INTERNAL AUDIT REPORT.doc

INTERNAL AUDIT REPORTStockton City CouncilMayorGary A. PodestoVice-MayorGloria C. NomuraCouncil MembersSteve BestolaridesRichard F. Nickerson, MDLeslie Baranco MartinFrank “Larry” RuhstallerGary S. GiovanettiCity Auditor F. Michael TaylorOFFICE OF THE CITY AUDITORAudit ReportSYSTEM EVALUATION: GOLF COURSE CASH RECEIPTSMay 2004Stockton, CaliforniaMay 18, 2004Stockton City CouncilAUDIT SUMMARY SYSTEM EVALUATION: GOLF COURSE CASH RECEIPTSIn accordance with our 2002-2003 audit plan, we have completed an audit of Golf Course Cash Receipts. Our audit was conducted in accordance with Generally Accepted Government Auditing Standards.The objective of our work was to determine whether the Citys golf course cash handling practices were in accordance with the Citys policies and procedures, and effective in assuring that golf course cash receipts were adequately protected. In addition, we examined current practices involving cash handling operations at each golf course to assess whether the Citys assets were properly safeguarded. The results of our audit were communicated to management.Our conclusions were based on conditions noted during the examination of golf course operations, interviews with City staff, and review of selected transactions. We conclude that serious weaknesses existed in the way golf course transactions and funds were handled, recorded and deposited. Because of these weaknesses, we believe the City has experienced financial losses. Parks and Recreation has taken significant steps in addressing the weaknesses noted. Conditions still needing attention include; oversight of money handling, control over gift certificates and golf passes, inadequate chain of custody over cash, noncompliance with Council fee schedule, inadequate safeguarding of cash, ineffective use of surveillance equipment, failure to obtain cash handling training for employees, and lack of written policies and procedures. We reported the above conditions to management and will perform follow-up procedures on implementation of managements corrective action plans.Although some losses have been quantified, overall control weaknesses make it impossible to calculate how much additional revenue should have been recorded and deposited.We would like to express our appreciation to the Parks and Recreation Department for their cooperation during the course of our audit, and to Administrative Services Department staff for bringing their concerns to our attention./Original signed by/Original signed byF. MICHAEL TAYLOR, CIAFRANK DEMATTOS, CPA, CIA CITY AUDITORSENIOR DEPUTY CITY AUDITORFMT:FBD:mgemc:Mark Lewis, Esq., City ManagerJayne Williams, Interim City AttorneyKatherine Gong Meissner, City ClerkJohnny Ford, Deputy City ManagerPamela Sloan, Parks and Recreation DirectorMark Herder, Chief of PoliceMark Moses, Administrative Services OfficerMacias, Gini & Company, LLPThe RecordTABLE OF CONTENTSSystem Evaluation: Golf Course Cash Receipts PageAudit SummaryAudit ReportBackground . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Objective and Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Audit Results. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3SYSTEM EVALUATION: GOLF COURSE CASH RECEIPTSWe have completed an audit of the Parks and Recreation Golf Course Cash Receipts as part of the 2002-2003 Audit Plan. Our audit was performed in accordance with Generally Accepted Government Auditing Standards.BACKGROUNDThe City operates two 18 hole championship golf courses, and two 9 hole courses at three locations in the City; Swenson Park, Van Buskirk, and Lyons. Golf courses are operated by the City, and are intended to be self sufficient, generating revenue from green fees, golf lessons, driving range balls, golf cart rentals and the sale of golf merchandise. For the fiscal years 2002 and 2003, the Citys golf courses reported annual gross revenue of $2.31 and $2.49 million, respectively. Over the years, the City Auditors Office has conducted a number of assignments related to operations of the Citys golf courses. On May 11, 2001, the Office of the City Auditor issued an audit report evaluating cash handling and internal controls. The audit findings reported to the City Council included: Cash receipts were not being deposited daily Courses did not accept credit card or debit card payments The need to establish limits on the amount of cash in the cash register, and Receipts not being provided to customers for verification of payment by a course marshal.In recent years, the Citys golf courses have experienced significant changes in management structure. Previously, golf course pro shops were managed by independent contractors. With the termination of these agreements, the City took over full operations of the golf courses. During this transition period, the Parks and Recreation Department experienced turnover in upper management positions. In addition, during the 2002 fiscal year, golf courses were authorized and equipped to accept payment by credit cards, which represented a procedural change. Additional concerns related to the golf courses came to the City Auditors attention during a Cash Verification audit, issued March 10, 2003, in which routine cash counts were conducted at various locations including the golf courses. Based on our audit results, we noted a need to perform further audit procedures on golf course operations due to serious weaknesses in cash receipts balancing procedures at the golf courses. We, therefore, included this system audit of golf course cash receipts in our audit plan. We also recommended the need for city-wide cash handling training and included unannounced cash counts in the current 2003 - 2004 audit plan. During one of our routine monthly cash count audits, Administrative Services Department staff communicated concerns regarding a cash deposit submitted by one of the golf courses. Because this situation directly related to control weaknesses System Evaluation: Golf Course Cash ReceiptsCity CouncilMay 18, 2004Page 10previously identified during our audit of golf course cash receipts, we expanded testing once again. We have incorporated in this report the most critical issues that came to our attention during this audit.OBJECTIVE AND SCOPEThe objective of our audit was to determine whether City golf courses were adequately safeguarding assets. Specifically, we focused on the handling, reporting, and depositing of cash receipts. Where internal control weaknesses were observed, we sought to identify the cause and provide management recommendations for improvement. To achieve the objectives of the audit, we focused the scope of our work in the following areas: Assess the adequacy of controls to safeguard cash, golf passes, and gift certificates. Review the cash receipts and daily reporting processes to determine whether data from the cash register and credit card Point-of-Sale (POS) system are reconciled, and any difference investigated. Evaluate the implementation of the new cash register system, and assess whether the expanded functionality addressed control weaknesses previously identified. Determine whether the control weaknesses observed have resulted in losses to the City.We tested golf course transactions and observed procedures from September 27, 2001 through January 15, 2002. We expanded our scope to evaluate changes subsequent to December 2002 due to implementation of a new cash register system. We wanted to determine whether changes demonstrated correction of conditions that were noted during the September 27, 2001 through January 15, 2002 period and continued fieldwork through February 2004.Because of matters brought to out attention as a results of a cash count performed at Swenson Park golf course on March 17, 2004, the scope of this audit was expanded to the audit of cash deposits at Swenson Park golf course for the period of October 16, 2003 through March 20, 2004. In addition to the audit of cash at Swenson Park golf course, we included an examination of compliance with the Citys fee schedule related to green fees, and services and products sold to customers. We could not test transaction detail prior to October 16, 2003, because the necessary documentation was not retained when records were transferred from paper documents to electronic media.METHODOLOGYTo gain an understanding of the internal control systems in place at City golf courses, we interviewed City staff, observed day to day operations, and reviewed available policies and procedures. For selected time periods, we obtained supporting documentation related to the daily receipts for each of the golf courses. We tested the supporting documentation to determine whether: Transaction Summaries generated by the credit card POS system matched the daily cash register tapes. Individual checks included in the daily deposit matched the daily cash register tapes. Cash register total receipts matched amounts deposited to the Citys bank account.Our review included analysis of cash, check, and credit card procedures and review of daily cash register tapes. We examined how daily cash receipts are prepared and deposited, and what oversight was performed by management. We assessed internal controls related to golf passes and gift certificates, as to physical security, distribution, and tracking of sales and redemptions. We made inquiries to gain an understanding of how sales of golf passes and gift certificates were conducted. We reviewed available logs and traced transactions back to supporting documentation. We also reviewed processes related to the handling of tournaments fees, and the method of tracking deposits paid by customers.During the course of the audit, management replaced the cash registers with a computerized cash register system. We examined the capabilities of the computerized cash registers, and how the new functionality was utilized. Our review included examining internal controls over inputs and outputs produced by the cash register system.We compared the fees charged at City golf courses with the Council approved fee schedule effective January 1, 2004, noting any discrepancies.AUDIT RESULTSBased on the results of our audit, we conclude that significant weaknesses exist in the controls to safeguard and account for cash and other assets at the Citys golf courses. During the course of this audit effort, and in prior work conducted by the City Auditors Office, we have communicated these deficiencies to management, and provided them with our recommendations for improvement. However, many of the issues we observed during our first observations continue to be an issue, and have resulted in financial losses to the City.Although some losses have been quantified, overall control weaknesses make it impossible to calculate how much additional revenue should have been recorded and deposited.Inadequate Oversight of Money HandlingDuring our initial work in golf courses, we found that the cash registers were not programmed to show the tender type on transactions (e.g. cash, check, credit card, gift certificate). The lack of this feature reduced the effectiveness of detailed transaction reviews. We were, however, able to identify a number of credit card transactions at Van Buskirk golf course that were not recorded in the cash register, but were used in daily balancing. This allowed money to be removed from the register, with supporting documentation appearing to balance. At the time of our audit work, none of the individuals who were potentially responsible were still employed by the City. We also found that employees were allowing customers to write checks for more than the amount of their purchase and get the difference back in cash. Additionally, employee paychecks were being cashed out of the register. We were not able to determine if any of these conditions existed at the Citys other golf courses, because those courses were not retaining documentation necessary for testing.In response to this discovery, management made changes to the cash register system to record tender type on each transaction. Management also installed equipment at each golf course to allow printing of reports and currently these reports are routinely printed. This improved the internal control design, providing management additional resources to monitor cash register activity.Following an unannounced cash count on March 17, 2004, Auditing continued to identify discrepancies between credit card totals from the credit card system and the cash register at Swenson Park golf course. Detailed tests showed that several credit card transactions were never recorded in the cash register, but those transactions were used in daily balancing. Testing also revealed several credit card transactions were recorded in the cash register as redemptions of gift certificates, which is a transaction type that does not involve the receipt of any money. These conditions mean that not all the money received at Swenson Park was deposited into the Citys bank account. Between October 16, 2003 and March 20, 2004, at least $1,823 cannot be accounted for due to these conditions.Additionally, credit card receipts totaling $590.92 for December 22, 2003 were used in balancing for the day, but because the credit card POS batch was not closed, the transactions were not transmitted to the bank. On December 23, 2003, those transactions were transmitted to the bank, and were used to balance to the cash registers total transactions for December 23, 2003. This means that $590.92 in credit card transactions were counted twice at the Swenson Park, without accounting for an equivalent amount of cash.Interviews of cashiers at Swenson Park golf course revealed that some cashiers will occasionally allow customers to write checks for more than the amount of purchase, and get the balance back in cash.Managements Action Plan:Parks and Recreation golf staff in charge of reviewing deposits will be trained in reconciling credit card transactions back to cash register tapes. Managers and supervisors will be trained more thoroughly in cash register operations so that they can recognize whether differences are the result of unrecorded transactions or cash entry errors.Checks will only be accepted for the amount of the purchase. All staff will be trained to follow the Citys check acceptance procedures required by Administrative Directive FIN-029. Corrective action will be completed by June 30, 2004.Inadequate Controls Over Gift CertificatesEarly in our work, we communicated to management that gift certificates were not monitored or properly controlled by the Parks and Recreation Department. The weak controls were serious enough that the risk of financial loss appeared to be high. Certificates were not pre-numbered, and there was no tracking of sales or redemptions.In response, the Parks and Recreation Department began using pre-numbered, two part forms for gift certificates. This design change provided an opportunity to improve controls over gift certificates, but control weaknesses remain.Outstanding gift certificates represent a liability to the City, yet the City has no way of determining the number or value of outstanding certificates. As certificates are sold, the certificate number and amount are not recorded. In addition, the Citys copy of the issued certificate is not always retained; many are immediately placed in the trash. We observed this practice during one of our on-site interviews.As gift certificates are redeemed, the City does not retain any documentation to support the actual use of the gift certificate. It is possible to enter a transaction, accept payment by cash, check or credit card, but record the tender type as a gift certificate. We have documented instances of this occurring at Swenson Park golf course when a credit card was used to make a purchase, but the transaction was recorded as being paid by gift certificate. This allowed cash to be removed from the cash register and still have daily totals balance.Managements Action Plan:Effective immediately, copies of all gift certificates sold will be retained and logged. As customers use gift certificates, the certificate number and remaining balance will also be logged.We will change the form of gift certificates to handle them under the same procedures as golf passes as referenced in our response to our management action plan for golf passes. The gift certificates will be designed to have pre-numbered magnetic strip cards similar to a credit card. Staff will have the ability to include the amount of the certificate on the magnetic strip. Once the new gift cards are in place, we will recall outstanding gift certificates and issue gift cards for the remaining balances. Corrective action will be completed by May 19, 2004.Inadequate Controls Over Golf PassesThe Parks and Recreation Department sells golf passes. Our review of the golf pass system of sales, distribution and monitoring identified a number of internal control weaknesses.The physical stock of golf passes was not adequately controlled. In addition, we noted that the monthly logs maintained to track the sale of passes were missing. The mos