinances, relating to interfund budgetary transfers. Condition: We noted that the City does not have a review or centralized process in place to ensure that proposed budgetary interfund transfer of resources are properly reviewed and approved for compliance with applicable laws, agreements, and ordinances prior to being presented to the City Commission for final authorization. Effect: Noncompliance with applicable laws, agreements, and City ordinances. Cause: The City does not have a formal independent review or process in place for proposed budgetary interfund transfer of resources before presentation to the City Commission for approval. Recommendation: We recommend that management adopt and adhere to a policy which requires that all amended budgetary interfund transfers of resources be subject to a supervisory review and approval before they are presented to the City Commission for final authorization. The supervisory review and approval should be performed by personnel knowledgeable of all applicable Taws, agreements, and City ordinances, in order to appropriately assess the validity and/or legal use of the proposed resources. Views of Responsible Officials and Planned Corrective Action: The City understands the concems and recommendations of the auditors, however, certain points about interfund transfers processing must be made. One of the Budget Department's functions is to determine amounts to be transferred between funds for funding City operations . These interfund transfers are included in the annual budget document brought before the City Commission for final approval. The Finance Department effects the interfund transfers as approved by the Commission. When modifications of transfer amounts are required, the Budget Department takes the lead. The degree to which the Budget Department confers and collaborates with other City Departments affected by changes to the transfers can be improved. This would make the proposed modified interfund transfers brought to the City Commission more comprehensively vetted. The City's Departments will work collaboratively with the Budget Department to ensure all future interfund transfers receive the appropriate level of scrutiny before being taken to the City Commission for final approval. 14 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-03 — Pension Plans Criteria: The City is required to accumulate assets and/or provide funding based on actuarial computations that will be sufficient to pay future benefits. Condition: The City is the sole sponsor for three defined benefit pension plans for its police officers, firefighters, and general employees. For the year ended September 30, 2009 the defined benefit pension plans collectively lost approximately $20 million in value relative to its plan assets. In addition, the net increase in the Pension Plans' unfunded liability, from that of the prior year, was approximately $391 million. Effect: As a consequence, the City as a sole sponsor has the fiduciary responsibility to fund the plans in order to make them financially capable to pay participant benefits in the current and future periods. Cause: Loss on the value of investments in the market. Recommendation: The City should perform a comprehensive assessment of its pension plans in order to determine their future viability and what the City's exposure would be with respect to its increased required contribution. Views of Responsible Officials and Planned Corrective Actions: The City concurs with the observation of the auditors. City Management has made several efforts over the last six years to address this growing problem. The City has engaged the services of an actuary and of outside counsel to assist with analyzing our options to amend the City's current Plans. The collective bargaining process has also been used as a vehicle with the unions to make compromises with limited positive results. Additionally, the City's ability to make meaningful changes to the Plans are controlled by a long-standing court order known as the Gates Settlement which resulted from lawsuit filed by employees against the City in the late 1970's. The issue continues to be an item of great concem to both management and the unions. The City will continue to bargain towards a structurally sound solution. 15 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-04 — Password Settings Criteria: IT system password setting should include complexity to ensure passwords are not easily guessed by others. Condition: Per inspection of password setting within the Oracle Active Directory, the setting "Password must meet complexity requirements" is disabled within Active Directory. Effect: Lack of complexity within password parameters may allow inappropriate or unauthorized access to critical IT systems. Cause: Management determined that enabling the password complexity setting on a global basis would have resulted in a high level of disruption to City employees ("forgetting" their password) and a general loss of productivity. For those reasons, complex passwords were not set. Recommendation: We recommend that the City enable the setting "Password must meet complexity" within Active Directory. Password complexity should include combinations between upper case, lower case, and numbers. Views of Responsible Officials and Planned Corrective Actions: While it would be a simple switch easily set, enabling this setting on a global basis is expected to cause a high level of disruption to City employees ("forgetting" their password), an increase in support calls to the ITD Helpdesk, and general loss of productivity — for those reasons, complex passwords were not set. Over the coming year, IT will phase -in complex passwords for "critical IT systems." There are a number of password policies which are (and have been) in effect requiring (1) passwords to be changed regularly, (2) new passwords to be different from the previous 6 passwords, and (3) passwords to be at least 6 characters in length. Additionally, we will increase the number City licenses for the Password Station product, funding permitted, to include all users in the automatic password reset facility now in use for approximately 500 users. 16 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-05 — IT Policies and Procedures Criteria: IT policies and procedures regarding logical access and data backups should be reviewed and updated, at least, annually. Condition: We noted that the IT policies and procedures were last updated in 2007. Effect: Outdated policies and procedures can lead to a process not addressing current security concerns and/or related inefficiencies due to the policies not keeping up with changing technologies and computing environments. Cause: Lack of timely review and update. Recommendation: We recommend that management review / update all IT policy and procedures on an annual basis. Views of Responsible Officials and Planned Corrective Actions: ITD Management concurs that policies should be reviewed annually. We are currently in the process of reviewing existing policies and updating as necessary. We expect to have completed the policy review by Fall 2010. 17 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-06 — IT System Trail Criteria: IT system trails should be set up and reviewed on a regular basis. Condition: Automatic alerts are not generated when changes to table fields occur in the Oracle HR & Payroll module. Effect: Absence of automated notifications can lead to unauthorized changes. Cause: Oracle has not been set up to generate automatic alerts when a change is made. Recommendation: Management should set up the automatic alert feature in the Oracle database and review changes to table fields on an ongoing basis. Views of Responsible Officials and Planned Corrective Actions: Changes made to the Oracle system are now recorded (with date and user), e.g., all salary changes are captured. Alerts have been implemented to ensure different levels of management are informed when changes are made in the system, e.g., financial approval/authority changes, salary changes exceeding 10%.These alerts are sent via email detailing the change made at different steps during the process. Furthermore, reports have been developed to show the status of the approval process at any point in time. Additional alerts will be added as necessary to enhance internal controls and we will investigate the optimum balance between audit trail history and storage utilization/cost. 18 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-07 — Timeliness of Financial Reporting Criteria: Chapter 18, Article IX, Section 18-542(10) of the City Code requires that the annual external audit reports (comprehensive annual financial report (CAFR), single audit, and management letter) be prepared and presented to the mayor and city commission by March 31st of each year. Condition: The year-end closing and preparation process was not performed in the time period to accommodate for preparation and issuance of the year-end CAFR in accordance with the due date established by the City Code. Effect: Management is not in compliance with the City Code. Cause: Untimely closing, reconciliation, and review of accounting records. Recommendation: We recommend that management adhere to control policies to ensure that the annual external audit reports are prepared and presented to the mayor and city commission by March 31st of each year. Views of Responsible Officials and Planned Corrective Action: The City relies on the individual audits of its discretely reported and blended component units in order to include the information in the City's CAFR as required by GAAP and GASB. During the current fiscal year, the audited financial statements of three component units were significantly late which delayed the finalization of the City's financial statements. In the subsequent fiscal year, the City will further work with all component units to ensure timely submission of their financial statements in order to not jeopardize the completion of the City's financial statements. 19 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-08 — Fund Balance Reserve Requirements Criteria: Chapter 18, Article IX, Section 18-542(5)(c) of the City Code requires that the City retain reserves equal to ten percent of the prior three years average of general revenue. Such reserves shall be used for funding long-term liabilities and commitments of the City. Condition: We noted the following instances of non-compliance with the City Code as it relates to fund balance reserve requirements: • Fiscal year 2009 designated reserve fund balance totaling $24,851,397 is $22,275,269 less than ten percent of the summation of the prior three years general revenues average totaling $471,266,662. • Fiscal year 2009 undesignated reserve fund balance is $0, this does not meet the required threshold of ten percent of the summation of the prior three years general revenue average total of $471,266,662. Effect: Management is not in compliance with the City Code. Cause: Lack of effective oversight and planning by management. Recommendation: We recommend that management review and improve budgetary practices which will help to increase fund balance reserves in future periods and allow compliance with the City Code. Views of Responsible Officials and Planned Corrective Action: The City agrees with the recommendation of the auditors. The Financial Integrity Principles acknowledge the fact that the City may fall below the required fund balance levels and provides for it. Once the fund balance of the general fund falls below the required level, the City must provide the City Commission with a repayment/replenishment plan that will bring the City's fund balances to the require levels. The City is currently developing said plan and will be presenting it to the City Commission for approval. 20 City of Miami, Florida Appendix A — Current Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2009-09 — Procurement Code Violation Criteria: Chapter 18, Article III [City of Miami Procurement Ordinance], provides the manner in which the City should control the purchase of materials, supplies, equipment and services. The procurement ordinance (Section 18 — 72 therein) stipulates that regardless of the source of funds, including state and federal assistance, all purchases or procurement must follow the provisions of the procurement code except as exempt under section 18-72(b). Excluded services should be purchased using quick invoices and paid via a direct payment to the vendor or service provider. Condition: We noted that a department within the City procured cellular phone service and made equipment lease payments using the direct payment method instead of a required purchase order. The City maintains an existing contract with each service provider/vendor from which services/goods were procured. Purchase orders are required for each purchase where a contract exists. Effect: The lack of adherence to internal control procedures over purchasing could result in material purchases being made without proper authorization, misappropriation/loss of City's assets, and/or incurrence of expenditures in excess of the adopted budget. Cause: Failure by management to follow the City's procurement policy. Recommendation: We recommend that management adhere to the City's procurement policy and use purchase orders when required. Views of Responsible Official and Planned Corrective Action: The City agrees with the finding and recommendations of the auditors. The City has subsequently implemented control procedures which will ensure proper procurement of City services. Additionally, supervisory review and periodic monitoring will further ensure the control is working effectively. The City does not believe this finding will repeat in the subsequent fiscal year. 21 City of Miami, Florida Appendix B - Status of Prior Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 Finding # Finding Title Status Other Explanation Findings related to financial statements: IC 2008-01 Signficant Issues Documentation IC 2008-02 Bank Reconciliations IC 2008-03 IC 2008-04 IC 2008-05 ML 2008-01 Grants Management Filing for Grant Reimbursements Capital Asset Management Payroll Accrual System ML 2008-02 Recording of Payroll Accruals ML 2008-03 Pollution Remediation ML 2008-04 Pension Plans ML 2007-01 Payroll ML 2007-04 Transfers of Completed Projects from CWIP ML 2007-05 Employee Cross Training ML 2007-06 System Access Security ML 2007-07 ML 2006-15 ML 2004-12 ML 2003-02 ML 2001-03 ML 2000-07 System Access Security— HRIPayroll Component Units Succession Planning Payroll Audit Trail Report Time Recording -Overtime Logical Security 22 Corrected Certain Corrective Action Taken Corrected Not Corrected Not Corrected No longer relevant Corrected No longer relevant Not Corrected No longer relevant Corrected Certain Corrective Action Taken No longer relevant Corrected Corrected No longer relevant No longer relevant No longer relevant No bnger relevant See current year finding IC 2009-01. See current year finding IC 2009-05. See current year finding IC 2009-06. City implemented Oracle Human Resource Management System in 2009. GASB 49 was adopted in 2009. See current year finding ML 2009-03 City implemented Oracle Human Resource Management System in 2009. Repeated in the current year. See ML 2007-05. City implemented Oracle Human Resource Management System in 2009. City of Miami, Florida Appendix B — Status of Prior Year's Recommendations to Improve Financial Management, Accounting Procedures and Internal Controls Fiscal Year Ended September 30, 2009 ML 2007-05— Employee Cross Training Criteria: An effective organization structure encourages growth and change, and contributes to the ability of an organization to attain its mission even when employees terminate or are on vacation. Condition: When certain employees of the City were absent, no other employees in the department could provide the information nor were cross trained to handle that person's job responsibilities during his or her absence. For example, only one person is trained/knowledgeable on how to convert and summarize payroll transactions for posting into the general ledger. Only one person in finance is knowledgeable regarding the Grants Management Module. In the Housing Department only one person has knowledge on all the various systems used. For debt transactions, only one person analyzes and posts transactions to the general ledger. Certain other areas such as preparation of the year end schedule and adjustment for capital assets or compensated absences are prepared by one individual without reviewed. Effect: The City might not have operational continuity or effectiveness when employees are terminated or on vacation. Cause: Lack of cross training of personnel within departments. Recommendation: We recommend that employees be cross trained within the departments so that if someone is absent or terminated, the organizational mission or job responsibilities of that department can continue. Views of Responsible Officials and Planned Corrective Actions: The City of Miami recognizes the need to cross train employees within all departments. There are many departments within the City of Miami where cross training has already taken place. The City of Miami will implement an action plan to facilitate cross training in those departments where staffing levels make cross training a very difficult task. 23