Audit of the City’s Vendor Master File Maintenance and 1099...Regular interaction and maintenance...

Internal Audit City Manager’s Office A18-FIN-VMF05

Audit of the City’s Vendor Master File Maintenance and 1099

Processes

Office of the City Manager

Internal Audit City Manager’s Office A18-FIN-VMF05

DATE: October 29, 2018 TO: Steve Mermell, City Manager FROM: Ruthe Holden and Rebecca Takahashi, Internal Audit Division SUBJECT: Audit of the City’s Vendor Master File and 1099 Processes As part of our FY 2018 Audit Plan, Internal Audit conducted an audit of the City’s compliance to City policies related to the accuracy and completeness of the City’s vendor master file and 1099 processes. Based on our audit, we identified seven issues related to these processes that need to be addressed of which four are considered high priority and three are medium priority. There are 15 recommendations associated with these seven findings which when implemented should strengthen the internal controls. One issue was corrected during the course of the audit. A description of our prioritization is located on page 22. We would like to thank the Finance, Information Technology, Humans Resources, and the various departments we engaged for their cooperation and providing key data needed for this review. cc: Julie Gutierrez, Assistant City Manager Nicholas Rodriguez, Assistant City Manager

Jennifer Curtis, Director, Human Resources Matthew Hawkesworth, Director, Finance

Phillip LeClair, Director, Information Technology William Huang, Director, Housing and Career Services

Audit of the City’s Vendor Master File and 1099 Process

Internal Audit City Manager’s Office 1 A18-FIN-VMF05

INTERNAL AUDIT OCTOBER 29, 2018

VENDOR MASTER FILE & 1099 PROCESS

AUDIT REPORT HIGHLIGHTS

1. Why We Did This Audit

The 2014 KPMG and the 2015 Citizen Task

Force reports were prepared as a result of the

alleged misappropriation of City of Pasadena

(City) funds, and both recommended that the

VMF be audited on a periodic basis.

The VMF is an important internal control to

ensure that the purchasing and payment of

goods and services is appropriate and that

only legitimate City vendors are paid.

The VMF is a database that contains a

considerable amount of data on vendors doing

business with the City. As such, it is important

that best practices are employed when

adding, maintaining and deactivating vendors.

The Internal Revenue Service (IRS) requires

that certain vendors be issued a form 1099 at

year-end summarizing the revenue received

from the City. The City may incur significant

penalties if the 1099s are not issued timely or

if not all required vendors receive a 1099.

The purpose of this audit is to evaluate the

accuracy and completeness of the VMF

database and of the vendors that should

receive an IRS Form 1099.

2. What We Found

There has been significant improvement in

the maintenance of the vendor master file

(VMF) and the process of issuing an IRS

Form 1099 to vendors since KPMG and the

Task Force on Financial Administration and

Internal Controls issued their reports.

Based on our audit, there are four high-risk

issues and three medium risk issues that

should be addressed to further strengthen

the internal controls over the vendor master

file database.

The high-risk issues identified are:

Inadequate Segregation of Duties

Strengthen Access to VMF

Collect potential conflict of interest data

Strengthen review of nonprofits/ charities

3. What We Recommend

The 18 recommendations detailed in the report include

updating current processes & forms,

limiting or eliminating current access to the VMF database,

updating City outside employment related forms and policy, and

updating vendor information in VMF.



Background

Why We Are Doing This Audit

In 2014, KPMG issued a report based on its review of suspected misappropriation and misuse of

City funds concerning the City’s Underground Utility Program. The report contained several

comments related to improving the City’s internal controls over the vendor master file (VMF),

including a recommendation for periodic audits of the VMF.

In 2015, the Task Force on Financial Administration and Internal Controls issued a report after

reviewing and assessing the City’s financial statements, administration and controls. The Task

Force made recommendations for change to prevent future misappropriations of funds and

improve the integrity and usability of City financial statements and information. The Task Force

made several recommendations, including increasing the control over the master list of vendors

and contractors and verifying the legitimacy of vendors in the VMF database.

The City’s List of Payees are Maintained in the Vendor Master File within Munis

The vendor master file (VMF) is a database composed of vital business information for

individuals or businesses that provide goods and services to the City of Pasadena. Important

vendor information found in the VMF include data such as a vendor’s business name, physical

and mailing addresses, W-9 form containing a tax identification number (TIN)1, and other

needed documentation. The VMF also tracks vendors that are required to be provided an

Internal Revenue Service (IRS) Form 1099 based on the specific payment type, amount, and

business. This information is stored and maintained in Munis, including images of hardcopy

documents provided by a vendor or department.

The IRS can issue a penalty of $50 to $260 for each form that is not issued timely, with a

maximum penalty of $3,218,500 per year. The penalty for form 1099s that have intentionally

been disregarded and not issued is $530 per form, with no maximum penalty. It is important

that the information contained in the VMF is accurate and complete as it relates to 1099

information to minimize the risk of incurring IRS penalties.

The City’s Purchasing and Accounts Payable processes depend on a properly managed and

functioning VMF. Regular interaction and maintenance of the vendor data within the VMF is the

primary responsibility of the Purchasing division within the Finance department. The Purchasing

Administrator is the person responsible for monitoring compliance to the VMF policy. However,

staff and management citywide are responsible for gathering and updating vendor information

for their procurements. It is critical that VMF policies and procedures prevent unauthorized or

inappropriate activity, duplicate payments, or inefficiencies.

1 A TIN is assigned either by the Social Security Administration (social security number) or by the Internal Revenue Service (Federal Employer Identification Number).



Vendor Status Classification

As of February 15, 2018, there are 10,605 vendor entries in the VMF. Table1 shows the count of

vendors by status. In the VMF within Munis, a vendor is coded as active, inactive, stop/do not

use or other status type.

Table 1: Vendor Master File Status by Count

Status Count Description of Status

A (Active) 8474 Vendors actively doing business with the City in the last 2 years. Allows for a requisition or contract to be assigned to them, and payment to be processed by Accounts Payable.

I (Inactive) 903

Vendors that are not currently doing business with the City. This status allows a requisition or contract to be assigned to them, but does not allow for AP to process a payment. In order to be paid, an inactive vendor would need to be reactivated.

Stop 1216 Vendors that are no longer doing business with the City and are not able to assigned a requisition within the financial system or receive payment.

Other status type

12 Identified as another status type (One time and B)2

Source: Analysis of Vendor Master File export provided by the Finance Department as of 2/15/2018

In addition to vendors that provide contracted goods and services, the VMF also contains

vendor records related to employee reimbursements, refunds and rebates for utility customers,

permit refunds related to construction and development projects, course registrations,

transportation citation or permit refunds, liabilities/claims payees, and other one-time

payments. Additionally, landlords/property managers participating in the City’s Section 8

housing program receiving monthly housing assistance payments are vendors in the VMF

database.

Process for Adding New Vendors to the Vendor Master File (VMF)

To setup a new vendor in the VMF, designated employees within each department collect the

required information from the vendors and forward to vendor set up for processing.

Department staff are expected to conduct a search for the vendor in Munis, the City’s financial

systems software for the VMF to avoid adding a duplicate vendor. To request a new vendor be

added to the VMF, the designated employee(s) must submit required documentation including

a completed vendor questionnaire form, signed and dated W-9 form with a physical address, a

Pasadena business license (if applicable) at the time of the award, and a remittance address. If

the vendor lists a PO Box as a primary address, then the vendor is required to provide a physical

street address via the vendor questionnaire or a signed/dated letter on their letterhead. A high

2 “O” vendor status type is used for one-time vendors, such as refund or rebates to customers. “B” status is for bidder not currently being used, according to Finance staff because it is linked to a Munis module that has not been purchased by the City. There is one vendor that has been coded with a “B” status.



level overview of the process whereby the City adds new vendors to the VMF is provided below

in Figure 2.

Source: Analysis of Vendor Master File Policies and Procedures

IRS 1099 Process

As part of the vendor information entry process, through the W-9 review, Purchasing staff

determine if a vendor is required to file a Form 1099-MISC with the IRS. A Form 1099-MISC is

required for each person and/or entity the City has paid at least $10 in royalties, broker

payments, or tax-exempt interest and at least $600 in rents, services performed by a non-

employee, prizes, and other specific business activities. Payments that do not have to be

reported on Form 1099-MISC, include payments to a corporation (except doctors and lawyers),

wages paid to employees, payments to tax-exempt organization, and other business activities.

The City is responsible for establishing 1099 reporting and backup withholding compliance

standards for 1099 eligible payments. Figure 3 below provides the general overview of the

process the City uses to issue a master 1099 report to the IRS annually.

Figure 2 - Steps to Add a New Vendor to the Vendor Master

File



Source: Analysis of 1099 Reporting Policies and Procedures

In addition to regular vendors, the City of Pasadena also files 1099s for vendors paid for

worker’s compensation-related services. The City uses a third-party administrator (TPA) to

process worker’s compensation medical services, including the payment of service providers.

The TPA pays the providers, and then requests reimbursement from the City on a monthly

basis. The City then pays the TPA for the expenses incurred through a trust fund account. The

TPA is required to verify that the service providers are legitimate and collect evidence of their

existence as a service provider, including the collection of TINs and other identifying

information needed to provide 1099’s to these providers.

Figure 3 - Steps to Issue a Master 1099 Report to the IRS



Objectives

The objectives of this audit were to review the accuracy and completeness of:

vendor information in the VMF database used to review and approve payments; and

vendors classified as required to receive IRS 1099 reports from the City of Pasadena.

Scope

The scope of our review were payments made to vendors from July 1, 2016 through December 31, 2017. In order to determine trends or systemic issues, we also reviewed prior payments or documents relevant to transactions that occurred in the scope period.

Methodology

In order to test our objectives, our review included the following procedures:

Reviewed relevant Federal, State, and local laws and regulations concerning vendors

Reviewed relevant Citywide and Departmental policies and procedures related to adding and updating vendors to the VMF database

Reviewed available documentation and transaction history in Munis

Reviewed best practices related to VMF management and maintenance

Interviewed staff and management from Finance, DoIT, and relevant City Departments

Compiled and analyzed Accounts Payable and VMF data from Munis

Using an outside contractor, ran comprehensive data mining inquiries to extract vendor data for duplicates, addresses with PO Boxes, and matches to employee/beneficiary names and addresses3

Using IDEA4, compiled and summarized transaction data for statistical sampling and trend analysis

Requested and analyzed a list of the top paid vendors during the scope

Reviewed select department files for samples of vendor documentation from Housing, Water and Power, Planning, Public Works, Transportation, and Finance for validation

Considered and assessed the adequacy of internal controls governing citywide and

departmental procedures for paying vendors

This project is an audit and was conducted in accordance with the Standards of the Institute of Internal Auditors (Standards). These Standards encompass such matters as the independence of City of Pasadena Internal Audit Division, objectivity, proficiency of staff, due professional care, the scope and performance of work activities, and the management of the internal auditing function. Our work included examining, on a test basis, evidence supporting transactions in the operating records and applying other procedures we considered necessary under the circumstances. It also included assessing the judgments and decisions made by management.

3 The contractor was provided with the VMF as of 02/15/2018. Subsequent analysis of the results occurred after this date, where updates to the vendor’s status may have occurred as part of ongoing VMF maintenance by the Purchasing division. 4 IDEA software is a data analysis tool used by the City to analyze data.



We believe that our work provides a reasonable basis for our issues, conclusions, and recommendations.

Overall Results

Significant improvements have occurred in the last 3 years to enhance processes and internal controls to verify the accuracy and completeness of vendor information in the City’s vendor database and in the accuracy of vendors classified as 1099 reportable vendors.

However, during the course of our audit, we identified seven issues with corresponding recommendations that will strengthen internal controls and improve processes related to Vendor Master File maintenance and issuance of IRS Form 1099s. There are four issues categorized as high risk and three issues categorized as medium risk5.

The high-risk issues identified during the audit are:

1. Inadequate segregation of duties when processing refunds or rebates 2. Strengthening access to VMF database 3. Potential conflict of interest data for procurements not collected 4. Nonprofit and charitable organizations not adequately reviewed

The medium risk issues identified during the audit are:

5. Potential duplicate vendors identified in VMF database 6. Updated W-9s needed for vendors receiving Housing Assistance Payments 7. Accuracy of 1099 related information

A detailed description of the 7 issues and 18 associated recommendations are discussed in detail on the following pages. The issues are listed in this report in the order of the risk associated with the issue.

5 The risk ranking criteria used to rank the issues identified during this audit is included in Attachment A on page 28 of the report.



Issues

Issue 1: Inadequate Segregation of Duties in Processing Refunds and Rebates

Issue Risk: High

Refunds and rebates were included in the scope of this audit because they are set up as one-

time vendors in the VMF database. One-time vendors is a known area of risk and so the

processes that used this function were reviewed.

Refunds and rebates from various departments are routinely compiled and submitted to

Accounts Payable by the same staff person in a department without review by the signature

authority, creating a segregation of duties issue that could lead to fraud or misuse.

Per the Committee on Sponsoring Organization’s Internal Control Framework (COSO), control

activities are the actions established through policies and procedures that help ensure that

management’s directives to mitigate risks to the achievement of objectives are carried out.

Control activities may be preventive or detective in nature and include a range of manual and

automated activities such as approvals, verifications, reconciliations, and business performance

reviews. Segregation of duties are usually built into development of control activities; however,

where segregation of duties is not possible, management must implement alternative control

procedures to compensate.

Individual Invoice Payment Process

In the current financial system, individual invoices and payment requests are processed through

a workflow approval sequence, where the request for payment is approved by an individual

that has the designated signature authority to do so after ensuring that the good or service was

received by another individual in accordance with terms and conditions. Once the needed

approvals are received, the payment is sent to Accounts Payable to pay the vendor. The

documentation supporting the individual invoice payment is accessed through the Accounts

Payable module.

Refund and Rebate Payment Process

However, in the case of refunds and rebates, there is no electronic payment workflow, these

payments are compiled for approval in excel documents and submitted and processed in Munis

using bulk batch requests. One issue identified when observing this process to pay bulk

requests for refunds, rebates, or other large batches of payments is that the financial system

Munis does not allow for large batches to be processed through a workflow. Instead, staff has

to compile refunds and rebates as a request for check for multiple payees, with the needed

information standardized on an excel file to be uploaded into Munis for Accounts Payable

processing. A request for check form is submitted with signatures, and supporting

documentation is loaded into Munis, but is accessed through the Journal attachments.



We interviewed several City departments that utilize these types of requests, to learn about

their process to validate and verify refunds or rebates due. We found that in general, there is a

segregation of duties risk in their respective processes as the same person who prepares the

batch requests, also gathers the needed wet signature from an authorized individual, and

submits the final request and supporting documentation to Finance. Finance relies on the

manual request for check form signatures to process the request. Finance also communicates

and sends information about the payments to the same person submitting the request. In this

process, it is possible for someone to potentially manipulate payee information or add fictitious

vendors after obtaining the needed signatures. Without separating the duties required to make

these types of batch payments, there is a risk payments may be made to fictitious or otherwise

inappropriate vendors.

Recommendation 1: The Director of Finance or his designee should:

Direct each submitting department to have the authorized approver submit these batch

processed rebates/refunds directly to Accounts Payable with a copy to the Accounts Payable

Supervisor for processing with supporting documentation including item count and dollar

totals. The Accounts Payable Supervisor will verify that the control total and item counts match

to the actual disbursement.

Management Response:

The Finance Director agrees with this recommendation and has implemented an immediate

corrective action and is working with DoIT to implement an automated workflow to streamline

refunds and rebates as a long term solution. The Finance Director’s response to the audit is

included in Attachment B.



Issue 2: Access to VMF Database Needs Strengthening

Issue Risk: High

Certain DoIT and Finance staff have access to the VMF and other areas of the Accounts Payable

module within Munis that they may not need.

One key control activity to maintain the integrity of a VMF database is adequate segregation of

duties for both manual and automated processes. Industry best practices recommend having

the Controller responsible for approving system access to add/modify vendors in the VMF.

Additionally, Human Resources is responsible for notifying the Department of Information

Technology (DoIT) of terminated or transferred users. All changes to system access must be

made in writing and submitted to DoIT.

At present, department representatives submit a DoIT generated form for a new employee to

receive access to Munis, specifying which modules and functions that the employee will need

to have access. These requests are then sent to DoIT’s Enterprise Resource Planning (ERP) team

to review and approve. In our review of system user access by role and user, we found two

Finance users have been assigned roles with conflicting duties. The Purchasing Administrator in

Finance was granted system administrator access to allow completion of needed year-end

reporting, but this access was not disabled or monitored. The Fiscal Services Administrator had

the ability to review and approve payments, and was also granted access to the senior buyer

role, which allowed access to edit the vendor6. These represent a segregation of duties issue in

the accounts payable process, as the same users had the ability to edit vendor data and process

payments in the Financial System.

In addition, the ERP team has Test Users in the Production database to allow for easier set up of

the test environment when testing is needed on version upgrades. These Test User roles are

accessible to the ERP team, and because of the roles assigned to them, have the potential to be

misused by an employee with access to them in the production environment to set up fictitious

vendors and/or process payments. The Test User roles were not being monitored in the

production environment.

We also found that there is no periodic review of Munis user access to validate that the

requested access is valid and appropriate, other than the initial department request. There is

no systematic access review when an employee separates from the City, transfers to another

department or is promoted/reassigned within the same department to ensure they do not have

conflicting duties with their current and former roles. Additionally, Munis does not

automatically detect if a user is assigned potentially conflicting duties/roles in a module.

Without automated or manual processes to control access rights, employees may be granted

6 This employee is no longer employed by the City at the time of the review and this user’s access was terminated in the system after their separation.



rights to access vendor data that would allow them to produce a false payment or other form of

vendor-related fraud.

As of March 2018, the City Controller and DoIT have agreed to develop a process to monitor

individual’s access rights for Munis financial modules based on the Controller’s determination

of signature authority, and DoIT will review access rights with department business owners for

all other modules on a periodic basis.

A summary of the conflicting access roles, data privileges, and staff assignments are

summarized in the tables 2 and 3 below.

Table 2: Munis Permissions and Segregation of Duties Conflicts Based on Role

ROLE

Accounts

Payable

Staff

Accounts

Payable

Supervisor

Buyer SR

Buyer

MUNIS Private

Role (System

Administrator)

ROLE PERMISSIONS

Add vendors on-the-fly X X X

Allow vendor name

maintenance X X X

Maintain vendors X X X X

View/maintain vendor

banking information X X

ROLE DATA ACCESS

Allow vendor address

maintenance

NONE NONE FULL FULL FULL

Vendor maintenance access

by type

NONE NONE FULL FULL FULL

Source: Auditor analysis of users and their assigned role permissions from Munis User Administration Reports



Table 3: Staff Assigned to Roles and Conflicts with Assignments

Department Staff Roles

Finance

Accounts

Payable

Staff

Accounts

Payable

Supervisor

Buyer Senior

Buyer

System

Administrator

Fiscal Services

Administrator X X

X

DoIT (4) X

Purchasing Administrator X X

Test User 1 X X X

Test User 2 and 3 X

Source: Auditor analysis of users and their assigned role permissions from Munis User Administration Reports.

Recommendation 2-1: In addition to the process developed by Finance and DoIT for reviewing

and granting access rights, the Director of Finance or his designee should also:

a) Require specific procedures to request written Finance Director approval for system

administrator roles and/ or otherwise conflicting roles. Additionally, employees granted

System Administrator rights should be monitored on a periodic basis to ensure their

access is still appropriate.

b) Develop procedures to remove granted access rights due to employee separation or

transfer.


The Finance Director agrees to work with DoIT to periodically review existing user access rights

and develop procedures for authorizing system administrator or otherwise conflicting roles.

The Finance department is working with DoIT to develop a procedure for removing access

rights due to employee separation or transfer. The Finance Director’s response to the audit is

included in Attachment B.

The Information Technology Director agrees that the implementation of the recommendations

will strengthen the internal controls associated with these functions and processes. In addition,

the test users in the production database have been deactivated. The Department of

Information Technology’s response to the audit is included in Attachment B.



Recommendation 2-2: The Director of Human Resources or her designee should:

a) As part of the personnel action process, develop a procedure to require departments to

indicate the citywide and department specific applications the separating employee has

access to, noting if this access should be deactivated or modified based on business

needs. This information should be provided to DoIT or department system administrator

to make the needed access changes.


The Human Resources Director agrees to provide a more formal mechanism to modify system

access for employees who promote or transfer as part of the personnel action approval

process. The Human Resources Director’s response to the audit is included in Attachment B.



Issue 3: Potential Conflict of Interest Information Not Collected

Issue Risk: High

The City is not effectively collecting vendor information that may require special oversight or

disclosure to prevent or detect conflicts of interest, or require special reporting to the IRS.

The City’s Manual of Personnel and Administrative Rules section on conflicts of interest strictly

prohibits any outside employment or other activities or relationships that create any actual,

potential or apparent conflict of interest. As a general rule, no employee shall engage in any

transactions or have any personal or financial interest, direct or indirect (as defined in the City’s

Conflict of Interest Code) which would lead an objective, reasonable person to believe that

independence of judgment or action in the performance of official duties would be impaired.

Based on these considerations, employees may not own or actively participate or engage in any

outside business activities or employment relationship without obtaining the prior, written

authorization of the employee’s department director and the Human Resources Department

for a specific outside relationship.

In our review of the VMF database, we performed name and address matching of employee

name and addresses. 21 vendors in the VMF database have addresses associated with current

or former employees that were paid for providing non-employment related services for the

department the employee either worked in, or had a direct relationship with a vendor that

provided services for the employee’s department. Of this 21, 12 vendors in the VMF database

may have a potential conflict of interest based on name or address association with an

employee7.

Of the 12 vendors with potential conflict, six of them clearly match a paid vendor to a City

employee. These relationships may present a conflict of interest as noted in the policy and

represent potential violations of the City’s purchase order terms and conditions, as well as the

City’s outside employment policy. None of these employees disclosed their business

relationship and payment via an outside employment form. These relationships on appearance

can present a conflict of interest as noted in the policy. Additionally, we identified one instance

of a department requesting payment to purchase tickets for an employee to attend an after-

hours retirement party.

The current vendor questionnaire does not require vendors to sign that they certify the

information they provide is true or hold them accountable to review and agree to the PO terms

and conditions. The form also does not provide a space for vendors to disclose or indicate if

they have a relationship with anyone in the City that may be perceived as a conflict, and if they

7 The remaining nine were associated with vendors that may have had the same surname or address as an employee, but provided services to a department different from the employees or could not be reasonably associated with the employee. The information on potential conflicts was provided to Human Resources to review and investigate as necessary.



have taken the steps necessary to get the written authorization by the appropriate authority to

do business with the City.

Audit referred the identified potential conflicts to Human Resources to investigate. Human

Resources conducted their review, and noted that departments associated with the employees

with potential conflicts were advised to strengthen staff training on City procurement policies.

Employees Paid for Services as an Independent Contractor

The City’s purchasing terms and conditions that are attached to a purchase order require the

vendor to affirm they are an independent contractor and not an employee or agent of the City

and shall furnish such services in its own manner and method except as required by this

Agreement. The City’s purchase order terms and conditions also include a “No Conflict” clause,

which states:

“Vendor hereby represents, warrants and certifies that no officer or employee of the

Vendor is a director, officer or employee of the City of Pasadena, or a member of

any boards, commission or committees, except as permitted by law.”

Based on a December 2012 determination, the Internal Revenue Service (IRS) allows a worker

to be considered both an employee and independent contractor, but each position must be

examined on a case-by-case basis. Code Section 31.3121(d)-1(c) (2) notes that an employer and

employee relationship exists when the person for whom the services are performed has the

right to direct and control the individual who performs the services not only as to the result to

be accomplished by the work, but also as to the details and means by which that result is

accomplished. The employer does not necessarily have to actually direct or control the manner

in which the services are performed; it is sufficient if he or she has the right to do so. Section

31.3121(d)-1(a)(3) of the regulations provides that if the relationship of an employer and

employee exists, the designation or description of the relationship by the parties as anything

other than that of employer and employee is immaterial. Thus, if an employer-employee

relationship exists, it is of no consequence that the employee is designated as partner, agent,

independent contractor, or other title. The IRS can make an official determination when

requested by a business using an SS-8 form.

Employees Receiving Housing Assistance Payments

Although not part of our sample testing, we found that a small number of City employees are property owners that participate in the City’s rental housing assistance program. This program is administered by the Housing program, which provides tenant-based assistance under the housing choice voucher program (voucher program) of the U.S. Department of Housing and Urban Development (HUD), also known as Section 8. These participating landlords receive a monthly subsidy payment for rent for tenants with Section 8 vouchers based on the HUD income-based rental limits for the metropolitan region.



Based on the current outside employment policy, it is unclear whether passive income or investment activities in the City of Pasadena such as rental income would be considered employment and therefore require disclosure by the employee. This information must be disclosed for employees subject to state California Fair Policy Practices Commission Form 700 filing, but not for other employee classifications. Without clarifying the policy of outside employment, the City is at risk of allowing an employee

to perform a job activity that could provide them a personal benefit or present another type of

conflict of interest. Also, by not strengthening and enforcing the current policies and

procedures for disclosing known conflicts of interests with a vendor, the City is at risk of

appearing to favor parties related to an employee and potentially prevent others from

competing for the City’s business. Additionally, it may be in the City’s best interest to seek an

official determination from the IRS for workers who are considered employees of the city and

also provide services as an independent contractor to ensure compliance with IRS rules related

to common law employees and 1099 reporting.

Recommendation 3-1: The Director of Finance or his designee should:

Incorporate the following evaluation guidelines into the Purchasing Handbook: Require

department directors to advise staff that select vendors for goods and services of the City’s

conflict of interest and disclosures policies, and develop a form or other document to provide

staff an opportunity to disclose any perceived or actual conflicts that arise in the vendor

selection process. Department directors should report on any conflicts of interest or absence

of any known conflicts by a department employee annually to Human Resources and Finance.


The Finance Director agrees with the recommendation and has revised the Purchasing

Handbook. In addition, the Finance Department will develop a form to annually solicit input

from each department director regarding the existence or absence of known conflicts of

interest unique to their department. The Finance Director’s response to the audit is included in

Attachment B.



Recommendation 3-2: The Director of Human Resources or her designee should:

a) Provide an official notification of any adopted changes to the outside employment

policy and disclosure process to current and new employees.

b) Review the current Outside Employment Policy and Disclosure form and update as

necessary to clarify what types of services or payments from the City would be

considered Outside Employment

c) Consult with the City Attorney’s Office and Director of Finance, if needed, to review and

determine which City employee-affiliated active vendors require an official IRS SS-8

determination.


The Human Resources department has agreed to discuss the need to broaden the outside

employment policy and to make needed changes if it is determined the policy should be

updated. The Human Resources Director’s response to the audit is included in Attachment B.



Issue 4: Nonprofit and Charitable Organizations Not Adequately Reviewed

Issue Risk: High

Special vendor types, such as nonprofit organizations that act as service providers for the City,

or receive charitable contributions are not being consistently validated using publicly available

IRS nonprofit and state business searches.

As noted in the City’s Purchasing Handbook8, there are conditions when new forms and

updated information may be required from prior or current City vendors, including the

questionnaire and W-9 form. This includes a vendor whose information was transferred from

the prior financial system, has worked with the City for more than three years, or if the vendor

has a change in ownership, name, or address.

We identified 18 vendors in the VMF database, which appear to be charitable or nonprofit

organizations that do not have any W-9, IRS, or other documentation to validate the

organization's existence. These organizations receive payroll deductions from employees as

part of a charitable donation program administered by the Employee Advisory Board. A total of

18 local and national nonprofit organizations receive payroll deductions from employees.

Figure 4: Organizations Registered as Nonprofits with the IRS

Source: Analysis of vendor types in Vendor Master File Database

8 Includes the policies and procedures referenced in the City’s Municipal Code and Financial Policies in the Manual of Personnel and Administrative Rules. This handbook is developed and maintained by the Purchasing division of the Finance Department.

11

6

1

Active

No Record

Status Revoked



Figure 5: Organizations Incorporated with the State of California

Source: Analysis of vendor types in Vendor Master File Database

Six of the 18 organizations in the VMF database are city employee associations9. These

associations are organizations formed by City employees for charitable or social purposes that

are funded by payroll contributions from City employees. Of these six organizations, only one is

an active nonprofit organization with the IRS and state. One organization had their IRS

nonprofit status auto-revoked and state designation revoked, while one other had their state

designation suspended. The remaining three have no record of being a tax-exempt entity or

other official entity with the IRS or the State of California.

Based on staff testimony, the nonprofits paid via payroll contributions have been participating

in the program for many years. They likely were not subject to the City’s vendor validation and

monitoring procedures outlined by the Purchasing Handbook. Purchasing’s primary validation

technique is to run a System for Award Management (SAM) report for all vendors. This report

was run for these 18 entities. This type of validation check is used to determine if a business

entity has been debarred from contracting with the Federal government. This type of check

would not identify if a nonprofit was a legitimate nonprofit registered with the IRS and/or a

respective state agency, or even in existence at present. Without conducting the proper

scrutiny of a nonprofit organization, the City may be processing payments from employee

contributions to organizations that are not valid or no longer in existence.

Recommendation 4: The Director of Finance or his designee should:

a) Require current and future nonprofit organizations receiving payments from the City or

its employees to submit W-9 forms, the vendor questionnaire, and any other

documentation necessary to validate their existence as a charitable or nonprofit entity.

b) Conduct an independent verification of nonprofit vendors using publically available tax-

exempt entity searches via the IRS and California Secretary of State. Update the

9 These do not include the employee unions.

13

2

1

2

Active

Suspended

Merged Out

Not Filed



Purchasing Handbook and any accompanying informational materials to reflect these

new procedures.

c) Notify any noncompliant nonprofit entity that all payroll deductions will cease by

December 31, 2018 if the nonprofit entity has not registered properly with the IRS and

California Secretary of State.


The Finance Director agrees with the recommendation and has amended its new vendor

process and ongoing vendor review process to include validation of nonprofit status as well as

documentation for for-profit businesses. Finance staff have notified the various employee

groups of the December 31, 2018 deadline and will follow-up as necessary. The Finance

Director’s response to the audit is included in Attachment B.



Issue 5: Potential Duplicate Vendors in VMF Database

Issue Risk: Medium

The Finance Department has begun to implement processes to refine and maintain the VMF so

that all active vendors are current, up to date, and valid; however, effort is still needed to

deactivate old vendors and conduct an independent validation of existing vendors.

Best practices for maintaining vendors in a database include:

Using standard forms and approvals to add or edit vendor data;

Conducting an independent validation of vendors using a 3rd party service or database;

Establishing routine processes to check for existing vendors before approving the

addition of a new vendor; and

Ensuring that appropriate vendor maintenance and modification rights are adequately

segregated.

Additionally, the City’s Purchasing Handbook outlines the procedures for a department to

request the setup of a new or maintenance of an existing vendor. This process is illustrated in

Figure 2 in the Background Section of this report.

Based on a review of the VMF process, we identified the following conditions:

There are 28 vendors in the VMF database that are duplicates but assigned unique

vendor numbers. These 28 consist of 13 unique vendor entities. For example, there are

five vendors named Chevron, but these are five gas stations in different cities.

126 vendor records contained address duplicates, of which 54 were identified as unique

addresses10. Of the 126 reviewed, 65 percent of remittance addresses could be tied to

the vendor based on available documentation in the VMF database or on the web.

Past practices in the maintenance of the VMF database resulted in the duplication of existing

vendors, maintenance of vendors that no longer did business with the City, and did not include

an independent validation of existing vendors. According to the Finance Department, two full-

time staff were involved in cleaning up the vendor data from the prior system (PeopleSoft), but

the data was not completely clean when it was transferred into Munis to prevent former or

inactive vendors from being added to the new Munis VMF database when the system went live

in FY 2016. There had been no systemic review of active or inactive vendors in the current VMF

database until 2017, this review is still ongoing.

At present, the Finance department is not able to completely segregate Purchasing staff in

maintaining and modifying the VMF database. To compensate for this segregation of duties

issue, the Finance Director has added a layer of routine monitoring. The Finance Director

independently queries a report in Munis that details modifications made to the VMF database.

10 The most frequent reason for the duplicates were individual property owners that had a combination of a utility rebate, permit refund, and/or are a Housing Assistance Payment property owner



The Finance Director then reviews the documentation supporting the modification and meets

with the Purchasing Administrator and Finance staff to review changes and obtain clarifying

information. These conversations at present are not documented, but the Finance Director will

begin to formally document these reviews and note issues he observed.

Another measure taken by the Finance department to strengthen their oversight of the VMF

database is conducting an annual verification of vendor Social Security Number (SSN) or Tax

Identification Numbers (TIN) using an online Internal Revenue Service verification service,

beginning with vendors paid in FY 2017. The Purchasing Division with assistance from DoIT was

able to conduct this IRS check of active vendors in the VMF database. A total of 2,477 records in

the VMF database were verified by the IRS, which matched as follows:

Figure 6: Results of Vendors’ TINs Matched to IRS Verification Service

Source: Analysis of IRS TIN Results Provided by Purchasing Division

Currently, IRS verifications are conducted before new requisitions are approved as POs. Also,

contracts are not processed for vendors without IRS verification on file.

Recommendation 5: As part of the ongoing maintenance effort, the Director of Finance or his

designee should:

a) Review all active vendors with duplicate addresses on file to consolidate information

into one entry and deactivate the other associated vendor number.

b) Review all active vendors using a PO Box as their business or remittance address and

receive confirmation of their existence at a physical location.

c) Review all vendors coded as 1099 vendor to verify they meet the IRS requirement to be

a 1099 vendor, and develop procedures to accurately categorize a new or current

vendor as a 1099 reportable vendor.

2241

33202

1

IRS TIN Match Results

Matched TIN Not Yet Issued Did Not Match Duplicate request



d) Document the meetings with the Purchasing Administrator to review any VMF database

changes, noting any specific issues or anomalies that need further review or correction.


The Finance Director agrees with this recommendation and is working to implement all items.

The Finance Director’s response to the audit is included in Attachment B.



Issue 6: Updated W-9s are Needed for Housing Assistance Payments

Issue Risk: Medium

The Housing Department is not consistently receiving updated W-9 forms from property

owners and managers that receive Housing Assistance Payments (HAP) to ensure payment is

being made to current and legitimate payees.

The Purchasing Handbook outlines conditions when documentation may be required from prior

or current vendors, including the questionnaire and W-9 form. These include if the vendor was

transferred from PeopleSoft, has done work for the City for more than three years, or if there

has been a change in ownership, name, or address. The Housing Department has their own

internal procedures for validating a prospective landlord to ensure they are the legitimate

owner or their designated representative and collect documentation to comply with HUD and

local regulations, including an independent ownership validation using a third party database.

Housing would typically request new ownership documentation when they are notified of a

change in ownership by the tenant or the owner. According to Housing staff, they began

collecting vendor questionnaires and W-9s forms to send to Purchasing in the last two years,

and have about 400 property owners participating in the program at present.

In our sample of HAP vendor documentation tested, we found that 40 of 55 (73%) vendors with

W-9s have signatures that pre-date 2015. Additionally, 9 payees (14%) of vendors were missing

W-9s in Munis. In our review of HAP owner files maintained by the department, six of the

landlords were no longer participants in the program, but were still listed as active vendors in

the VMF database. In addition, two property files reviewed on site also did not contain any

evidence of an independent ownership validation search performed by Housing. According to

Housing, both properties are owned by participating landlords that started with the program

prior to 2003, when Housing began to use an independent real estate ownership validation

service called RealQuest. The practice used by Housing staff prior to 2003 was to request copies

of grant deeds and property tax bills from participating landlords at the time of initial contract

signing to verify ownership. Housing then provided us evidence that these two properties

contained ownership validation evidence dated 1997 and 1992.

The conditions related to the lack of current W-9s for HAP stemmed from not having a formal

process or practice in place to request and receive updated W-9s from existing HAP landlords,

or to update the Purchasing Administrator to deactivate former HAP recipients during our

period of review. Without recent and verifiable landlord information, the Housing department

is at risk of approving payment for landlords that are no longer rightful owners or ceased

participating as a Section 8 rental unit.

Housing Department in conjunction with the Purchasing Division, has reached out to existing

HAP landlord/owners to get updated W-9s. According to Purchasing and Housing staff, as of

October 2018, there are 430 Active HAP landlord/owners in the VMF, however, 40 landlords do

not have current W-9s in the VMF. Of the 40 outstanding vendors, 16 have not yet responded



to the request for an updated W-9 and 15 returned W-9s that were either rejected for

incomplete data or missing physical addresses and nine submitted updated W-9s but did not

use the most current IRS form. Housing staff have committed to following up with the

landlords with outstanding W-9 updates.

Recommendation 6a: The Housing Director or his designee should work with Purchasing staff

to continue to obtain recent W-9s from landlords with outdated forms in the VMF; and require

landlords/owners to complete and sign a W-9 every 3 years as required by City policy.

Recommendation 6b: The Finance Director or his designee should consider implementing the

IRS 20% withholding for any landlords/owners that do not complete and submit an updated

W-9 form.


The Finance Director agrees with this recommendation and will make such considerations. The

Finance Director’s response to the audit is included in Attachment B.

The Housing Director agrees with the recommendation and is working to collect all required

W-9s from landlord/owners. Additionally, the Administrative Plan will be updated to include

this requirement beginning with the 2019 program year. The Housing Director’s response to the

audit is included in Attachment B.



Issue 7: Accuracy of Worker’s Compensation Third Party Administrator Taxpayer

Identification Numbers (TINs) and Vendor Form 1099 Information

Issue Risk: Medium

The City is not consistently receiving accurate tax identification numbers for vendors used by

the Third Party Administrator.

The City contracts with a Third Party Administrator (TPA) to receive and process worker’s

compensation claims and treatment. The TPA directly pays worker’s compensation medical and

health care providers on behalf of the City of Pasadena. The TPA sends the Human Resources

Worker’s Compensation Supervisor a weekly check register of services provided for affected

employees that the Worker’s Compensation coordinator reviews and then approves for

payment by the Finance Department. A trust account for payment of workers’ compensation

claims is used to pay the TPA. Finance reconciles payments to the bank statements and the

Human Resources Worker’s Compensation Supervisor weekly reviews the check registers which

includes paper transactions, voids, stop pays, and vouchers. According to the policies and

procedures provided by the TPA, they require all new individuals or businesses that they do

business with to submit a completed IRS W-9 form upon submitting a request for payment. The

TPA cannot enter a vendor in their system without a tax ID and issue a second request if they

do not receive a W-9 by year end. The TPA also has additional procedures to follow if the

second attempt is not successful. The procedures did not include any formal processes for

validating the information the individual or business provides on their W-9. Upon request from

the City, the TPA now uses the IRS match process to validate that the vendor provided a correct

TIN.

In FY 2016, 50 total vendors paid by the City or TPA submitted an incorrect name or tax

identification number, of which 21 (42%) are worker's compensation vendors used by the TPA.

Of the 21, 12 had used a name that was different from the official TIN name, but eventually

were verified as having valid TINs. Eight of these vendors provided an updated W-9 form. One

vendor has yet to submit the requested information and per the Worker’s Compensation

Supervisor, is no longer receiving any payment from the City. The City’s Worker’s Compensation

Supervisor followed up with the TPA to determine what actions the TPA should take to remedy

this issue in the future. According to the Worker’s Compensation Supervisor, the TPA has

agreed to do update their procedures to include a preliminary IRS verification of TIN numbers

prior to adding this vendor to their database, as well as deactivate vendors that are

nonresponsive to W-9 requests.

By requiring the TPA to do preventative validation of their vendors/service providers, the City

can more effectively administer the 1099 process and reduce the risk of paying a fraudulent

vendor.



Recommendation 7:

The Director of Human Resources should work with the Worker’s Compensation Supervisor to

conduct periodic monitoring of the TPA to ensure they are properly validating and managing

service providers used for City of Pasadena Worker’s Compensation claims.


The Human Resources Director agrees with the recommendation and the TPA has already

updated their Vendor W-9 policy and procedures will be required to provide quarterly

confirmation of compliance to these procedures. The Human Resources Director’s response to

the audit is included in Attachment B.



Attachment A: Findings Risk Ranking Criteria

High Risk Medium Risk Low Risk

Potential significant financial/operational losses to the City

Weakness that could cause moderate losses to the City

Control weaknesses exist but are mitigated by other controls

Significant internal control weaknesses that are Citywide or affect a department’s operations.

Internal control weaknesses at a division or unit level or non-compliance with citywide policies

Controls which, if eliminated or re-engineered, would benefit productivity or effectiveness

Violation of laws, regulations or Municipal Code/Ordinance

Non-compliance with grant requirements or other contractual agreements

Opportunities for process improvements or increased efficiencies



Attachment B: Management Responses to Audit Report

B1: Finance Department

B2: Department of Information Technology

B3: Human Resources Department

B4: Housing Department

Attachment B2

32

Attachment B4

37

Audit of the City’s Vendor Master File Maintenance and 1099...Regular interaction and maintenance...

Documents

Transcript of Audit of the City’s Vendor Master File Maintenance and 1099...Regular interaction and maintenance...