Internal Audit Report Lee County Supervisor of Elections Report Number: 2015.10 Date: September 2015 Audit of Supervisor of Elections Date: October 5, 2015 To: The Honorable Linda Doggett, Lee County Clerk of Court & Comptroller From: Tim Parks, Chief Internal Audit Officer/Inspector General Re: Audit of Supervisor of Elections The Internal Audit/Inspector General Department has conducted an audit of the Lee County Supervisor of Elections. The audit was limited to a review of the internal control environment surrounding the procurement processes within the SOE’s office. David Rollman, CIA, and Mabel Febles, CIGA, completed the review. The auditee’s response is attached to this report. The auditors wish to thank the SOE and her employees for their assistance and cooperation during the review. This report will be posted to the Clerk of Courts website www.leeclerk.org under Internal Audit/Inspector General, Audit Reports. A link to this report has been sent to the Lee County Board of County Commissioners and appropriate parties. Tim Parks, CIA, CIG Chief Internal Audit Officer/Inspector General TJP/GK Audit of Supervisor of Elections Table of Contents: Executive Summary ........................................................................................................................ 1 Background ..................................................................................................................................... 2 Objective, Scope, and Methodology ............................................................................................... 2 Issues ............................................................................................................................................... 3 Response ………………………………………………………………………………………… Audit of Supervisor of Elections Executive Summary Procurement is a complex function that can be guided by statutes, laws, regulations, policies and procedures. The Supervisor of Elections (SOE) does not have formal written procurement policy and procedures. Our primary recommendation is that a written policy and procedures be created and implemented. A review was made of a sample of the SOE’s largest purchases. Although elements of sound procurement practices were utilized through the office’s informal policies and procedures, it is recommended that steps be implemented or expanded to meet and maintain best practices. These include the use of competitive, public, advertised bids when appropriate, and a detailed written technical analysis of proposed purchases of software and hardware. Assurance should be provided that the purchases are at the best price and meet current needs as well as projected future business and technical requirements. The SOE office is a relatively small organization, and some of the election equipment purchased has a limited number of vendors or must be State approved. Given these limitations, there are still improvements that can be made to enhance the current purchasing procedures. The U.S. Government Accountability Office (GAO) summarized the risk associated with not having a formal procurement manual: “A comprehensive procurement policy manual – one that lays out these policies and applicable laws is critical to ensuring that procurement, agency staff, and all stakeholders follow the proper procedures and rules so all will have a clear and consistent understanding of the required regulations. In the absence of such guidance, a lack of consistency in how procurement work is carried out becomes likely. This inconsistency results in frustration within and outside the… organization and the possibility that procurement actions may appear to be arbitrary and unfair. It is therefore critical… to have a comprehensive procurement policy manual in place.”1 1 U.S. Government Accountability Office (GAO). (2007) District of Columbia: Procurement system needs major reform. Journal of Public Procurement. Retrieved from www.nipg.org 1 Audit of Supervisor of Elections Background Timeline: During the 2012 election, there were long lines at certain Lee County polls due in part to the use of a paper sign-in system and an insufficient number of scanners. In September 2013, the SOE purchased one hundred additional scanners to speed up the process at the polls. That addressed one part of the bottle-neck at the polls. Over the period of 2013-2014, the computer system was upgraded from Windows XP to Windows 7. It was a necessary upgrade because Windows XP was no longer a supported operating system. Poll Pads (Specialized Apple iPads) were purchased in 2014. The Poll Pads were intended to eliminate the paper sign-in system on Election Day and thus, speed up the process. The Poll Pads reportedly worked well during Election Day voting, but they were incompatible with the Megalink voter registration system during the early voting process. The Poll Pads require a live link to the voter registration system to be effective during early voting. A new voter registration system, Voter Focus, was purchased in 2014 and implemented in early 2015. Megalink had been utilized for many years and had its drawbacks. Primarily, it was not compatible with Windows 7. The Poll Pads are still effective on Election Day, but they are not designed to handle the early voting process; even with the Voter Focus system. They do not have a live link to Voter Focus. In June 2015, the SOE submitted and then withdrew a budget request with the Lee County Board of County Commissioners for the purchase of Electronic Voter Identification (EViD) devices to replace the Poll Pads. These devices are designed to handle both early voting and check-in at the polls because of their interface with Voter Focus. Objective, Scope, and Methodology Objectives: To evaluate the control environment in place in SOE’s financial records, and procurement processes. This includes a review of applicable Florida Statutes and any other pertinent laws, regulations, and policies and procedures as well as an assessment of the degree to which the SOE complies with the requirements stated therein. Control weaknesses will be documented and recommendations will be developed based on the scope of the review and any additional observations that may arise during the audit. Scope: This audit is limited to a review of the internal control environment surrounding the procurement processes within the SOE’s office. The Clerk of Court’s (Clerk) Auditors will determine high risk areas within this scope on the basis of initial document reviews and interviews of appropriate staff. Testing will be designed and conducted to evaluate select transactions in areas deemed to represent high risk. The scope of the audit may be 2 Audit of Supervisor of Elections subsequently changed upon mutual agreement of the Clerk and SOE. The audit is being conducted to review the SOE purchasing function. It is not intended to be a detailed technical study of the current and future software and hardware needs of the SOE. Methodology: To fulfill the objectives, the auditors: • • • • • • Review the applicable laws, regulations, and state statutes related to the operation of the SOE’s Office. Review the policies and procedures that document the internal controls put in place by the SOE. Interview key employees involved in management and performance of financial transactions and procurement. Analyze financial records to identify the universe of transactions within the audit scope, quantify volume of business with vendors used, and assess supporting documentation. Select high risk general ledger accounts and vendors to review. Perform testing as deemed necessary. Issues Written Purchasing Procedures The SOE does not have a formal written policy or procedures for purchasing. Recommendation It is recommended that the SOE develop comprehensive procurement policy and procedures that clearly define purchasing authority, responsibility, and guidelines. This policy should comply with the appropriate laws and regulations and with general best practices for government entity procurement. The policy should provide fair and open competition and ensure that purchases are awarded equitably and economically. The written policy and procedures should include:  Purchases over a certain dollar amount should, and sometimes must be put out for a competitive public bid or proposal. o A reasonable threshold would be between $35,000 and $100,000 for purchases that are not defined as “voting equipment.” o Any purchase of voting equipment, the individual or combined retail value of which is in excess of $35,000 shall be by means of competitive sealed bids or competitive sealed proposals from at least two bidders, unless exempted and certified to the Division of Elections (F.S. 101.293). o The bids, quotes, etc. must be appropriately documented. o Procedures should address how sole source or limited source purchases are to be handled. 3 Audit of Supervisor of Elections                  Technical analysis, if appropriate, should be conducted by qualified personnel (SOE or County IT, independent consultant, etc.) to verify that the purchase meets current and future needs of the SOE. The technical review should be documented. Verification that the item to be purchased is State approved, when necessary. The role of the various SOE leadership team members that are affected by the purchasing process should be defined. The development of specifications and criteria should be evaluated to ensure that each purchase meets current and future business needs. The approval levels for various SOE personnel, including how many approvals are required and how the approval is to be documented. The procedures for inspecting items received, including the separation of the ordering and receiving functions. The use of purchase orders, outlining the terms of the purchase. Defining when formal written contracts are to be utilized; for example – professional services, lease agreements, maintenance agreements, etc. Identifying when written contracts should be subjected to legal review on behalf of the SOE. Piggybacking with other government entity competitively bid contracts when appropriate. Purchasing documentation to be utilized and retained. Documentation should contain a detailed justification for the procurement decision. Method for approving vendors or maintaining an approved vendors list. Ethics and Code of Conduct, including conflicts of interest, gratuities, misuse of information, etc. Verification that budget requirements are met. Define when purchases require BOCC approval. The use of credit cards, including who is authorized to use the cards and the monetary limits. The procedure for employing emergency purchases. The date that the procedures were written, updated, and approved. Review of Purchases A sample of purchases over $100,000 from 2012, through June 2015, was reviewed, and it included the following:      Poll Pads and accessories Voter Focus voter registration system Scanners Ballots Computer support and maintenance The informal procedures that were followed in these purchases met some of the elements of a sound purchasing policy, such as the use of purchase orders, obtaining quotes on some purchases, and the written approval of purchases. However, other elements such as the following were not utilized: 4 Audit of Supervisor of Elections      Competitive, public, advertised bids were not utilized for any of the purchases, although quotes were obtained for the purchase of the Poll Pads. Competitive bids might have been appropriate for some of the purchases. There was no documentation of an in-depth analysis to determine if the purchases met current and future technical or business needs. There is no official list of who is authorized to approve purchases, how many approvals are required, or the individual approval levels. Most purchase orders had been approved by two SOE personnel. However, some had been approved by only one person. There is no approved vendor list or method to approve vendors. Written contracts were utilized for some purchases and not others. There is no written guideline as to when contracts are to be utilized or if they should be subjected to a legal review. Recommendation It is recommended that all purchases comply with the written SOE purchasing policy and procedures once they are written and approved. 5 MEMORANDUM DATE: OCTOBER 2, 2015 TO: HON. LINDA DOGGETT, LEE COUNTY CLERK OF COURTS FROM: HON. SHARON L. HARRINGTON, LEE COUNTY SUPERVISOR OF ELECTIONS RE: CLERK OF COURTS AUDIT AND OFFICIAL RESPONSE I have received and reviewed the recent audit report with regards to a review of the internal control environment surrounding the procurement processes of the Supervisor of Elections Office. I appreciate the time involved in conducting such an audit and wish to thank Tim Parks, David Rollman and Mabel Febles for their patience and their professionalism. Attached please find my responses as they pertain to the findings of the internal audit. (1) Important information that should be considered while reading the audit report:  The Supervisor of Elections is an elected position that was established under the Constitution of the State of Florida.  The Supervisor of Elections office is governed by Florida Statutes and Rules.  The Supervisor of Elections office is not a county department under the Board of County Commissioners, but an independent office.  The Lee County Supervisor of Elections is not required to seek public sealed competitive bids. (More detail provided in this response.)  The SOE’s office is unique in the fact that we deal with a limited number of equipment vendors offering specialized voting equipment, sometimes sole-source companies. We are limited to purchasing equipment that must be state certified or procure products from companies that have been working with election officials for many years and know how crucial our operations are.  The office of the Supervisor of Elections under the previous administration elected to handle the office’s accounting/purchasing functions separate from the county in 1989-90.  The office of the Supervisor of Elections is dedicated to providing the voters of Lee County with the opportunity to cast an independent and secret ballot and to have the confidence in the system that their vote has been counted while still being responsible fiduciaries of their tax dollars. SUPERVISOR’S RESPONSES: The main recommendation by the audit team is that the SOE develop a Policy and Procedures Manual with regards to our purchasing processes along with suggestions on what items should appear in the documentation. As mentioned, we are a small independent office of 35 employees with a limited number of individuals involved in the actual purchasing process. These individuals have a clear separation of duties as affirmed each year during our regular standard countywide financial statement audit. Because of the limited access to the purchasing process and separation of duties, a P&P manual was not previously considered. However, based on this audit, we have already begun to draft a manual and will be using the content recommendations of the audit team where applicable. Advisory Opinion #AGO 88-31 says that since Lee County Elections is independent of the county financial/purchasing processes, the SOE is not required to seek public sealed competitive bids when purchasing goods. Our office is limited to what we can purchase because of the low number of state certified vendors available. Currently there are only two voting systems certified in the State of Florida and they operate on proprietary software. (2) When applicable, we get at least 3 quotes on a product if available. Our office researches the availability of federal, county, state, or organizational contracts/grants on like products in order to take advantage of lower prices. This process has been an on-going procedure for many years. We have already implemented a policy that will also be documented in the P&P manual that requires the attachment of a technical analysis to future requests for any technical equipment when applicable. Some vendors require contracts on purchases, others do not. Since the beginning of this year, our contracts are being sent to our office attorney for review. In closing, I want to assure the Board of County Commissioners and the voters of Lee County that the Supervisor of Elections office will continue striving to provide fair, honest and open elections using a high degree of fiduciary responsibility. (3)