HomeMy WebLinkAboutCAO-2023-284 - 2nd Quarter Audit Status ReportStaff Report
Chief Administrator's Office
REPORT TO: Audit Committee
DATE OF MEETING: June 26, 2023
SUBMITTED BY: Corina Tasker, Internal Auditor, 519-741-2200 ext. 7361
PREPARED BY: Corina Tasker, Internal Auditor, 519-741-2200 ext. 7361
WARD(S) INVOLVED: All
DATE OF REPORT: June 15, 2023
REPORT NO.: CAO -2023-284
SUBJECT: 2nd Quarter Audit Status Report
RECOMMENDATION:
For information.
www.kitchener.ca
REPORT HIGHLIGHTS:
• The purpose of this report is to provide information regarding recent audits.
• There are two audits included in this report: 1) Petty Cash and Floats; and 2) Facility
Bookings and Risk Assessment Program Review.
• Results of the audits were positive, with no fraud detected. However, opportunities for
improvement have been identified.
• There are no financial implications.
• Community engagement included this report posted to the city's website with the agenda in
advance of the council / committee meeting.
• This report supports the delivery of core services.
EXECUTIVE SUMMARY:
The following report provides a summary of the Internal Audit assurance and consulting services
completed during the period of April to June 2023. The table below shows the audits contained
in this report.
/
Petty Cash and Floats Controls audit
Facility Bookings and Risk Assessment Program review
Assurance work is in progress on the following topics:
• Accounting controls
Consulting work is in progress on the following reviews:
• Training Documentation - process review
The results of the petty cash and float controls audit show that cash floats are generally well
protected by being stored in safes or point of sale machines. Throughout the pandemic there
*** This information is available in accessible formats upon request. ***
Please call 519-741-2345 or TTY 1-866-969-9994 for assistance.
Page 238 of 264
was a lot of staff turnover with limited cross -training provided on proper reconciliation
procedures which led to some areas with incorrect (over or short) float balances. However,
staff are now all aware of the proper procedures and will endeavor to ensure cash is reconciled
regularly. The implementation of SAP Concur has greatly decreased this risk as petty cash is
only used in a few instances. With the exception of a large discrepancy in the Parking float, all
other variances were very small and there are no suspicions of theft. The Parking float
shortage is likely due to funds located in the parking machines, which will be reconciled as the
new parking system is implemented.
In June 2022 a new online facility booking inquiry form and risk assessment process were
launched. The original intent of implementing this process was to facilitate an automated risk
assessment process to ensure no stakeholders were left out of the process, and that input
could be sought earlier in the booking process in order to mitigate safety and financial risk to
the corporation.The results of the facility booking and risk assessment program review indicate
that the new online inquiry form and risk assessment process for events at City facilities have
generally had a neutral to positive impact on staff and customers, however, more can be done
to fine-tune the program to be even more effective. Moving the facility booking process online
through the form and webpage information is a positive and required step for customer
satisfaction in today's digital environment. However, improvements can be made to the
original solution to streamline the process and provide a better customer experience. The risk
assessment process requires some analysis to refine which groups truly need to be involved to
mitigate risk. This first iteration of a solution to solve the problem identified by Public Safety
Canada stands as a solid foundation to build upon with further continuous improvement.
BACKGROUND:
The overarching goal of internal audit is to protect the City's assets and interests. This
includes, but is not limited to, protecting the long-term health of the organization, its financial
and physical assets, its reputation, its ability to perform critical services and the safety and
well-being of employees and citizens.
Internal Audit provides assurance and consulting services in accordance with the International
Standards for the Professional Practice of Internal Auditing (Standards), IIA 2012. These
services are independent, objective activity designed to add value and improve an
organization's operations. It helps an organization accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve the effectiveness of risk
management, control, and governance processes.
Assurance services provide an objective assessment of evidence to provide an
independent opinion or conclusions regarding an entity, operation, function, process,
system, or other subject matter.
• Consulting services are advisory in nature and are generally performed at the specific
request of an engagement client. When performing consulting services, the internal
auditor should maintain objectivity and not assume management responsibility.
Audit topics are selected independently by the Internal Auditor and approved by Audit Committee
on an annual basis. Audit results are brought back to Audit Committee in reports such as this on
a quarterly basis as completed.
Page 239 of 264
REPORT:
1. Petty Cash and Floats - Controls Audit
Completed. June 12, 2023
Background:
Employees are empowered to purchase goods and services on behalf of the City of Kitchener
to perform their jobs. For purchases <$3000 they can do so through using a corporate VISA
card if they have one, or by using their own funds and being reimbursed through SAP Concur.
In rare cases, employees without access to SAP are able to use petty cash (for <$100). Prior
to the implementation of SAP Concur in 2020, payments were made through cheque
requisition.
With the implementation of SAP Concur for employee expenses in 2020, most locations no
longer have a need to have a petty cash float as all staff who have an employee email account
must use Concur to be reimbursed. Most areas still retain a change float for their point of sale
(POS) machines which are topped up from sales prior to making revenue deposits, with any
over or under variances being noted on the deposit.
Throughout the pandemic there was a lot of staff turnover with limited cross -training provided
on proper procedures. Reports of theft or missing funds increased, and it was found that
controls were lacking in some areas.
Audit Objectives:
The objective of this review is to physically confirm that petty cash and float balances are
correct and that the cash is adequately protected from theft. A secondary objective is to test
any petty cash vouchers and associated backup / receipts to ensure compliance with policy.
Scope and Methodology:
This audit included the following activities:
• Unannounced physical count of petty cash and float balances for twenty-nine locations
• Review of safe procedures and controls
• Testing vouchers and backup (if any) against the following criteria:
o Voucher was authorized by the appropriate person, and the custodian and
person receiving the cash signed in the appropriate spot on the voucher
o Business reason for the expense was provided
o No alcohol or tobacco was purchased
o No personal items / loans / cashing of personal cheques
o Original receipts attached
Findings:
Petty Cash
There are only four petty cash floats remaining at City locations. They are used for the
following reasons:
Page 240 of 264
• KOF — to reimburse staff for doctor's notes for those outside staff without a City email
address
• Parking — 5t" floor City Hall — to provide refunds for transponder deposits; note that this
will no longer be required when the new parking system is installed which does not
require a transponder nor a deposit
• Market — to purchase program supplies (groceries) from market vendors that only
accept cash, and to reimburse vendors for market dollar vouchers
• The Aud — to reimburse expenses for temporary or part-time event staff without a City
email address
There were no issues with the KOF and Aud petty cash floats. Both were properly secured
and balanced to the correct total. The Market and Parking petty cash floats had more cash
than expected. It is expected that these floats will be balanced the next time they are topped
up.
Two of the Parking petty cash vouchers did not have receipts, none had an authorized
signature, and the balance had not been reconciled in several months. Staff were instructed to
ensure it is now balanced monthly going forward and that all vouchers have receipts attached.
As noted above, this will no longer be required when the new parking system is implemented.
Floats
There are thirty-one change floats across twenty-six locations. All floats were locked in a safe
or POS machine with the exception of one float which was left in an unlocked drawer. Twenty-
one floats balanced, four were short money and six had excess money.
Except for two parking floats, the other discrepancies were small dollars. The parking floats
were short by a total of $14,694.88. While staff were regularly counting the floats and recording
the denominations, they were unaware that this should balance to a particular number and
were thus not indicating any over / short in their deposits. In addition, it is suspected that a
substantial portion of the shortage is within the parking machines and may balance. There is
evidence from previous audits that this is the case.
Once the implementation of the new parking system is complete, staff will work to determine
how much float is in the machines and develop a process to reconcile to the float total on a
regular basis, monthly at a minimum. Staff will report back to the Auditor in July when that has
been completed.
There were various changes to the float custodians, approvers and amounts noted and shared
with Finance staff. Three floats were also deemed to no longer be required and will be
returned to Finance.
Actions:
The following actions have been or will be taken to address issues noted above:
• Accounting has been informed to make all required custodian, approver, and amount
updates to their main list.
Page 241 of 264
• Accounting will ensure the three floats that are no longer needed are deposited
properly.
• Procedures have been changed to ensure all floats are secured at all times.
• Parking will work to reconcile their floats and petty cash and establish a monthly
reconciliation process going forward.
Conclusion:
The results of this audit show that cash floats are generally well protected. There were no
large discrepancies (except for Parking) or suspicions of theft. Throughout the pandemic there
was a lot of staff turnover with limited cross -training provided on proper procedures. However,
staff are now all aware of the proper procedures and will endeavor to ensure cash is reconciled
regularly. The implementation of SAP Concur has greatly decreased this risk as petty cash is
only used in a few instances.
This audit will continue to be part of the rotating list of standard controls and compliance
audits.
2. Facility Booking and Risk Assessment - Program Review
Completed. June 8, 2023
Background
In June 2022 a new online facility booking inquiry form and risk assessment process were
launched. The original intent of implementing this process was to facilitate an automated risk
assessment process to ensure no stakeholders were left out of the process, and that input
could be sought earlier in the booking process in order to mitigate safety and financial risk to
the corporation.
At the time Council requested a follow-up report at the end of the year. After six months of use
staff and customers were surveyed to determine the effectiveness and impact of the new
process and tools and identify further areas for improvement. In addition, program data was
collected and analyzed. The following is a summary of the responses, data, and related
recommendations which have been shared with staff responsible for the process.
Review Objectives
The overall goal of this review is to assess the effectiveness and impact of the new facility
booking and risk assessment process and to identify further areas for improvement.
Scope
The following areas are within scope for this review:
• Staff and customer feedback related to the new process and tools after approximately 6
months of use
• Recommendations for further improvements
The following is out of scope:
• Implementation of recommendations
Page 242 of 264
Methodology
The following activities were completed as part of this review:
• Survey of internal facility host staff
• Survey of internal risk assessors
• Survey of technical support staff
• Customer experience surveys for customers using the online inquiry form between
January 19 and February 16, 2023
• Review of booking data to date
Findings
Booking Data and Volumes
Since inception in June 2022 until March 2023, there have been 2184 facility booking inquiry
forms submitted. Of those 48% or 1055 have not resulted in a booking. The remaining 52% or
1129 were in various stages of completion, while 415 events were booked or completed. In
terms of type of events and preferred venues, the majority of inquiries are for birthday parties
at community centres.
Council was specifically interested in knowing how many Indigenous events were booked and
had received the new fee waiver. The data showed that there were two Indigenous events
booked through the new form, one of which is complete, and one is in progress. There were
also six ongoing Indigenous groups with seventy-five individual bookings which were set up
prior to the inquiry form implementation. The total fee waiver of all Indigenous bookings in
2022 was $18,908.
Risk Assessment Analysis
Data from the risk assessment tool was analyzed to determine the effectiveness of the
process. There have been 474 events that were directed to one or more risk assessors (City
staff in various roles), depending on the attributes of the event, resulting in 949 risk
assessment requests in total.
Risk assessors have the ability to mark the assessment as complete or indicate that it is not
applicable, meaning it may have been sent to them in error and system adjustments may be
required. Comments should be input for either response and they are required to respond
within two business days. If the inquiry form is cancelled by the event host prior to completion,
then the status will change to cancelled. A blank status indicates that the risk assessor took
no action.
The data shows that only 14% of total assessments were completed, while 44% had no
response. This may be because the majority of risk assessment requests are directed to
Custodial, and Parks & Cemeteries staff, in order to schedule staff to clean the area before or
after the event, and don't require a risk assessment. There is an opportunity to streamline the
process further to notify these staff in some other manner rather than involving them in the risk
assessment process.
Page 243 of 264
A review of the comments provided by staff risk assessors shows 31 % had comments. Of
those comments, a small amount provided instructions or required actions to be taken. The
rest of the comments simply indicated that no action was required, which is also a helpful
confirmation to the event host. There may be opportunities to streamline to eliminate some of
these requests if they truly are not required though.
The time from receipt of the risk assessment request until submission of the comment was
also calculated based on time stamps on the records. The average response time was 1.5
days.
Event Hosts
The majority of staff feel the online intake form is an improvement, mainly because it collects
most of the required information all in one spot, which decreases much of the time going back
and forth with the customer to gather the information. There were several recommendations for
improvements to the form which included the addition of fields to gather more information,
formatting changes, and better instructions. CSD Administration staff should consider these
suggestions and work with staff to update the form where feasible.
Adding facility booking information to the City website has been only moderately successful in
decreasing inquiries regarding pricing and room capacities. The largest problem seems to be
confusion around costs in addition to the hourly room rental price. Revised wording should be
considered as well as adding pictures of all rooms and the ability to see room availability.
The website information has driven more bookings in some areas. For example, inquiries and
confirmed bookings for the Williamsburg Dedication Centre has increased since
implementation of the website.
47% of facility hosts feel that risk assessors are not responding in a timely manner, causing
staff to either wait, spend time following up, or putting the corporation at risk by not waiting for
the risk assessment. As noted above, the data shows that the average response time is 1.5
days, however. This process should be revisited with the risk assessor group to see what is
impeding the assessors who are taking more than the 2 -day limit and which risk assessments
are truly needed. However, the majority of event hosts do find the comments provided by risk
assessors to be helpful.
About half of the staff feel that this new process has both decreased lead time for the customer
and decreased the amount of staff time spent on rentals. However, there is an equal amount
who feel this is more cumbersome and time consuming. Improvements to the process are
required to streamline the staff processing time while still providing the required data to the risk
assessors.
Risk Assessors
Most risk assessors indicated they are able to complete their assessments very quickly, which
is supported by the data. There does not appear to be as much benefit to the risk assessors as
was originally intended. Although it does automate the process and ensure all risk assessors
are in the loop, several have not received any requests yet, and the majority of requests are
low risk, resulting in no feedback from the risk assessors.
Page 244 of 264
Technical Support Staff Feedback
Staff who support the use of the inquiry form, webpage, and risk assessment tool felt that
having a single form for all facility types was beneficial for the customer and that the risk
assessment tool was simple to maintain. They noted, however, that the online form is
becoming prohibitively difficult to maintain due to its complexity and have recommended
alternative software to explore for future iterations of this program.
Customer Feedback
Customer feedback was gathered through the Customer Satisfaction Program from January 19
— February 16, 2023. After submitting the online inquiry form customers were prompted to fill
out a separate survey about their facility booking experience. 76% of customers felt the form
was easy or very easy to fill out. 77% of repeat customers found the form easier than the
previous process of phoning or emailing their preferred venue(s). Overall, 73% were satisfied
or very satisfied with the process. Areas for improvement include faster response times by
staff, showing pictures of venues and current availability on the webpage, and clarifying how to
book ice time.
Recommendations
The results of this review indicate that the process and tools have generally had a neutral to
positive impact on staff and customers, however, more can be done to fine-tune the program
to be even more effective. The online form is a positive change from the previous process
from both staff and customer perspectives and could be modified further to be more effective.
The web page has not had as much impact as hoped but could be improved by adding more
information including venue availability. The risk assessment process is seen as time
consuming but does provide some benefit in automatically including all the relevant
stakeholders
It is recommended that the CSD Manager, Service Coordination and Improvement complete
the following:
• Consider the suggestions for improvement to the website to ensure the information for
the public is as clear as possible.
• Consider the suggestions for improvement to streamline the form and make it easier to
fill out for customers.
• Meet with risk assessors to determine if there are some which can be removed from the
workflow if this is not providing value.
• Review the criteria for sending the risk assessments to each risk assessor to determine
if changes are required.
• Meet with event hosts to review their concerns and how/ if they will be addressed.
Brainstorm ideas for possible exemptions from the risk assessment process, i.e., are
there types of events which are low risk and could be removed from the workflow such
as birthday parties at community centres.
• Explore with Technology Innovation and Services (TIS) staff / Activenet staff the
possibility of adding a calendar with available times to the website. (This was explored
previously but was not possible at the time but may be viable now).
• Work with TIS staff to explore alternative software for housing the form and data
(Dataverse / Power Platform), including requesting budget to support this.
Page 245 of 264
Conclusion
Moving the facility booking process online through the form and webpage information is a
positive and required step for customer satisfaction in today's digital environment. However,
improvements can be made to the original solution to streamline the process and provide a
better customer experience. The risk assessment process requires some analysis to fine tune
which groups truly need to be involved to mitigate risk. This first iteration of a solution to solve
the problem identified by Public Safety Canada stands as a solid foundation to build upon with
further continuous improvement.
STRATEGIC PLAN ALIGNMENT:
This report supports the delivery of core services.
FINANCIAL IMPLICATIONS:
Capital Budget — The recommendation has no impact on the Capital Budget.
Operating Budget — The recommendation has no impact on the Operating Budget.
COMMUNITY ENGAGEMENT:
INFORM — This report has been posted to the City's website with the agenda in advance of the
council / committee meeting.
PREVIOUS REPORTS/AUTHORITIES:
• CAO -2022-494 2023 Internal Audit Work Plan
APPROVED BY: Dan Chapman, CAO
ATTACHMENTS:
None
Page 246 of 264
Cr1l"ll I'll , IM, -
ACY-2021-284,
2ND QUARTER AUDIT STATUS
REPORT
Page 247 of 264
Completed:
v1 Petty cash and floats — controls audit
✓Facility booking & risk assessment
review
In progress:
LJAccounting controls audit
LJTraining documentation review
- program
Page 248 of 264
PETTY CASH AND FLOATS
Page 249 of 264
Objectives:
• To confirm petty cash and float balances and
that cash is adequately protected from theft
Scope:
• All 29 City locations which have petty cash or
floats
Page 250 of 264
9
• Surprise cash counts
• Review of safe procedures and controls
• Testing petty cash vouchers where applicable
Page 251 of 264
R,
• Only 4 locations with petty cash
• 2 were balanced correctly
• 2 had more cash than expected
• Parking vouchers not filled out correctly
Page 252 of 264
• 30 of 31 floats securely locked
• 3 floats no longer required
• 21 floats balanced exactly
• 4 were short money
• 6 had excess money
• Parking float short $15K
— Likely in parking machines
—Will reconcile as new system installed
Page 253 of 264
• Update list of floats (names, amounts)
• Ensure 3 unneeded floats deposited
• Secure all floats
• Reconcile Parking floats / petty cash and
establish process
Page 254 of 264
FACILITY BOOKING & RISK
ASSESSMENT PROGRAM REVIEW
Page 255 of 264
Page 256 of 264
• Internal surveys
— Facility hosts
— Risk assessors
—Technical support staff
• Customer experience surveys
• Review of booking data
Page 257 of 264
9
• June 2022 to March 2023:
• 2184 booking inquiry forms
• 48% did not result in a booking
• Majority of inquiries are for birthday parties at
community centres which are typically low risk
• Indigenous events, January to December 2022:
• 2 events booked through the new form
• 6 ongoing events (with 75 individual bookings) booked
prior to the new form
Page 258 of 264
• $19K total fee waiver
• 949 risk assessment requests
— 44% had no response
— 14% complete
• Majority of risk assessment requests sent to
Custodial or Parks & Cemeteries
— No comments required
— Sent as information
• Opportunity to streamline the logic
Average response time 1.5 days
Page 259 of 264
• Online form collects information in one spot
• Suggestions to improve the form
• Website should include pictures, prices,
availability
• Dissatisfaction with risk assessor response
time
• Half feel new process decreases lead time and
staff time spent on rentals
Page 260 of 264
• Most are able to complete the assessments
quickly
• Like that it automatically routes events to the
correct stakeholders
• Not as many requiring their input as first
thought
Page 261 of 264
• Single form is beneficial to the customer
• Risk assessment tool easy to maintain
• Form is hard to maintain due to complexity of
logic
• Recommend exploring alternative software in
future iterations
Page 262 of 264
• 76% feel form is easy to fill out
• 77% of repeat customers feel the form is easier
than the previous process of emailing or phoning
• 73% of customers satisfied overall with the
process
• Faster response time
• Pictures of venues on webpage
• Availability on webpage
Page 263 of 264
• Consider improvement suggestions for the
form and webpage
• Review risk assessment criteria
• Review facility host concerns / brainstorm
solutions
• Explore adding facility availability to webpage
• Explore alternative online form software
Page 264 of 264