Introduction

Background

The Quick Pay (QP) Voucher process allows an agency to process invoices electronically which do not exceed a limit stated by the Office of the State Comptroller (OSC). The limits used during the audit period April 1, 1998 through March 31, 1999 were $2,500 for vendor payments and $500 for employee travel reimbursement. The QP voucher process is designed to increase efficiency in processing invoices that do not exceed the limits, while maintaining an effective OSC pre-audit of these payments. Streamlining the process for high volume, low dollar payments benefits both State agencies and OSC.

In the New York State Education Department (SED), the Bureau of Fiscal Management (Bureau) is responsible for processing QP vouchers. The Bureau uses a two-step process to enter data into OSC's Central Accounting System (CAS). The first step is the QP Voucher Entry/Correct process, which is online entry of voucher information about the goods and services being purchased. The second step is online certification of the QP voucher batches by finance officers/designates. With the CAS, OSC can pre-audit the "electronic voucher" and issue a check as early as the next day without requiring batches of paper vouchers and invoices.

OSC has allowed SED to increase its respective QP voucher limits to $2,500 for vendor payments and $500 for employee travel reimbursement, subject to the following conditions:

· an audit of the QP voucher process must be completed annually and the final report issued must be provided to OSC;

· OSC retains the right to continue normal pre-audit and post-audit responsibilities; and

· OSC retains the right to reduce or terminate the QP authority to SED should OSC become aware of any operating deficiencies or other circumstances that, in the opinion of OSC, warrant such action.

Objectives, Scope, and Methodology

Pursuant to OSC's Procurement and Disbursement Guidelines, Bulletin No. G-158 and G-179, the audit included a review of the internal controls, security and procurement practices for QP transactions. We audited selected management practices, records, and documentation supporting QP payments and our objectives were to:

· evaluate the adequacy and effectiveness of SED's system of internal control for the QP voucher process;

· determine if costs are adequately supported;

· determine if procedures are in effect to insure that all source documents are properly secured, controlled, and can be accounted for;

· determine that expenses are properly reported to OSC on the CAS in accordance with applicable guidelines and regulations; and

· obtain an understanding of the procedures to prevent the unauthorized use or the misuse of the terminals in the data entry and certification activities.

To accomplish our objectives, we reviewed applicable laws, regulations, policies and procedures; interviewed SED management and staff; examined records and supporting documentation; and sampled transactions on a statistical basis. We conducted our audit in accordance with Government Auditing Standards issued by the Comptroller General of the United States. These standards require that we plan and perform the audit to obtain reasonable assurance that the internal controls, security and procurement practices for the QP transactions are accurate.

An audit includes examining, on a test basis, evidence supporting transactions recorded in the accounting and operational records, and applying such other audit procedures as we considered necessary in the circumstances. An audit also includes assessing the estimates, judgments and decisions made by management. We believe that the audit provides a reasonable basis for our findings, conclusions and recommendations.

Comments of Fiscal Management Officials

Fiscal Management officials generally agreed with the findings and recommendations contained in this report. However, they do not believe the report supports a recommendation to improve password security. Their written response is included as Appendix B to this report.

Report on Internal Controls

The Standards for Internal Control in New York State Government, issued by the Office of the State Comptroller, identifies five components as internal control standards. These components are; Control Environment, Communication, Assessing and Managing Risk, Control Activities, and Monitoring.

As part of the audit, staff were interviewed; the QP voucher process was documented, and policies and procedures, applicable laws, rules and regulations were reviewed in order to perform a preliminary assessment of the internal control system. Following our assessment, various tests were performed to ensure that the internal controls identified were in place and functioning as intended.

Control Environment

The control environment in the Bureau is adequate. Written procedures exist for the payment of claims. The written procedures include the State Procurement Guidelines, OSC rules and regulations, and internal procedures. The Bureau operates under the OSC recommended standards for the separation of duties for staff requiring more than one employee to be involved in the payment of a claim. Training is provided, staff turnover is low, and management has indicated that they would be quick to take action in the event of employee misconduct.

Risk Assessment

Management has reviewed the risks associated with the payment process and identified the following risks:

· If strong internal controls are not in place and or procedures are not followed, SED could potentially face the loss of its QP authority.

· Loss of this ability could result in a delay of payments. As a result, a loss of vendors could result and additional interest charges may be incurred under the prompt payment provision of the State Finance Law.

· With a QP authorization of up to $2,500, misuse of the system could result in the loss of assets and/or theft of goods or money.

Control Activities

Control activities within SED begin with the processing of a purchase requisition and the preparation of a travel authorization. Written procedures exist for every step in the purchase/payment process including the preparation, approval, processing and payment. The procedures reflect OSC, OGS and SED rules, regulations and guidelines. Additional controls exist in the levels of approvals required for processing at each step and include a separation the duties.

Control over the computer system exists in the form of limited access to terminals and the assignment of unique passwords with limited authority to various employees, depending on the requirements of the job. Passwords are changed at six-month intervals.

Information and Communication

The information and communication system within SED consists of methods and records established to identify, capture and exchange information in a form and time frame that enables staff to carry out their responsibilities effectively. The information systems consist of reports produced on a daily, weekly and monthly basis. Communications systems within SED allow for the free flow of information and the ability of staff to bring potential problems or abnormalities to supervisory personnel. Supervisors are encouraged to work together to resolve problems and issues. Management holds periodic meetings with staff to discuss the status of the Bureau and problems that are occurring.

Monitoring

Monitoring of the QP voucher process is an on-going function in the Accounts Payable and Travel units, and begins when the clerk audits the invoice/voucher and data enters the information into CAS. The certification process is achieved through a two-step process. The Principal Account Clerk(s) or Calculations Clerks(s)II of the Accounts Payable & Travel units sign the QP vouchers after a review to certify that the data entry was accurate. The Principal Account Clerk(s) review the vouchers to assure that they have been approved and signed by the appropriate unit and to certify the QP vouchers on CAS for payment. At any point in the process, all staff involved in the process are able to ask for additional information and/or reject a voucher.

In addition, pursuant to OSC Bulletins G-158 and G-179, SED has conducted a yearly audit of the QP voucher process beginning in 1996.

Conclusion

Following our preliminary assessment of the internal control structure, we performed various tests of the process to determine if the internal controls previously identified were functioning as intended. As shown in the next section of this report, although an adequate system of internal controls exists, we identified instances where it was not functioning as intended.

Compliance with Laws, Regulations, and Policies

Management is responsible for ensuring compliance with laws, regulations and policies, and for establishing and maintaining systems of internal controls. The objectives of these systems are to provide reasonable assurance that assets are safeguarded against loss from unauthorized use or disposition, and that transactions are properly authorized and recorded to permit the preparation of financial reports in accordance with generally accepted accounting principles, applicable laws, regulations and policies.

The New York Code of Rules and Regulations, Volume 2 (Audit and Control) Part 21 "Quick Pay Voucher Payment System" states in section 21.5 that Internals Controls must include the following:

(a) separation of duties relating to ordering, receiving and payment functions;

(b) separation of on-line data entry and certification functions; and

The audit found that supporting documentation was always available, however there were instances of data entry being performed by a certification operator, batches being entered and certified by the same individual, and batch certification being done when time sheets indicated the individual was not at work.

Supporting Documentation Attached

A sample of 140 QP vendor vouchers and 71 QP travel vouchers were selected for review from the period April 1, 1998 and March 31, 1999. The audit found no material errors in the supporting documentation or calculation of QP vouchers' totals.

The audit determined that the Bureau is in compliance with all material aspects of OSC's Procurement and Disbursement Guidelines, Bulletin No. G-158 regarding the retention of supporting documentation and the accurate calculation of voucher totals.

Data Entry of Quick Pay Performed by a Certification Operator

OSC's Bulletin No. A-266 states that any person who has a Certification Operator ID cannot also perform QP data entry.

The audit found that, of the 34,723 vendor vouchers processed during the period April 1, 1998 through March 31, 1999, 492 (1.4 percent) of the QP vouchers were data entered by certification operators. This condition was also found during the last Quick Pay audit. The frequency has decreased from 4.2 percent to the current level.

Bureau officials attribute the reduction in the incidence of certification operators data entering to improvements made to internal controls over the data entry process in response to the prior Quick Pay audit. It was noted during this audit that the ORACLE Financial Management System includes control features that will prevent this from occurring in the future.

Batches Certified by the Individual Performing the Data Entry

OSC’s Financial Management Guide’s, Internal Control Standards state that management should ensure that “Key duties and responsibilities in authorizing, processing, recording, and reviewing transactions should be separated among individuals."

The responsibility for data entering vouchers and certifying the batch should be performed by different individuals to ensure the appropriateness of the information entered and approved.

The audit reviewed 140 QP vouchers and compared the name of the person performing the data entry with the name of the person certifying the batch. In two instances, the vouchers were data entered and certified by the same individual. This observation was also made during the last Quick Pay audit, however the frequency has decreased.

Password Security

OSC's Accounting Bulletin A-266, page 5, states "Management is responsible for ensuring adherence to all controls for terminal and password security. " For those vouchers selected for review by OSC, the audit compared the date that the batch was certified with the employees' time sheets to ensure that the individual certifying the batch was present on the day that their password was used.

Password security is intended to prevent the entry of unauthorized transactions, changes to computer files and access to restricted data. Violation of password security can effect the integrity of the data and increase the potential for fraud and abuse.

The audit found two instances of a certification operator certifying a batch on days that their time sheet indicates they were not present.

Bureau officials indicated that, on these two days, the individual reported to work on her regular day off. The Bureau needs to establish a policy on how time worked which deviates from the regular schedule is recorded and accounted for to ensure accountability with password security.

Recommendations

1. Ensure that certification operators do not data enter QP voucher batches.

2. Ensure that the individual performing data entry is not the individual certifying the batch.

3. Periodically generate reports to monitor the occurrence of individuals by-passing the separation of responsibilities.

4. Ensure that passwords are unique to each individual and not shared among Bureau staff.

5. Meet with Human Resource Management staff to determine a method to account for staff deviating from normal work schedules to ensure accountability with password security.

Comments of Fiscal Management Officials

Fiscal Management officials agree with recommendations 1, 2, 3 and 5. They do not believe the report supports a recommendation regarding password security.

Auditor’s Note

The audit identified instances of a password being used on days when the individual assigned the password was marked absent on the timesheet. There was no documentation available as to what occurred on those days. The two possibilities are that the individual reported to work on a regular day off or someone else used the password. Our recommendation, number 4, addressed the latter possibility.

To:	Daniel Tworek	Date:	April 11, 2000
From:	Don Juron
Subject:	Draft Audit Report-Quick Pay Process