Loading...
HomeMy WebLinkAboutCS 11-06 036 REPORT TO AUDIT COMMITTEE Report Number: CS 11-06 Date: February 7,2006 From: Gillis A. Paterson Director, Corporate Services & Treasurer Subject: Clerk's Division Revenue Cycle Review Follow up Review by Deloitte Recommendation: That Report CS 11-06 of the Director, Corporate Services & Treasurer with respect to the report by Deloitte concerning a follow up to the June 2004 Revenue Cycle Review be received for information. Executive Summary: As per the direction of the Chief Administrative Officer to engage our auditors to undertake a process and controls review of the Clerks Division revenue cycle in June 2004, a further follow up review was completed in August 2005 by Deloitte. Background: The new City Clerk was hired on May 30, 2005 and was updated in July 2005 on the original review of Deloitte. A preliminary review was conducted at that time by the City Clerk based on the Divisional workplan that was created after the June 2004 Deloitte process review. On July 20, 2005, a report on the original June 2004 Deloitte recommendation was presented to the Audit Committee through Report CS 58-05, a copy of which is includeQ as Attachment 1 to this report.- Further to the Audit Committee meeting held on July 25, 2005 and the request of Mayor Ryan to ensure that all processes were formally in place with respect to the revenue cycle review, the City Clerk began to document the divisional processes for tighter controls related to the manual systems in place, with the understanding that a large part of the audit controls required would be permanently enhanced with the implementation of an electronic business licensing system (Amanda location module). The enhancement of the Amanda system for the licensing module was ordered in September 2005, following meetings held by the City Clerk with the Manager, Information Technology. Installation of the module was completed late November and testing of the system commenced in November 2005, with the launch of the majority of the system in January 2006. It should be noted that this location module was further developed in December 2005 in order to accommodate animal services licensing. Report CS 11-06 Date: February 7, 2006 037 Clerk's Division Revenue Cycle Review Page 2 Due to the implementation of the Amanda module, staff have spent considerable time testing the system to ensure the options of tracking, data management and renewal activities meet our needs as well as comments received in relation to the revenue cycle review. Due to the large volume associated with animal services licensing, the focus by staff was geared to this testing in December 2005. This aspect of licensing is fully integrated and functional as of January 1, 2006 and aside from minor changes requested, such as greater search capabilities, it appears to be meeting our needs. With respect to remaining licensing functions of the Clerks Division, staff are currently transferring all manual files into the Amanda location module. As we enter the files we are completing quality assurance testing to ensure it will meet our needs. At the present time, we are completing the entry and testing of the licensing files for home based businesses. It is anticipated that the entry and final testing will be completed by the end of April, 2006. The timing is such that we are giving ourselves plenty of time for the implementation due to the sheer volume of animal licenses (approximately 300 per week) that are required to be entered, on top of current staff constraints. It should also be noted that the the Clerks Division is now at full complement with respect to the senior management team and a large number of processes and procedures related to budget monitoring and revenue cycles have now been more appropriately assigned to these staff, with formal review and sign off by the City Clerk. Based on the review results of October 19, 2005 by Deloitte, the following comments are offered based on the fact that the Amanda location module has now been installed. You will recall that a large number of the recommendations by Deloitte were dependant upon this installation. It should further be noted that the City Clerk was satisfied with the comments submitted by Deloitte following the review, based on the time and staff constraints that were placed upon the Division, along with any further advice for improvement that was recommended. 0 3 ~eport CS 11-06 Clerk's Division Revenue Cycle Review Date: February 7, 2006 Page 3 CLERK'S DIVISION REVENUE CYCLE RECOMMENDATIONS FROM DELOITTE & TOUCHE Budget Monitoring: Financial tracking Management Manual informal Clerk's Division sheets have been comments address reconciliations are still management should established for By-law the being prepared by the monitor activities on a Enforcement and are recommendations. Audit Analyst pending full regular basis through currently being finalized implementation of the reviewing reports and for balance of the Management Amanda system in the analyzing the statistics. Division. Policy and comments have been interim. Results and comments on procedures have been implemented with the any deviations should be completed. exception of the Tracking sheets and documented and signed- Clerks division reconciliations, including off. Finance, as an The Clerk's Division will reconciliations. reconciliations for our independent party, should reconcile all accounts Manual informal contractor with respect to review the actual revenue on a monthly basis and reconciliations are Animal licensing are in numbers per type of provide verification to being prepared by the place. licence, permit, service or the Finance Division. Audit Analyst pending parking ticket and follow Regular reviews will be the launch of the Monthly computer print up with Clerk's Division completed by the Amanda system. outs of sectional management on any Finance staff. Statistics accounts are provided to noted variances on the number of the management team licences, permits. for review and Parking tags, etc. have subsequent sign off by been or are in process the City Clerk. (January of being produced for 30, 2006 will be first full management review, month for new process) productivity and control ur oses. Central Filing: All documents are filed Management With the furniture move All documents should be within central files, with comments address that recently took place filed in the Central the exception of active the within the Division, all Files, which should be by-law enforcement recommendations. Clerks Division files are locked during non- officer files. All files are within a central filing business hours. locked during non- Management system. File sign out Procedures for filing business hours. comments have been sheets are in place within documents should be Procedures have been implemented with the the central files in the established and followed developed for tracking exception of event staff are utilizing by all employees involved. of the work in progress procedures for files for work in progress. files. Access to the tracking work in central files after hours progress files. have been restricted to management only. No formal procedures were noted to track work in process files stored outside of central filin . 039 Report CS 11-06 Date: February 7,2006 Clerk's Division Revenue Cycle Review Page 4 Reconciliations: Reconciliation Management Monthly computer print Reconciliations and procedures have been comments address outs of sectional reviews need to be established and forms the accounts are provided to documented and signed- have been developed. recommendations. the management team off by the responsible for review and personnel. Any deviations Establishment of Management has subsequent sign off by or problems encountered additional separate implemented the City Clerk. (January should be explained. revenue accounts have reconciliation 30, 2006 will be first full been completed. procedures however month for new process) they do not include documented reviews and signoffs. Templates have been developed for tracking sheets. Separate revenue accounts have been created. Policies and Desk reference binders Management Ongoing project for 2006 Procedures: have been completed comments address and established as a We understand that for clerical staff, and will the recommendation. divisional goal. management has initiated be incorporated into The desk reference the process of Clerks Division policy binders have been documenting the activities and procedure manual. developed however and we encourage By-law Enforcement they will be management to continue staff are anticipating significantly changed with its efforts in completion early in 2006 upon the full developing and due to current workload implementation of the documenting the commitments. Amanda software. Clerk's Division's procedures. These We encourage procedures such as pre- management to numbering forms, central continue with its filing, segregation of efforts in developing duties should cover areas and documenting such as pre-numbering, procedures in light of reconciliations of revenue, the anticipated etc. software im plementation. Taxi Driver's Licence: All files and blank forms Recommendations Identicam software has Taxi driver licence cards are secured at all times. have not been been purchased and is should be pre-printed and implemented pending currently being tested by contain special features Software program - the launch of the IT staff. Delay for (i.e. watermark, digital Identicam has been Identicam software. installation due to photos) to prevent researched for licence implementation of new falsification. Additionall, issuance and is in the Files and blank forms front counter in the Clerks Report CS 11-06 04 °Clerk's Division Revenue Cycle Review Date: February 7, 2006 Page 5 cards should be numbered to allow management to control the stock of blank cards and the number of licences issued by the Division. The issuance of taxi driver licences should be recorded in a centralized database to allow Clerk's Division to have better control of the licences and the expiry dates. Physical files should be securely locked during non- business hours. Licences should not be signed until documentation is completed and ready to be issued. Blank stock of Sensitive Forms: Blank stock of sensitive forms should be securely locked outside of business hours. Management should keep control of forms received and issued. Monthly reconciliations should be performed, documented and signed-off, by an independent party, who should also compare the stock position to the monthly revenue. process of being purchased. Database is currently being developed for licence tracking. No licences are pre-signed and a temporary manual numbering system has been established. All licences are reviewed by the City Clerk effective July 1, 2005, prior to issuance. Sensitive forms are locked and a monthly stock reconciliation (log book) has been developed. Private information is securely locked during non- business hours. The Clerk's Division completes reconciliations on a monthly basis and Finance staff completes final reconciliation every six months. have been secured. Licenses are being reviewed prior to issuance by either the City Clerk or the Manager, By-Law Enforcement. Management comments address the recommendations. The comments have been implemented with the exception of the reconciliations of blank stock which will now be the responsibility of the new Deputy Clerk. Management expects that this recommendation will be implemented by the new Deputy Clerk. Division. March 2006 implementation anticipated. Reconciliations are now in place by the Deputy Clerk. Report CS 11-06 Date: February 7,2006 Clerk's Division Revenue Cycle Review Page 6 041 Permits, birth Pre-printed forms are Management Full implementation with registrations, licences being used but special comments address the Amanda system and compliance letters: security measures are the expected by April 2006. Birth registration, pending the integration recommendations. municipal licences, of upgrades to the permits and compliance Amanda system in the Pre-printed letters should be issued Fall. Enhancement of sequentially on pre-printed forms with the existing database numbered forms are special features to will also be realized as only used for prevent part of the Amanda marriage and lottery falsification. Forms should system. licenses, thus the be sequentially numbered recommendation has to allow management to Compliance letters are not been fully control the number of now completed utilizing implemented. registrations, licences and a standard template permits issued by the including computer Compliance letters Division. All issuance of generated numbers and are completed using licences and permits are signed by clerical a standard template should be recorded in a personnel. however the database to allow Clerk's numbering system is Division to maintain better still manual. control of the documents and, if applicable, the There is no formal expiry date. database for the issuance of all licenses and ermits. Safeguard of Private All central file cabinets Management Completed. Information: are locked during non- comments address Private information should business hours and the the recommendations be kept securely locked key secured and appear to have during non-business been implemented. hours. Customer Information: Counter signage has Recom mendations Completed. Signage should notify been established and have yet to be customers to make permanent signage is implemented. payments only at the pending redesign of the Expected to be cashiers. front counter and the implemented upon necessary approvals. remodeling of the counter area. 042 Report CS 11-06 Clerk's Division Revenue Cycle Review Date: February 7, 2006 Page 7 Vital Statistics/Lottery Systems: Management should consider updating these systems and enforcing users to change their passwords at least every 90 days. Passwords should have a minimum length of 6 characters and, if possible, complexity should be enforced. The system should lockout users who exceed 3 unsuccessful login attempts until the IT Section can reset the password. Segregation of Duties: The following duties should be segregated: By-law Section or an independent party .- Recording ticket information into Ticket Processor from handhelds and manual tickets should be delivered directly to this section. By-law Section should not have access to Ticket Processor functionalities other than uploading and viewing tickets. Clerical personnel - Reconciling tickets recorded in Ticket Processor with handheld print-outs or manual tickets; - Recording payment into Ticket Processor; - Cancelling tickets accordin to Excel database created and implemented by IT for affected staff. Restricted password access established. Procedures have been developed Duties have been segregated and controls established, including a cancellation policy. This process will be further reviewed upon the purchase of the new parking ticket handheld units (lease expires this year). Co-signing of all documents is strictly enforced. MTO plate information can only be accessed by the Manager, By-law Enforcement and one senior MLEO officer. One clerical personnel confirms the search and matches to the appropriate parking ticket. Daily log for pay tickets is completed and signed by the Cit Clerk, then Management comment does not appear to address password changes in Vital Statistics and Lottery System Software. Although computer network access requires regular password changes, access to Vital Statistics/Lottery systems do not currently appear to require password changes. Management comments address the recommendations. Segregation of duties have not been implemented as recom mended. Co-signing of documents, daily log of Pay Tickets, reconciliation of Moneris information and payment processing has been implemented. Installation of new handheld units being completed in February 2006. Segregation of duties will be enhanced with the implementation of this new system. Report CS 11-06 Clerk's Division Revenue Cycle Review 043 Date: February 7, 2006 Page 8 cancellation policies; - Obtaining MTO car owner information; and - sending plate to plate denial Ticket cancellations PayTicket payment reversal and plate denial activities should also be co-signed by a second clerical staff member and reviewed by management on a regular basis. Exceptions from cancellation policy should be approved by management and reasons noted. If possible, system should log the user responsible for the cancellation and second review. Finance .. Receiving payments done at the cashier, drop-box, direct deposit via PayTicket or cheques from MTO. .. Recording payment received in the accounting system. .. Reconciling payments processed by the Finance with payment information recorded into Ticket Processor. Ticket Cancellation Process: Each condominium or private area should formally designate the appropriate personnel who will have the authorit forwarded to Finance staff for processing. Reconciliation on a monthly basis is completed by the Clerk's Assistant and amended forms are forwarded to Finance staff for payment. Any payment processing is handled by the cashiers in the Finance Division. The Clerk's Division, in accordance with the cancellation policy, handles all cancellations. A letter was sent to all Management comments do not address the recommendations. Management has implemented a Completed. Cancellation policy has been updated to formally list the designated personnel with approval to authorize ticket cancellation. - Report CS 11-06 044 Clerk's Division Revenue Cycle Review Date: February 7, 2006 Page 9 to cancel tickets. condominiums advising cancellation policy Only authorized personnel of this change in policy however it does not should be able to request in the fall of 2004. include the the cancellation of a recommended listing ticket. Requests should of formally be signed and the original designated personnel document should be with approval to compared to the name authorize ticket and signature in the cancellation. authorization process and filed together with the cancelled tickets. Ticket cancellation should be co- signed by two clerical staff members. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Reconciliation: Monthly reconciliations Management Completed. Monthly reconciliations have re-commenced comments address should be performed, since the hiring of the the recommendation. documented and signed- new City Clerk. off by an independent Formal party. Payments reconciliations are processed by Finance not being performed should be compared to by the Audit Analyst the information in the pending the launch of Ticket Processor system. the Amanda software. Logic Security: Information from the Management Reconciliations of Information downloaded downloads are saved comments address uploaded information and from the handhelds within a protected the recommendation. ticket information are should be saved in a directory and errors are under review. protected directory in the verified by Clerical Reconciliations of network to which only the personnel prior to uploaded information Ticket Processor has further processing. and ticket information access. Control totals has not been checks should be All ticket reconciliations implemented. implemented in Ticket are handled by one Processor to ensure clerical personnel, with Clerical personnel information was uploaded an additional sign off by restricted as does not correctly. Additionally, the Clerk's Assistant. have access to tickets uploaded into change or modify Ticket Processor should Clerical staff do not uploaded ticket Report CS 11-06 Clerk's Division Revenue Cycle Review 045 Date: February 7,2006 Page 10 be reconciled to the handhelds printed tickets by an independent party. Clerical personnel should not have access to change nor to modify ticket information uploaded from handhelds. Payments Received at the Drop-Box: Drop-box content should be directed to Finance to count and document the payments received. A list of payments should then be sent to the Clerk's Division to identify whether payments should be processed or returned to the customer. Car Owner Request to MTO: Cancellation due to inconsistent or lack of information should be co- signed by two clerical personnel. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Distribution of Manual Ticket Books: Ticket books should be given to authorized personnel upon presentation of identification document. Clerk's Division should kee track of which officer have the authority to change or modify the ticket information uploaded. Finance document through a log the cheques received and send to clerical personnel for verification. Payment is processed once the verification is received All cancellations are reviewed in accordance with the cancellation procedures by two clerical personnel and final review and approval by the Manager, By-law Enforcement. A log book for sign out of the books have been established. A copy of the officer identification is kept with the log book for verification purposes. Management comments address the recommendation and have been implemented. A cancellation policy requiring co-signing by the two clerical personnel plus management signature for exceptions has been implemented. This policy is consistent with the recom mendations, however, it is inconsistent with management comments. Management comments address the recom mendations. Management has implemented a log book for the sign out of the books which Completed. Completed. Completed. ~eport CS 11-06 046 Clerk's Division Revenue Cycle Review Date: February 7,2006 Page 11 collected which books. Periodic reconciliations should be performed by an independent party to ensure ticket books are being used appropriately (i.e. if there are no tickets missing nor gaps in the sequence). Ticket Processor Audit Trail: Customized reports should be developed to allow management to monitor Clerks Division activities. Attachments: An RFP for the handheld units has been prepared and specifications have been developed to ensure customized reports can be developed. With the existing units, customized reports cannot be obtained. keeps track of the officer who collected the books. Officer identification and periodic reconciliation were not evident. RFP is still outstanding thus recommendation has not been implemented. Completed purchase of handheld units and installation scheduled for February 2006. 1. 2. Report CS 58-05 of the Director, Corporate Services & Treasurer Clerk's Division Revenue Cycle - Follow up dated October 2005 047 Report CS 11-06 Date: February 7,2006 Clerk's Division Revenue Cycle Review Page 12 Prepared By: Approved I Endorsed By: ~b',~~..1t" 1 Debi A. Bentley City Clerk .~ y~~~- Gillis A. Paterson Director, Corporate Services & Treasurer GAP/vw Attachments Copy: Chief Administrative Officer Recommended for the consideration of Pickering Cit~o .(/ /' 048 Ciú¡ o~ ATTACHMENT # -L TO REPORT#..ts...l {- °' REPORT TO AUDIT COMMITTEE Report Number: CS 58-05 Date: July 20, 2005 From: Gillis A. Paterson Director, Corporate Services & Treasurer Subject: Clerks Division Revenue Cycle Review Recommendation: 1. That Report CS 58-05 of the Director, Corporate Services & Treasurer be received for information. Executive Summary: As per the direction of the Chief Administrative Officer, the Director, Corporate Services & Treasurer engaged our auditors, Deloitte & Touche, to undertake a process and controls review. of the Clerks Division revenue cycle in June 2004. The purpose of the review was to document the processes of the Division's principal business activities and provide recommendations to enhance internal controls within these processes. Deloitte & Touche issued their report in August 2004 and a Divisional implementation workplan was developed from this report. The following report is a summary update of actions taken and those in progress for the information of the Audit Committee. Background: By the direction of the Chief Administrative Officer, with the endorsement of Council, the Clerks Division was transferred to the Corporate Services Department in May 2004. At that time it was thought necessary and beneficial to undertake a process review of the Clerks Division's revenue cycle to documenLand review their business processes. With the various sources of revenue the Division collects, it was seen as an opportunity to assess where efficiencies or synergies could be made within the Division and the Department as a whole. As existing City resources were not available due to daily workload and other commitments, Deloitte & Touche was engaged to undertake the review based on the firm's extensive municipal background. The scope of the review was to document key systems and processes as well as the internal controls for each of these processes. They were to review the existence and effectiveness or the controls and provide recommendations for improvements where necessary. It was agreed jointly by the Chief Administrative Officer and the Director, Corporate Services & Treasurer, that following the Forensic Audit, the next logical step was to undertake this review. ReportCS 58-05 Clerks Division Revenue Cycle Review Date: July 20, 2005 049 Page 2 Deloitte & Touche's report was received in late August 2004 and was forwarded to the Clerk in early September to assist in and oversee the implementation of the various recommendations. The Supervisor, Legislative Services and the Audit Analyst reviewed the report and drafted an implementation plan for each of the recommendations. Work on the implementation plan continued through the fall and early winter. Progress meetings were held with the Clerk, the Supervisor and the Department Head up until the end of the year to ensure all actions that could be undertaken quickly were readily implemented. However with the by-election in the fall of 2004, year end work, departure of the Supervisor at the end of 2004, together with the Manager, By-law Enforcement and the announcement of the Clerk's retirement in June 2005, progress was impeded and a number of original target dates had to be revised. With the hiring of the new Clerk in May 2005, she has had an opportunity to review the recommendations, meet with staff, and review and update the implementation plan. She is confident that any remaining key items will soon be addressed and implemented accordingly. Below are the recommendations included in Deloitte & Touche's report. In light of discussions at the Audit Committee meeting of June 20, 2005, we have provided our comments on the status of these recommendations and a copy of this report has been provided to the auditors for their information. A number of the items reflected within the table are contingent upon the upgrade of the Amanda software, which was provided for in the 2005 Budgets, and database development assistance from the IT Division. This assistance commenced in the fall of 2004 and the new City Clerk will be meeting with the Manager, Information Technology in order to prioritize Divisional requirements and seek the necessary guidance from IT. CLERKS DIVISION REVENUE CYCLE RECOMMENDATIONS FROM DELOITTE & TOUCHE RECOMMENDATION Clerks Division management should monitor activities on a regular basis through reviewing reports and analyzing the statistics. Results and comments on any deviations should be documented and signed- off. Finance, as an independent party, should review the actual revenue numbers per type of licence, permit, service or Budget Monitoring: Management prepares the annual budget mainly based on previous year numbers per type of licence, permit, service or parking tickets. However, Finance only reviews the budget for the total revenue. MANAGEME COMMENT Financial tracking sheets have been established for By-law Enforcement and are currently being finalized for balance of the Division. Policy and proced ures have been completed. The Clerks Division will reconcile all accounts on & monthly basis and provide verification to the Finance Division. Regular reviews will be com leted b the ..1eport CS 58-05 05,0 Clerks Division Revenue Cycle Review Date: July 20, 2005 Page 3 Central Filing: Currently, part of the supporting documentation used to issue licences and permits is filed in the Central Files; however, some documents are kept in separate files by the By-law officer responsible for the review and approval of the licence/permit (e.g. business licence, pool enclosure permits, etc.). Decentralized filing may make it difficult to locate required records as each record set would be arranged and managed differently. Reconciliations: As part of the process of monitoring Clerks Division's activities, reconciliations and reviews need to be performed. We observed that some reviews and reconciliations are not documented nor are they signed-off. Policies and Procedures: Clerks Division's procedures have not been formalized. Work is performed based on the experience of clerical personnel. Taxi Driver's Licence: The stock of blank licence cards is kept parking ticket and follow up with Clerks Division management on any noted variances All documents should be filed in the Central Files, which should be locked during non- business hours. Procedures for filing documents should be established and followed by all employees involved. Reconciliations and reviews need to be documented and signed- off by the responsible personnel. Any deviations or problems encountered should be explained. We understand that management has initiated the process of documenting the activities and we encourage management to continue with its efforts in developing and documenting the Clerks Division's procedures. These procedures such as pre- numbering forms, central filing, segregation of duties should cover areas such as pre-numbering, reconciliations of revenue, etc. Taxi driver licence cards should be pre-printed and contain special features M JtN'« COMM Finance staff. Statistics on the number of licences, permits, parking tags, etc have been or are in the process of being produced for management review, productivity and control ur oses. All documents are filed within central files, with the exception of active by-law enforcement officer files. All files are locked during non- business hours. Procedures have been developed for tracking of the work in progress files. Access to the central files after hours have been restricted to management only. Reconciliation procedures have been established and templates have been developed incorporating the recommendations. Establishment of additional separate revenue accounts have been com leted. Desk reference binders have been completed for clerical staff, and will be incorporated into Clerks Division policy and procedure manual. By-law Enforcement staff are anticipating completion early in 2006 due to current workload commitments. All files and blank forms are secured at all times. Software ro ram- Report CS 58-05 Clerks Division Revenue Cycle Review Date: July 20,2005 0'5;11 Page 4 unlocked and pre-signed on a desk. Cards are not sequentially numbered. In addition, information about taxi driver's licence is not recorded into a centralized database. Physical files are kepi in an open cabinet. Blank Stock of Sensitive Forms: Marriage and lottery licences are printed on pre-printed numbered paper. However, the stock of blank forms is not securely stored and is accessible at any time. Additionally, management does not control the sequence of lottery licence forms. Numbering and inventory of marriage licence forms is reconciled by the Finance Section. (i.e. watermark, digital photos) to prevent falsification. Additionally, cards should be numbered to allow management to control the stock of blank cards and the number of licences issued by the Division. The issuance of taxi driver licences should be recorded in a centralized database to allow Clerks Division to have better control of the licences and the expiry dates. Physical files should be securely locked during non-business hours. Licences should not be signed until documentation is completed and ready to be issued. Blank stock of sensitive forms should be securely locked outside of business hours. Management should keep control of forms received and issued. Monthly reconciliations should be performed, documented and signed-off, by an independent party, who should also compare the stock position to the monthl revenue. ,E~EN " ENm$ ,,' Identicam has been researched for licence issuance and is in the process of being purchased. Database is currently being developed for licence tracking. No licences are pre-signed and a temporary manual numbering system has been established. All licences are reviewed by the City Clerk effective July 1, 2005, prior to issuance. Sensitive forms are locked and a stock reconciliation (log book) has been developed. Private information is securely locked during non-business hours. The Clerks Division completes reconciliations on a monthly basis and Finance staff com pletes final reconciliation every six months. . geport CS 58-05 052 Clerks Division Revenue Cycle Review Date: July 20,2005 Page 5 Permits, birth registration, licences and compliance letters: Permits, birth registration, licences and compliance letters with the exception of marriage and lottery licences, are issued on plain blank paper. Although these documents need to be signed by the City Clerk, Manager, Municipal Law Enforcement Officer "MLEO" or clerical personnel, depending on the type of document, controls do not ensure that the City only issues and charges for legitimate documents. Compliance letters are also printed on plain blank paper and do not need to be signed. In addition, most of the licences and permits are not controlled by a system nor are they recorded into a database. Safeguard of Private Information: Some files like the marriage licence and taxi driver's licence contain private information. Documents are ke t in unlocked cabinets. Customer Information: There are no signs indicating that payments can not be accepted by the clerical personnel and should be made directl at the cashier. Vital Statistics/Lottery Systems: The Vital Statistics system is used to record birth registrations, marriage licences and burial permits. The Lottery system records lottery licences. None of these systems enforce periodic user password changes. N Birth registration, municipal licences, permits and compliance letters should be issued on pre-printed forms with special features to prevent falsification. Forms should be sequentially numbered to allow management to control the number of registrations, licences and permits issued by the Division. All issuance of licences and permits should be recorded in a database to allow Clerks Division to maintain better control of the documents and, if applicable, the expiry date. Private information should be kept securely locked during non-business hours. Sign age should notify customers to make payments only at the cashiers. Management should consider updating these systems and enforcing users to change their passwords at least every 90 days. Passwords should have a minimum length of 6 characters and, if possible, complexity should be enforced. The system should lockout users who exceed 3 unsuccessful login attempts until the IT Section can reset the assword. . MÂNÂGEM ENT GQMMENIS Pre-printed sequentially numbered forms are being used and special security features are pending the integration of upgrades to the Amanda system in the Fall. Enhancement of the existing database will also be realized as part of the Amanda system. Compliance letters are now completed utilizing a standard template including computer generated numbers and are signed by clerical personnel. All central file cabinets are locked during non-business hours and the key secured. Counter signage has been established and permanent signage is being reviewed. Excel database created and implemented by IT for affected staff. Restricted password access established. Procedures have been developed. Report CS 58-05 Clerks Division Revenue Cycle Review 053, Date: July 20, 2005 Page 6 Segregation of Duties: Manual parking tickets are keyed into the system by the Clerks Division, which is also responsible for processing ticket cancellation, recording payment, obtaining car owner information from the MTO and sending plates to plate denial. RECOMMENDATION The following duties should be segregated: By-law Section or an independent party . Recording ticket information into Ticket Processor from handhelds and manual tickets should be delivered directly to this section. By-law Section should not have access to Ticket Processor functionalities other than uploading and viewing tickets. Clerical personnel . Reconciling tickets recorded in Ticket Processor with handheld print-outs or manual tickets; . Recording payment into Ticket Processor; . Cancelling tickets according to cancellation policies; . Obtaining MTO car owner information; and . sending plate to plate denial . Ticket cancellations, PayTicket payment reversal and plate denial activities should also be co-signed by a second clerical staff member and reviewed by management on a regular basis. Exceptions from I cancellation policy should be approved by , management and reasons noted. If possible, system should 10 the user M.itNJ:tGErqleNm COMMEN\r$ . Duties have been segregated and controls established, including a cancellation policy. This process will be further reviewed upon the purchase of the new parking ticket handheld units. Co-signing of all documents is strictly enforced. Plate information can only be accessed by the Manager, By-law Enforcement and one senior MLEO officer. One clerical personnel confirms the search and matches to the appropriate parking ticket. Daily log for Pay Tickets is completed and signed by the City Clerk, then forwarded to Finance staff for processing. Reconciliation on a monthly basis is completed by the Clerk's Assistant and amended forms are forwarded to Finance staff for payment. Any payment processing is handled by the cashiers in the Finance Division. , 'ieport CS 58-05 0,54 Clerks Division Revenue Cycle Review Date: July 20, 2005 Page 7 responsible for the cancellation and second review. Finance . Receiving payments done at the cashier, drop-box, direct deposit via PayTicket or cheques from MTO. . Recording payment received in the accounting system. . Reconciling payments processed by Finance with payment information recorded into Ticket Processor. Report CS58-05 Clerks Division Revenue Cycle Review 0:5:5 Date: July 20,2005 u Page 8 Ticket Canceilation Process: Condominium or private area parking tickets are cancelled upon issuer request. During our work, we identified a ticket that was cancelled upon the receipt of a fax document. The fax had the logo of the condominium but it was not signed and did not indicate the full name of the condominium representative. In addition, there is no second review/approval for the cancellation of a ticket. Reconciliation: Ticket payments processed by Finance and recorded into the G/L are not reconciled to the tickets paid in Ticket Processor (system used to control parking tickets). Logic Security: Information stored in the handheld units is downloaded via Citation+, which produces a text file to be saved in a network directory. A File is then uploaded into Ticket Processor by appropriate clerical personnel. The Interface file contains control totals; however, the Ticket Processor does not perform checks to ensure information was uploaded correctly. Each condominium or private area should formally designate the appropriate personnel who will have the authority to cancel tickets. Only authorized personnel should be able to request the cancellation of a ticket. Requests should be signed and the original document should be compared to the name and signature in the authorization process and filed together with the cancelled tickets. Ticket cancellation should be co- signed by two clerical staff members. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Monthly reconciliations should be performed, documented and signed- off by an independent party. Payments processed by Finance should be compared to the information in the Ticket Processor s stem. Information downloaded from the handhelds should be saved in a protected directory in the network to which only the Ticket Processor has access. Control totals checks should be implemented in Ticket Processor to ensure information was uploaded correctly. Additionally, tickets uploaded into Ticket Processor should be reconciled to the handhelds printed tickets b an inde en dent art. The Clerks Division, in accordance with the cancellation policy, handles all cancellations. A letter was sent to all condominiums advising of this change in policy in the fall of 2004. Monthly reconciliations have re-commenced since the hiring of the new City Clerk. Information from the downloads are saved within a protected directory and errors are verified by clerical personnel prior to further processing. All ticket reconciliations are handled by one clerical personnel, with an additional sign off by the Clerk's Assistant. Clerical staff do not have the authority to change or modify the ticket information u loaded. 056 Report CS 58-05 Clerks Division Revenue Cycle Review Date: July 20, 2005 Page 9 Payments Received at the Drop-Box: Payments received at the drop-box are directed to the clerical personnel to ensure parking tickets are due (i.e., identify whether ticket is in court or was sent to MTO for plate denial). If Clerks Division approves payment receipt, then cheque or cash is sent to Finance to process payment. Car Owner Request to MTO: Tickets that are not paid up to 14 days after the due date are extracted from Ticket Processor and a text file is produced to be sent to MTO, which sends back a text file containing the car owner information. A Text file is received by clerical personnel and uploaded into Ticket Processor. If the information received from MTO is inconsistent or the car owner information can not be found, the ticket is cancelled. Distribution of Manual Ticket Books: Parking tickets books are distributed at the Clerks Division. To obtain a book, a document identifying the number sequence of the book must be signed by the recipient/parking control officer. However, no identification is requested, as the recipients are usually in uniform. Ticket Processor Audit Trail: Ticket Processor records audit trails. However, there are no customized reports to be used for monitoring purposes. In order to check all the operations done by clerical personnel, a query needs to be run against the database. RECOMI\lIENDÞ:TION . Clerical personnel should not have access to change nor to modify ticket information uploaded from handhelds. Drop-box content should be directed to Finance to count and document the payments received. A list of payments should then be sent to the Clerks Division to identify whether payments should be processed or returned to the customer. Cancellation due to inconsistent or lack of information should be co- signed by two clerical personnel. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Ticket books should be given to authorized personnel upon presentation of identification document. Clerks Division should keep track of which officer collected which books. Periodic reconciliations should be performed by an independent party to ensure ticket books are being used appropriately (i.e. if there are no tickets missing nor gaps in the se uence. Customized reports should be developed to allow management to monitor Clerks Division activities. MANAGEMENT. COMMENTS Finance document through a log the cheques received and send to clerical personnel for verification. Payment is processed once the verification is received. In accordance with the cancellation procedures, all cancellations are reviewed by two clerical personnel and final review and approval by the Manager, By-law Enforcement. A log book for sign out of the books have been established. A copy of the officer identification is kept with the log book for verification purposes. Periodic reconciliations will be undertaken by an independent person. An RFP for the handheld units has been prepared and specifications have been developed to ensure customized reports can be developed. 057 Report CS 58-05 Date: July 20, 2005 Clerks Division Revenue Cycle Review Page 10 INSIGHT AND IMPLICATION RECOMMENDATION . MANAGEMENT . COMMENTS With the existing units, customized reports cannot be obtained. With all the recent changes within the Division, it should be noted that special care has been taken to ensure there is a strong focus on internal controls, customer service and best practices. The workplan developed based on the recommendations will be reviewed by the City Clerk on a bi-weekly basis with management staff within the Division, along with monthly briefing at Clerks Division staff meetings to ensure that all parties are on track and best practices are continually addressed to determine the feasibility of implementation within the Division. Attachments: 1. Clerks Division Revenue Cycle - Deloitte & Touche Report Prepared By: Approved / Endorsed By: --., ~ -? ~-'~/..-.~.""" .'-.--------- .-- ,-c:. <' ~~ Gillis A. Paterson Director, Corporate Services & Treasurer GAP/vw Attachment Copy: Chief Administrative Officer City Clerk Manager, Accounting Services Audit Analyst Deloitte & Touche Recommended for the consideration of Pickering CiJy cil / . // /1" /' ( - 058 - ATTACHMENT # ~ TO REPORT # ß~.J {-oG ell ... ... .- 0 - ell Q bJ) ~ .~ ~ (l) ~ U .~ ~ ~ 0 ~ ~ .~ U 0.. ::J ~ 0 - 0 LL I Q) U >- U Q) ::J c: Q) > Q) a:: c: 0 .- (J) .- > .- 0 LO 0 (J) 0 .... N ~ ~ L.. Q) Q) -g - . ..J u å Deloitte Deloitte & Touche LLP 5140 Yonge Street Suite 1700 Toronto, ON M2N 6L7 Canada Tel: (416) 601 6150 Fax: (416) 601 6151 www.deloitte.ca Audit Committee The Corporation of the City of Pickering 1 The Esplanade Pickering, Ontario Ll V 6K7 Dear Audit Committee Members: As requested by the Audit Committee, we have followed up on the Clerk's Division Revenue Cycle recommendations prepared by Deloitte & Touche in June 2004 and the respective management comments dated July 20,2005. As of October 19,2005, Deloitte & Touche reviewed management comments to determine if they were implemented as stated and addressed the recommendations. The results of this review are included in the attached document. Overall, it was noted that the majority of the recommendations have not been fully implemented. The Clerk's Division is expecting to implement the Amanda software in January 2006. Management anticipates addressing the Deloitte & Touche recommendations as part of this software implementation. We would like to acknowledge the assistance and co-operation of management and all the staff during the course of the review. We would be pleased to discuss the results of our review and provide any assistance you may wish in their implementation. Yours truly, ILl ß~ Paula A. Jesty, CA Partner Member of Deloitte Touche Tohmatsu Q Ul q;¡ Clerks Division Revenue Cycle Recommendations From Deloitte & Touche Insight and Implication Budget Monitoring: Management prepares the annual budget mainly based on previous year numbers per type of licence, permit, service or parking tickets. However, Finance only reviews the budget for the total revenue. Central Filing: Currently, part of the supporting documentation used to issue licences and permits is filed in the Central Files; however, some documents are kept in separate files by the By-law officer responsible for the review and approval of the licence/permit (e.g. business licence, pool enclosure permits, etc.). Decentralized filing may make it difficult to locate required records as each record set would be arranged and managed differently. Reconciliations: As part of the process of monitoring Clerks Division's activities, reconciliations and reviews need to be performed. We observed that some reviews and reconciliations are not documented nor are they signed-off. @ Deloitte & Touche LLP and affiliated entities. Recommendation - June 2004 Clerks Division management should monitor activities on a regular basis through reviewing reports and analyzing the statistics. Results and comments on any deviations should be documented and signed-off. Finance, as an independent party, should review the actual revenue numbers per type of licence, permit, service or parking ticket and follow up with Clerks Division management on any noted variances. All documents should be filed in the Central Files, which should be locked during non-business hours. Procedures for filing documents should be established and followed by all employees involved. Reconciliations and reviews need to be documented and signed-off by the responsible personnel. Any deviations or problems encountered should be explained. Management Comments - July 20, 2005 Financial tracking sheets have been established for By-law Enforcement and are currently being finalized for balance of the Division. Policy and procedures have been completed. The Clerks Division will reconcile all accounts on a monthly basis and provide verification to the Finance Division. Regular reviews will be completed by the Finance staff. Statistics on the number of licences, permits, parking tags, etc. have been or are in the process of being produced for management review, productivity and control purposes. All documents are filed within central files, with the exception of active by-law enforcement officer files. All files are locked during non-business hours. Procedures have been developed for tracking of the work in progress files. Access to the central files after hours have been restricted to management only. Reconciliation procedures have been established and templates have been developed incorporating the recommendations. Establishment of additional separate revenue accounts have been completed. 0 0') ~ Follow up - October 19,2005 Management comments address the recommendations. Management comments have been implemented with the exception of the Clerks division reconciliations. Manual informal reconciliations are being prepared by the Audit Analyst pending the launch of the Amanda System. Management comments address the recommendations. Management comments have been implemented with the exception of procedures for tracking work in progress files. No formal procedures were noted to track work in process files stored outside of central filing. Management comments address the recommendations. Management has implemented reconciliation procedures however they do not include documented reviews and sign-offs. Templates have been developed for tracking sheets. Separate revenue accounts have been created. City of Pickering - Clerk's Revenue Process 2 Clerks Division Revenue Cycle Recommendations From Deloitte & Touche Insight and Implication Policies and Procedures: Clerks Division's procedures have not been formalized. Work is performed based on the experience of clerical personnel. Taxi Driver's Licence: The stock of blank licence cards is kept unlocked and pre-signed on a desk. Cards are not sequentially numbered. In addition, information about taxi driver's licence is not recorded into a centralized database. Physical files are kept in an open cabinet. Blank Stock of Sensitive Forms: Marriage and lottery licences are printed on pre-printed numbered paper. However, the stock of blank forms is not securely stored and is accessible at any time. Additionally, management does not control the sequence of lottery licence forms. Numbering and inventory of marriage licence forms is reconciled by the Finance Section. Recommendation - June 2004 We understand that management has initiated the process of documenting the activities and we encourage management to continue with its efforts in developing and documenting the Clerks Division's procedures. These procedures such as pre- numbering forms, central filing, segregation of duties should cover areas such as pre-numbering, reconciliations of revenue, etc. Taxi driver licence cards should be pre- printed and contain special features (i.e. watermark, digital photos) to prevent falsification. Additionally, cards should be numbered to allow management to control the stock of blank cards and the number of licences issued by the Division. The issuance of taxi driver licences should be recorded in a centralized database to allow Clerks Division to have better control of the licences and the expiry dates. Physical files should be securely locked during non-business hours. Licences should not be signed until documentation is completed and ready to be issued. Blank stock of sensitive forms should be securely locked outside of business hours. Management should keep control of forms received and issued. Monthly reconciliations should be performed, documented and signed- off, by an independent party, who should also compare the stock position to the monthly revenue. @ Deloitte & Touche LLP and affiliated entities. Management Comments - July 20, 2005 Desk reference binders have been completed for clerical staff, and will be incorporated into Clerks Division policy and procedure manual. By-law Enforcement staff are anticipating completion early in 2006 due to current workload commitments. All files and blank forms are secured at all times. Software program - Identicam has been researched for licence issuance and is in the process of being purchased. Database is currently being developed for licence tracking. No licences are pre-signed and a temporary manual numbering system has been established. All licences are reviewed by the City Clerk effective July 1, 2005, prior to issuance. Sensitive forms are locked and a stock reconciliation (log book) has been developed. Private information is securely locked during non-business hours. The Clerks Division completes reconciliations on a monthly basis and Finance staff completes final reconciliation every six months. Follow up - October 19, 2005 Management comments address the recommendation. The desk reference binders have been developed however they will be significantly changed upon the full implementation of the Amanda software. We encourage management to continue with its efforts in developing and documenting procedures in light of the anticipated software implementation. Recommendations have not been implemented pending the launch of the Identicam software. Files and blank forms have been secured. Licenses are being reviewed prior to issuance by either the City Clerk or the Manager, By-Law Enforcement. Management comments address the recommendations. The comments have been implemented with the exception of the reconciliations of blank stock which will now be the responsibility of the new Deputy Clerk. Management expects that this recommendation will be implemented by the new Deputy Clerk. City of Pickering - Clerk's Revenue Process 3 <:;;::) (;7') oo-+ Clerks Division Revenue Cycle Recommendations From Deloitte & Touche Insight and Implication Permits, birth registration, licences and compliance letters: Permits, birth registration, licences and compliance letters with the exception of marriage and lottery licences, are issued on plain blank paper. Although these documents need to be signed by the City Clerk, Manager, Municipal Law Enforcement Officer "MLEO" or clerical personnel, depending on the type of document, controls do not ensure that the City only issues and charges for legitimate documents. Compliance letters are also printed on plain blank paper and do not need to be signed. In addition, most of the licences and permits are not controlled by a system nor are they recorded into a database. Safeguard of Private Information: Some files like the marriage licence and taxi driver's licence contain private information. Documents are kept in unlocked cabinets. Customer Information: There are no signs indicating that payments can not be accepted by the clerical personnel and should be made directly at the cashier. Vital Statistics/Lottery Systems: The Vita Statistics system is used to record birth registrations, marriage licences and burial permits. The Lottery system records lottery licences. None of these systems enforce periodic user password changes. Recommendation - June 2004 Birth registration, municipal licences, permits and compliance letters should be issued on pre-printed forms with special features to prevent falsification. Forms should be sequentially numbered to allow management to control the number of registrations, licences and permits issued by the Division. All issuance of licences and permits should be recorded in a database to allow Clerks Division to maintain better control of the documents and, if applicable, the expiry date. Private information should be kept securely locked during non-business hours. Signage should notify customers to make payments only at the cashiers. Management should consider updating these systems and enforcing users to change their passwords at least every 90 days. Passwords should have a minimum length of 6 characters and, if possible, complexity should be enforced. The system should lockout users who exceed 3 unsuccessful login attempts until the IT Section can reset the password. @ Deloitte & Touche LLP and affiliated entities. Management Comments - July 20, 2005 Pre-printed sequentially numbered forms are being used and special security features are pending the integration of upgrades to the Amanda system in the Fall. Enhancement of the existing database will also be realized as part of the Amanda system. Compliance letters are now completed utilizing a standard template including computer generated numbers and are signed by clerical personnel. All central file cabinets are locked during non-business hours and the key secured. Counter signage has been established and permanent signage is being reviewed. Excel database created and implemented by IT for affected staff. Restricted password access established. Procedures have been developed. c:> cn:. l\; " Follow up - October 19, 2005 Management comments address the recommendations. Pre-printed sequentially numbered forms are only used for marriage and lottery licenses, thus the recommendation has not been fully implemented. Compliance letters are completed using a standard template however the numbering system is still manual. There is no formal database for the issuance of all licenses and permits. Management comments address the recommendations and appear to have been implemented. Recommendations have yet to be implemented. Expected to be implemented upon remodeling of the counter area. Management comment does not appear to address password changes in Vital Statistics and Lottery System Software. Although computer network access requires regular password changes, access to Vital Statistics/Lottery systems do not currently appear to require password changes. City of Pickering - Clerk's Revenue Process 4 Clerks Division Revenue Cycle Recommendations From Deloitte &. Touche Insight and Implication Segregation of Duties: Manual parking tickets are keyed into the system by the Clerks Division, which is also responsible for processing ticket cancellation, recording payment, obtaining car owner information from the MTO and sending plates to plate denial. Recommendation - June 2004 The following duties should be segregated. By-law Section or an indeDendent Darty . Recording ticket information into Ticket Processor from handhelds and manual tickets should be delivered directly to this section. By-law Section should not have access to Ticket Processor functionalities other than uploading and viewing tickets. Clerical Dersonnel . Reconciling tickets recorded in Ticket Processor with handheld print-outs or manual tickets; . Recording payment into Ticket Processor; . Cancelling tickets according to cancellation policies; . Obtaining MTO car owner information; and . Sending plate to plate denial . Ticket cancellations, PayTicket payment reversal and plate denial activities should also be co-signed by a second clerical staff member and reviewed by management on a regular basis. Exceptions from cancellation policy should be approved by management and reasons noted. If possible, system should log the user responsible for the cancellation and second review. Finance . Receiving payments done at the cashier, drop-box, direct deposit via PayTicket or cheques from MTO. . Recording payment received in the accounting system. . Reconciling payments processed by Finance with payment information recorded into Ticket Processor. @ Deloitte & Touche LLP and affiliated entities. Management Comments - July 20, 2005 Duties have been segregated and controls established, including a cancellation policy. This process will be further reviewed upon the purchase of the new parking ticket handheld units. Co-signing of all documents is strictly enforced. Plate information can only be accessed by the Manager, By-law Enforcement and one senior MLEO officer. One clerical personnel confirms the search and matches to the appropriate parking ticket. Daily log for Pay Tickets is completed and signed by the City Clerk, then forwarded to Finance staff for processing. Reconciliation on a monthly basis is completed by the Clerk's Assistant and amended forms are forwarded to Finance staff for payment. Any payment processing is handled by the cashiers in the Finance Division. Follow up - October 19, 2005 Management comments address the recommendations. Segregation of duties have not been implemented as recommended. Co-signing of documents, daily log of Pay Tickets, reconciliation of Moneris information and payment processing has been implemented. City of Pickering - Clerk's Revenue Process 5 c:J ~ Ç..ù Clerks Division Revenue Cycle Recommendations From Deloitte & Touche Insight and Implication Ticket Cancellation Process: Condominium or private area parking tickets are cancelled upon issuer request. During our work, we identified a ticket that was cancelled upon the receipt of a fax document. The fax had the logo of the condominium but it was not signed and did not indicate the full name of the condominium representative. In addition, there is no second review/ approval for the cancellation of a ticket. Reconciliation: Ticket payments processed by Finance and recorded into the G/L are not reconciled to the tickets paid in Ticket Processor (system used to control parking tickets). Logic Security: Information stored in the handheld units is downloaded via Citation+, which produces a text file to be saved in a network directory. A File is then uploaded into Ticket Processor by appropriate clerical personnel. The Interface file contains control totals; however, the Ticket Processor does not perform checks to ensure information was uploaded correctly. Recommendation - June 2004 Each condominium or private area should formally designate the appropriate personnel who will have the authority to cancel tickets. Only authorized personnel should be able to request the cancellation of a ticket. Requests should be signed and the original document should be compared to the name and signature in the authorization process and filed together with the cancelled tickets. Ticket cancellation should be co-signed by two clerical staff members. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Monthly reconciliations should be performed, documented and signed-off by an independent party. Payments processed by Finance should be compared to the information in the Ticket Processor system. Information downloaded from the handhelds should be saved in a protected directory in the network to which only the Ticket Processor has access. Control totals checks should be implemented in Ticket Processor to ensure information was uploaded correctly. Additionally, tickets uploaded into Ticket Processor should be reconciled to the handhelds printed tickets by an independent party. Clerical personnel should not have access to change nor to modify ticket information uploaded from handhelds. @ Deloitte & Touche LLP and affiliated entities. Management Comments - July 20, 2005 <:> Ø') ¡,þ. Follow up - October 19, 2005 The Clerks Division, in accordance with the Management comments do not cancellation policy, handles all cancellations. address the recommendations. A letter was sent to all condominiums advising Management has implemented a of this change in policy in the fall of 2004. cancellation policy however it does not include the recommended listing of formally designated personnel with approval to authorize ticket cancellation. Monthly reconciliations have re-commenced since the hiring of the new City Clerk. Information from the downloads are saved within a protected directory and errors are verified by clerical personnel prior to further processing. All ticket reconciliations are handled by one clerical personnel, with an additional sign off by the Clerk's Assistant. Clerical staff do not have the authority to change or modify the ticket information uploaded. Management comments address the recommendation. Formal reconciliations are not being performed by the Audit Analyst pending the launch of the Amanda software. Management comments address the recommendation. Reconciliations of uploaded information and ticket information has not been implemented. Clerical personnel restricted as they do not have access to change or modify uploaded ticket information. City of Pickering - Clerk's Revenue Process 6 Clerks Division Revenue Cycle Recommendations From Deloitte &. Touche Insight and Implication Payments Received at the Drop-Box: Payments received at the drop-box are directed to the clerical personnel to ensure parking tickets are due (i.e., identify whether ticket is in court or was sent to MTO for plate denial). If Clerks Division approves payment receipt, then cheque or cash is sent to Finance to process payment. Car Owner Request to MTO: Tickets that are not paid up to 14 days after the due date are extracted from Ticket Processor and a text file is produced to be sent to MTO, which sends back a text file containing the car owner information. A Text file is received by clerical personnel and uploaded into Ticket Processor. If the information received from MTO is inconsistent or the car owner information can not be found, the ticket is cancelled. Distribution of Manual Ticket Books: Parking ticket books are distributed at the Clerks Division. To obtain a book, a document identifying the number sequence of the book must be signed by the recipient/parking control officer. However, no identification is requested, as the recipients are usually in uniform. Ticket Processor Audit Trail: Ticket Processor records audit trails. However, there are no customized reports to be used for monitoring purposes. In order to check all the operations done by clerical personnel, a query needs to be run against the database. @ Deloitte & Touche LLP and affiliated entities. Recommendation - June 2004 Drop-box content should be directed to Finance to count and document the payments received. A list of payments should then be sent to the Clerks Division to identify whether payments should be processed or returned to the customer. Cancellation due to inconsistent or lack of information should be co- signed by two clerical personnel. Any exceptions from the policy should be approved by management and reasons noted. Management should review cancellations on a regular basis. Ticket books should be given to authorized personnel upon presentation of identification document. Clerks Division should keep track of which officer collected which books. Periodic reconciliations should be performed by an independent party to ensure ticket books are being used appropriately (i.e. if there are no tickets missing nor gaps in the sequence). Customized reports should be developed to allow management to monitor Clerks Division activities. Management Comments - July 20, 2005 Follow up - October 19, 2005 Finance document through a log the cheques I Management comments address received and send to clerical personnel for the recommendation and have verification. Payment is processed once the been implemented. verification is received. In accordance with the cancellation procedures, all cancellations are reviewed by two clerical personnel and final review and approval by the Manager, By-law Enforcement. A log book for sign out of the books have been established. A copy of the officer identification is kept with the log book for verification purposes. Periodic reconciliations will be undertaken by an independent person. . An RFP for the handheld units has been prepared and specifications have been developed to ensure customized reports can be developed. With the existing units, customized reports cannot be obtained. A cancellation policy requiring co-signing by the two clerical personnel plus management signature for exceptions has been implemented. This policy is consistent with the recommendations, however, it is inconsistent with management comments. Management comments address the recommendations. Management has implemented a log book for the sign out of the books which keeps track of the officer who collected the books. Officer identification and periodic reconciliation were not evident. RFP is still outstanding thus recommendation has not been implemented. City of Pickering - Clerk's Revenue Process 7 Q ~ CJ1 @ Deloitte & Touche LLP and affiliated entities. . elOI Deloitte, one of Canada's leading professional services firms, provides audit, tax, consulting, and financial advisory services through more than 6,100 people in 47 offices. Deloitte operates in Québec as Samson Bélair/Deloitte & Touche s.e.n.c.r.1. The firm is dedicated to helping its clients and its people excel. Deloitte is the Canadian member firm of Deloitte Touche Tohmatsu. Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, its member firms, and their respective subsidiaries and affiliates. As a Swiss Verein (association), neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other's acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names "Deloitte," "Deloitte & Touche," "Deloitte Touche Tohmatsu," or other related names. Services are provided by the member firms or their subsidiaries or affiliates and not by the Deloitte Touche Tohmatsu Verein. e 0 ~ ~ Member of Deloitte Touche Tohmatsu