COUNTY OF LOS ANGELES DEPARTMENT OF AUDITOR.CONTROLLER KENNETH HAHN HALL OF ADMINISTRATION 5OO WEST TEMPLE STREET, ROOM 525 LOS ANGELES, CALIFORNIA 9OO1 2.3873 PHONE: (213)974-8301 FAX: (213) 626-5427 JOHN NAIMO AUDIÏOR-CONTROLLER August 28,2015 TO: Supervisor Michael D. Antonovich, Mayor Supervisor Hilda L. Solis S upervisor Mark Rid ley-Thomas Supervisor Sheila Kuehl Supervisor Don be FROM: John Naimo Aud ler SUBJECT: SHERIFF'S DEPARTMENT - REVIEW OF TRANSACTIONS BETWEEN LOS ANGELES COUNTY AND PALANTIR TECHNOLOGIES, INC. (Board Agenda Item 7, April 14,20151 On April 14, 2015, your Board instructed the Auditor-Controller (A-C), in consultation with the lnspector General, to audit all transactions between Los Angeles County (County) and Palantir Technologies lnc. (Palantir) to determine whether any Board policies or applicable laws had been violated, and to recommend appropriate action. All of the County's transactions with Palantir were completed by the Sheriffls Department (Sheriff or LASD). Background Palantir is a computer software and services company that provides large-scale data integration, analysis, visualization, and management. Many federal, State, and local government agencies use Palantir's commercial software for anti-fraud and counterterrorism efforts to facilitate analysis of intelligence, for collaboration on investigations, and for case management and reporting. The Sheriff's transactions with Palantir comprise 12 purchase orders issued between December 2009 and April 2015. Eleven of the 12 purchases were made by the Sheriff in its role as the fiduciary for the Joint Regional lntelligence Center (JRIC), a law enforcement fusion center whose purpose is to collect, analyze, and disseminate terrorism-related threat intelligence for the greater Southern California area. JRIC's participating agencies include the Federal Bureau of lnvestigation, California Highway Help Conserve Paper - Print Double-Srded "To Enrich Lives Through Effective and Caring Service" Review of Transactions with Palantir Pase 2 Patrol, and many other safety and law enforcement agencies such as LASD and the Los Angeles Police Department. ln its role as JRIC's fiduciary, the Sheriff receives funding from two federal Homeland Security Grant programs on behalf of JRIC. The Sheriff has paid Palantir a total of $17.1 million: $16.6 million in federal grant funds to purchase Palantir products and services for JRIC, and $500,000 in Departmental Federal Asset Forfeiture funds for LASD to implement Palantir access for its personnel via computers in patrol cars. All of the transactions were made as sole source commodity purchases. The Sheriff receives the grant funds by claims reimbursement, i.e., the Sheriff incurs and pays eligible expenses on behalf of JRIC using County funds, then submits claims for reimbursement. Given that the Sheriff uses County funds for the Palantir purchases for JRIC, all such purchases must comply with County policies and procedures, including Board policies and County purchasing standards. Scope of Review We reviewed the Sheriffs compliance with County and Departmental policies and procedures, and other applicable laws, related to its transactions with Palantir. We also reviewed purchasing documentation, as well as documents and correspondence provided by LASD, the Internal Services Department (lSD), the Chief Information Office (ClO), and County Counsel. ln addition, we met with JRIC representatives, Sheriff, lSD, and CIO managers and personnel, and consulted with counsel for Palantir and the County. We also reviewed the Palantir implementation at the JRIC and observed demonstrations of the system and its functionality. Results of Review Overall, the Sheriff, acting as a fiduciary for JRIC, generally purchased goods and services from Palantir in accordance with applicable federal, Board, and County policies, though we did note a single retroactive payment. The Sheriff also appears to have complied with sole source purchase requirements, including obtaining approval to spend grant funds on Palantir products from the California Governor's Office of Emergency Servíces (the granting agency) and the City of Los Angeles (the primary grantee; LASD is a grant sub-recipient). We noted that the Sheriff was fully reimbursed for each of the 11 purchases made with federal grant funds, and that the Sheriff's use of Federal Asset Forfeiture funds for their own implementation of Palantir was in accordance with the guidelines for these funds. While we did not find overt violations of purchasing policies, our review noted areas where the Sheriff needs to strengthen its procedures for processing Palantír purchases, and for procuring and implementing information technology and systems. For example, the Sheriff: Procured Palantir for JRIC without any documented and defined specifications or technical requirements describing JRIC's data analysis needs. As a result, we AU DITOR.CONTROLLER COUNTY OF tOS Á,VGELES Review of Transactions with Palantir Paqe 3 could not determine if there are other competing products that might be able to meet the Sheriff's or JRIC's needs in addition to Palantir. a Approved Palantir invoices for payment even though the invoices did not separately list the cost of equipment, software and/or service(s) purchased, and sometimes lacked other required information. For example, one maintenancerelated invoice was approved for payment even though it did not specify the term of the maintenance agreement, and therefore lacked sufficient information to be paid. The Sheriff should work with PalantÍr to obtain additional information to differentiate between the cost of commodities and services (which are treated differently under County purchasing policies), and ensure that it obtains sufficiently detailed invoices so that purchases are processed in accordance with applicable policies and that the Board is notified of purchases when required (Recommendation 5). a Did not seek clarification for vague product descriptions indicated on Palantir invoices. We found that Palantir's bundled products may include software licenses, hardware, support services, etc., but these items are described in only general terms on invoices, leading to confusion about what was purchased and how to classify it. The Sheriff should work with Palantir, the County Purchasing Agent (i.e., ISD), and County Counsel to establish agreed-upon product terminology and procedures for evaluating and accounting for such purchases (Recommendation 12). a Did not separately identify or account for the cost of servers that were included with most purchases. As a result, capital assets (i.e., assets valued at $5,000 or greater) were not recorded in the County's electronic Countyruide Accounting and Purchasing System (eCAPS), as required. While JRIC has an inventory of the servers, the assets were not accounted for in the Sheriff's equipment inventory. While all Palantir-related equipment appears to be accounted for, the Sheriff should ensure that all capital equipment is properly identified, inventoried, and recorded in eCAPS (Recommendations 1 and 2). a Did not obtain the required purchasing authorization before incurring obligations to Palantir for maintenance, resulting in a retroactive payment. The Sheriff appropriately notified your Board concerning the payment, and has indicated its intent to follow up with the Retroactive Contract Review Committee to prevent additional retroactive payments (Recommendations 7 and 8). o Does not have a formal agreement with Palantir for ongoing maintenance services, and does not have documented and defined specifications for JRIC's data analysis system. The Sheriff should work with County Counsel and ISD to Board-approved contract for service purchases from Palantir establish (Recommendation 13). a As noted above, because Palantir does not detail the composition of the products and services it sells, and uses a bundled pricing model (i.e., a single line-item price for all AU DITOR.CONTROLLER COUNTY OF IOS AA'GELES Review of Transactions with Palantir Paoe 4 services and equipment), their past invoices lacked sufficient information to ensure that County purchasing policies were appropriately applied, or to clearly identify when the Board should have been notified of the purchases. Bundled or composite pricing is not unique to Palantir, and we noted that County procurement policies may need to be updated to account for this type of procurement model, and to ensure that such purchases are more closely scrutinized and subject to additional oversight, including Board notification where appropriate. Specifically, we recommend that ISD: o Ensure that departments provide sufficient information, such as detailed product descriptions, terms of service, etc., to determine precisely what goods/services are being procured prior to issuing purchase orders (Recommendation 6). a Enhance procurement policies to provide for additional management review of purchases that may include a service component exceeding $100,000 (which require a Board contract) (Recommendation 9). Details of our review, along with recommendations for corrective action, are included in Attachment l. Review of Report We discussed our report with Sheriff, lSD, ClO, and JRIC management, and they indicated agreement with our findings and recommendations (Attachments ll, lll, and lV). We also consulted with the lnspector General on our findings and conclusions. We thank personnel from the Sheriff, lSD, ClO, and JRIC for their cooperation and assistance during our review. lf you have any questions, please call me or your staff may contact Robert Campbell at (213) 974-0681. JN:RGC:GZ:AMS:tt R-201 5-1 0533 Attachments c: Sachi A. Hamai, lnterim Chief Executive Officer Mary C. Wickham, lnterim County Counsel Jim McDonnell, Sheriff Jim Jones, Director, lnternal Services Department Dave Chittenden, Chief Deputy, lnternal Services Department Richard Sanchez, Chief lnformation Officer Patrick Ogawa, Acting Executive Offícer, Board of Supervisors Max Huntsman, lnspector General Audit Committee Public I nformation Office AU DITOR-CONTROLLER COUNTY OF ¿OS AAIGELES Attachment I SHERIFF'S DEPARTMENT REVIEW OF TRANSACTIONS WITH PALANTIR Background On April 14, 2015, your Board instructed the Auditor-Controller (A-C), in consultation with the lnspector General, to audit all transactions between Los Angeles County (County) and Palantir Technologies, Inc., (Palantir) to determine whether any Board policies or applicable laws had been violated, and to recommend appropriate action. According to data from the electronic Countywide Accounting and Purchasing System (eCAPS), all of the County's payments to Palantir were made by the Los Angeles County Sheriff's Department (Sheriff or LASD). Palantir According to its website, Palantir is a computer software and services company that provides "data fusíon platforms for integrating, managing, and securing any kind of data, at massive scale." Many federal, State, and local government agencies, including the federal intelligence and defense sectors, use Palantir commercial software for anti-fraud and counter-terrorism efforts to facilitate analysis of intelligence, for collaboration on investigations, and for case management and reporting. Palantir also offers technology solutions to assist non-profit organizations and governments in responding to disasters and public health emergencies. A Palantir implementation generally consists of software/user licenses, hardware appliances, and implementation, support and maintenance services. Palantir describes its products as offering a "fully featured, highly configurable commercial solution for data integration, analysis, visualization, and knowledge management." The Palantir implementation procured by the Sheriff incorporates data from many sources to facilitate law enforcement investigations, threat detection, and crime prevention. This data can be rapidly searched, cross referenced, geocoded, and displayed according to strict access controls to assist in investigations and for other authorized law enforcement purposes. According to Palantir product descriptions, and as indicated on Palantir quotes and invoices, the company prices its products using a "core licensing" model, under which Palantir software is licensed in what the company terms a "core at a firm-fixed" price, bundled with hardware appliances, and support and maintenance services. Palantir indicates the number of cores a customer needs for system deployment is based upon the "data scale, usage characteristics, and user load." Joint Regional lntelligence Genter Most of LASD's purchases from Palantir were made in its role as the fiduciary for the Joint Regional lntelligence Center (JRIC), a law enforcement fusion center whose purpose is to collect, analyze, and disseminate terrorism-related threat intelligence for a AU DITOR-CONTROLLER COUNTY OF IOS A'VGE¿ES Review of Gounty Transactions with Palantir Pase 2 seven-county region of Southern California. There are 78 fusion centers throughout the U.S., which were jointly created by the U.S. Department of Homeland Security (DHS) and the U.S. Department of Justice. Fusion centers receive federal support, including grant funding from DHS. JRIC's participating agencies include the Federal Bureau of lnvestigation, California Highway Patrol, Los Angeles County Police Chiefs Association, Los Angeles Area Fire Chiefs Association, LASD, and the Los Angeles Police Department (LAPD). According to LASD and JRIC management, LASD has served as JRIC's fiduciary since shortly after JRIC's formation in 2006. JRIC has a written Memorandum of Understanding (MOU) between the participating agencies, but the MOU does not specifically define LASD's role within JRIC or identify a specific entity as the fiduciary. However, MOU Section J, Funding, states that, "Expenditures by each party will be subject to its budgetary processes and to the availability of funds and resources pursuant to applicable laws, regulations, and policies." Funding As JRIC's fiduciary, LASD receives federal Urban Areas Security lnitiative (UASI) grant funds on behalf of JRIC as a sub-recipient of the City of Los Angeles (City), which for purposes of these funds is a grantee of the State of California. The Sheriff also receives State Homeland Security Grant Program (SHSGP) grant funds as a subrecipient of the Los Angeles County Disaster Administrative Team, which is also a grantee of the State. Both the UASI and SHSGP grant monies are received via claims reimbursement, where the Sheriff incurs and pays eligible expenses on behalf of JRIC using County funds, then submits claims for reimbursement to the City. Given that the Sheriff uses County funds for the Palantir purchases for JRIC, all such purchases must comply with County policies and procedures, including Board policies and County purchasing standards established by the Purchasing Agent (i.e., the lnternal Services Department or ISD) and approved by the Board. We noted that your Board properly approved receipt of the County's UASI and SHSGP allocations for each grant period in which LASD made purchases, as evidenced by Board letters submitted jointly by the Chief Executive Officer (CEO), Sheriff, and the Fire Department. Also, Sheriffs management indicated that since 2006, the Department has requested spending authority in its annual budget for anticipated JRIC expenditures and corresponding grant revenue in the Homeland Security Division (HSD) budget unit. Since February 2010, the Sheriff has paid Palantir a total of $17.1 million: $16.35 million in UASI funds and $250,000 in SHSGP funds for Palantir products and services procured for JRIC, and $500,000 in Departmental Federal Asset Forfeiture funds for the Sheriff to implement access via Mobile Digital Computers (MDCs) in Sheriff's patrol cars. AU DITOR-CONTROLLER COUNTY OF LOS A,VGELES Review of Countv Transactions with Palantir Page 3 Scope We reviewed the Sheriff's compliance wíth County and Departmental policies and procedures, and other applicable laws, related to íts transactions with Palantir, which comprise 12 purchase orders (POs) between December 2009 and April 2015. We also reviewed purchasing documentation, as well as documents and correspondence provided by LASD, lSD, the Chief Information Office (ClO), and County Counsel. In addition, we met with JRIC representatives, Sheriff, lSD, and CIO managers and staff, and consulted with counsel for Palantir and the County. We also reviewed the Palantir implementation at the JRIC and observed demonstrations of the system and its functionality. The following table summarizes LASD's purchase transactions with Palantir. Purchase Order # Payment sH-10321758 Amount Palantir Core - Software Subscription Services (10 installments of $25,000 on various dates). UASI $250,000 10t25t2011 - 18 Core Perpetual Licenses, Support Services and Product Upgrades, lmplementation and lntegration, Hardware Appliance. UASI 2,250,000 12108t2011 Software - 2 Core Perpetual Licenses, Support Services and Product Upgrades, lmplementation and lntegration, Hardware Appliance. SHSGP 250,000 UASI 500,000 UASI 3,775,000 02t09t2010 1 Funding Source Purchase Description Date through 11t18t2010 Software 2. 3. sH-1232"t611 sH-12321989 4. sH-12322375 02t0'12012 Software - 4 Core Perpetual Licenses, Support Services and Product Upgrades, lmplementation and lntegration, Hardware Appliance. 5. sH-12323471 0512412012 Software - 30 Core Perpetual Licenses Support Services and Product Upgrades, lmplementation and lntegration. - 4 Core Perpetual Licenses, Support Services and Product Upgrades, Hardware Appliance, lmplementation and lnteqration, Hardware. (For LASD use). Software 6. sH-13322s78 0312'U2013 7 sH-13323121 0410512013 8. sH-13323247 04t23t2013 Palantir Operations and Maintenance for Government License - 52 Cores Palantir Disaster Recovery License Cores; Software - 8 Core Perpetual - Federal Asset 500,000 Forfeiture UASI 1,000,000 UASI 1,400,000 UASI 4,250,000 UASI 1,625,000 128 Licenses. 9. sH-14323163 04t16t2014 34 Core Perpetual Licenses, per Server Core. lncludes initial year Operations and Maintenance. 10. sH-14323406 04t1612014 Core. lncludes initial year Operations and 13 Core Perpetual Licenses, per Server Maintenance. AU DITOR-CONTROLLER COUNTY OF LOS A,VGELES Review of Gountv Transactions with Purchase Order # Payment 11. sH-14323985 05t29t2014 12. sH-15323319 04t21t2015 Palantir Paqe 4 Funding Source Purchase Description Date 2 Core Perpetual Licenses, per Server Core. Annual Support and Maintenance for one year. Total Amount UASI 250,000 UASI 1,050,000 $17,100,000 Findinqs and Recommendations We reviewed the 12 transactions between LASD and Palantir, and noted the following Transaction I - Palantir Pilot Project JRIC staff indicated that Palantir was originally selected for a pilot project based on the recommendation of a former LASD HSD manager. Beginning in early 2010, JRIC used UASI grant funds to acquire a subscription for a limited version of Palantir's proprietary software for a 1O-month pilot. JRIC did not create a list of specifications or performance requirements for the pilot. LASD, on behalf of JRIC, submitted a sole source justification for the purchase to the City, which approved the request and fonryarded it to the State. LASD provided documentation indicatÍng that the California Governor's Office of Emergency Services (Cal OES; formerly the California Emergency Management Agency), approved the use of UASI funds to purchase Palantir software as a sole source. County Code (Code) Section (S) 2.81.800 (et seq.) indicates that the County Purchasing Agent (i.e., ISD) is authorized to issue POs to purchase commodities upon receipt of an approved Departmental requisition. Based on an approved LASD requisition, ISD issued a PO to procure the Palantir software subscription as a sole source transaction. According to County Purchasing Policy #M-1900, monopoly subscriptions, including electronic subscriptions such as software licenses, may be processed without sole source documentation and/or negotiated transactions. ISD indicated that the Palantir pilot purchases appeared to be for licenses to use the software only (each invoice indicates the purchase was for a license and no hardware or other equipment is listed), which qualified as a subscription. Therefore, ISD approved the PO as a subscription for the pilot period. LASD subsequently received UASI reimbursement for the $250,000 cost of the pilot. Code S 2.81.960 provides that any sole source purchase over $5,000 must be reported to the Board on a monthly basis. ISD indicated that because the Palantir pilot was exempt from sole source documentation requirements, it was not subject to disclosure on ISD's monthly report to the Board. However, during our review, Palantir indicated it included four servers with this purchase. Because it is Palantir's practice to bundle its products and not list the prices of individual items on its quotes or invoices, the inclusion of servers is not evident on any purchasing documents the Sheriff provided to lSD. AU DITOR.CONTROLLER COUNTY OF LOS A/VGE¿ES Review of Countv Transactions with Pal ntir Paqe 5 Since the purchase was not entirely related to a software subscription, sole source documentation and disclosure to the Board were required. Equipment - Servers Palantir indicated that in addition to the pilot transaction, it also provided the servers/hardware necessary to support the requirements of the software, data processing, etc., for each of the nine purchases of cores by LASD/JRIC (transactions 26 and 8-11). According to Palantir, they delivered a total of 44 servers to JRIC headquarters as part of these transactions. ISD staff indicated that because Palantir bundles all items into one price (with hardware indicated at zero cost), they were not aware that servers were provided at the time of the purchases. The issue of Palantids bundled pricing model, how affected the LASD/JRIC purchases, and our recommendations are fully discussed in the Other lssues section of this report, below. it Title 44 of the Code of Federal Regulations (CFR), Part 13, which addresses financial administration of DHS funds, indicates that ownership of equipment acquired under a grant vests wíth the grantee or subgrantee upon acquisition. The Sheriff is the subgrantee for the UASI and SHSGP grants used for the Palantir purchases. Accordingly, LASD holds title to the servers. The CFR also indicates that detailed property records must be maintained for equipment purchased with grant funds, including a description of the property, serial or other identification number, location, etc. During a site visit to JRIC, we observed a sample of the Palantir servers and verified that they were appropriately recorded on JRIC's inventory listing. We noted that the Sheriff's official inventory listing did not include all of the information required per the CFR. Specifically, the Sheriff did not record who holds title to the servers, the acquisition date for each server, the cost of the servers, or the percentage of federal participation in their cost. In addition, County Fiscal Manual (CFM) S 6.1.0, Capital Assets, indicates that equipment, such as computer hardware, having a useful life of more than one year and costing $5,000 or more is a capital asset. The CFM indicates that, among other requirements, Departments must maintain a record of acquisitions and dispositions of capital assets by using the eCAPS Capital Asset System. We consulted with the A-C's Accounting Division and reviewed eCAPS records, and found no indicatíon that the Palantir servers were recorded as capital assets. None of the purchasing documentation or Palantir invoices provided by the Sheriff or ISD specified the number of servers purchased or their cost. At our request, Palantir provided a list of the servers included with the Sheriff's purchases. However, Palantir declined to specify the cost per server, and a company representative claimed that unit pricing information "... is Palantir proprietary and trade secret information." Because Palantir refused to provide us with pricing information, we used publicly available prices for servers and related hardware, obtained from the internet, to estimate the original cosVvalue of the Palantir servers. Our estimates are based on the AU DITOR-CONTROLLER COUNTY OF LOS A'VGE¿ES Review of Countv Transactions with Palantir Paqe 6 retaíl price of equipment substantially similar in configuration, capacity, and capability to Palantir-supplied servers at JRIC. Our analysis indicates that most of the servers likely exceeded the $5,000 threshold at the time of acquisition, and should have been recorded as capital assets per County policy. Recommendations Sheriff's management: 1. Revise its listing of equipment purchased with Urban Areas Security lnitiative and State Homeland Security Grant Program funds to comply with the record keeping requirements specified in Title 44 of Gode of Federal Regulations, Part 13. 2. Determine or estimate the acquisition cost of Palantir servers, record any Palantir hardware that meets the County's definition of a Gapital Asset (i.e., costing $5,000 or more) in the electronic Gountywide Accounting and Purchasing System, as required by Gounty Fiscal Manual Section 6.1.0, and implement procedures to ensure that future capital asset purchases are appropriately recorded. Transactions 2-5 and 8-11 - Palantir Purchases for JRIC According to JRIC and Sheriff managers, the Palantir pilot was deemed successful by the JRIC leadership team and in October 2011, LASD purchased the Palantir cores and servers required for JRIC to fully implement the system. As additional law enforcement agencies were trained on and began to use the JRIC Palantir platform (which is currently being used by over 25 law enforcement agencies and nearly 5,500 users), and as additional data sources were added to Palantir, it became necessary to purchase additional Palantir cores and servers to maintain intelligence data processing capacity and capability. The following discussion addresses transactions 2-5 and 8-11. Transactions 7 and 12 are purchases of maintenance services only (i.e., not cores) and are addressed separately. Transaction 6 represents a purchase made exclusively for LASD, with Federal Asset Forfeiture Funds, and is also addressed separately. Citv and State Approvals The Sheriff provided us copies of letters from the City and Cal OES indicating that they each approved using UASI grant funds for these eight sole source purchases. The Sheriff also provided documentation confirming that the Department was reimbursed from UASI grant funds for these purchases, which were made on behalf of JRIC. LASD Approvals CFM S 4.4.0, Procurement Methods, states that Departmental requisitions used to request goods and services must be approved by the appropriate authority level(s). AU DITOR-CONTROLLER COUNTY OF ¿OS ANGE¿ES Review of Countv Transactions with Pal Pase 7 Also, if the amount is above the department's delegated purchasing authority, the CFM indicates the requisition should be electronically transmitted to ISD's Purchasing Agent. We noted that LASD requisitions for each Palantir purchase contained appropriate management level approvals as required by the CFM. Each requisition exceeded LASD delegated purchasing authority (i.e., over $15,000), and LASD properly submitted each requisition to ISD for approval. ISD Aporovals County Purchasing Policy #P-3700 indicates that sole source purchases over $5,000 must be approved by the Purchasing Agent, may be awarded without bidding when the item can be obtained only from one source, and the sole source acquisition must be adequately justified. The Polícy also specifies that Departments must demonstrate that the sole sourced commodity is available from only one source, that the brand must match or inter-member with an existing system, etc. We noted that for all Palantir purchases, LASD completed and submitted standard County sole source questionnaires with the requisitions. According to the questionnaires, "Palantir is the only software that analyzes this kind of data at the law enforcement level." However, we cannot evaluate this conclusion because the Sheriff did not develop formal requirements before procuring Palantir. Palantir correspondence included in the purchasing packets indicate its software is proprietary, and that it holds patents, trademarks, etc., to its intellectual property, for which Palantir is the sole provider. ISD approved the LASD purchases from Palantir as they each met the criteria for sole source commodities. County Purchasing Policy #P-0800 indicates that for negotiated transactions (i.e., purchase orders and agreements established without a competitive bid process), ISD will complete a Negotiated Purchase Documentation form to document and justify the transaction. We verified that ISD completed this form for each Palantir purchase. ISD Monthly Report to the Board As indicated, County Code S 2.81.960 states that any sole source purchase over $5,000 must be reported to the Board on a monthly basis. ISD appropriately reported each of the eight LASD sole source Palantir purchases on its monthly Report on Negotiated/Sole Source Purchases to the Board. CIO Approvals According to Board Policy #6.020, Chíef lnformation Office Board Letter Approval, to ensure continuity Countyrvide in the implementation or modification of information management systems, it is "essential for the CIO to review all requests from County departments" for purchases of information technology (lT)-related software, equipment, etc. This Policy states that departments are required to obtain CIO review and approval AU DITOR-CONTROLLER COUNTY OF ¿OS A,VGELES Review of Countv Transactions with Palantir Paqe I on "all purchases" of computer based software, equipment or services prior to finalizing such acquisitions. We noted that four (transactions 1, 3, 4, and 5) of the nine JRIC Palantir purchases were not reviewed by the ClO. During our review, we noted that CIO and (44o/o) ISD management expressed differing views of the CIO's role in review/approval of these purchases, and also of the intent and applicability of Board Policy #6.020. ISD management indicated that, based on historical discussions with CIO staff, the Policy was applicable to those lT purchases requiring Board approval, and that it was not intended to require CIO review/approval of all lT purchases. CIO management indicated that the Policy required CIO review and approval of all lT purchases, but that the Policy had not been fully implemented in process or practice. These discrepancies indicate the need for additional clarification on how the policy should be implemented and its applicability. fn May 2014 (i.e., after all but the last Palantir purchase were completed), the CIO issued to the CIO Council a clarifying lT Procurement matrix which incorporates reviews by ISD Purchasing, to ensure that each lT purchase request is properly evaluated. This matrix indicates that, among other requirements, ISD Purchasing will submit to the CIO requests for new software, new upgrades, and new maintenance for review/approval, and submit renewals or updates greater than $100,000, to the CIO for review/approval (if CIO approval has not already been obtained by the purchasing department). CIO managers indicated that the requirements in the matrix were approved by ISD and discussed with the CIO Council, comprised of Departmental ClOs and lT managers. We noted that the matrix summarizes and provides clarification for existing purchasing policies, but it does not appear to be documented in County policy where it may be easily referenced by all County personnel. Recommendations 3. Sheriff management ensure that all applicable Ghief lnformation Office reviews/approvals related to information technology procurement are obtained prior to approving Departmental purchase requests. 4. Chief lnformation Office management work with Gounty Gounsel and, if applicable, the lnternal Services Department, to consider incorporating the requirements in the lnformation Technology Procurement matrix into Board Policy 6.020 and/or County purchasing policy. Transaction 6 - Sheriff's Palantir lmplementation According to Sheriff purchasing documentation, in March 2013, the Department used $500,000 in "Federal Asset Forfeiture" funds to purchase the Palantir Government platform to "allow Department members access to additional datasets that the JRIC shares with other agencies," such as the Los Angeles and Long Beach Police Departments. LASD indicated that this purchase was initiated for the School Safety AU DITOR-CONTROLLER COUNTY OF LOS A'VGELES Review of Gountv Transactions with Palantir Page 9 Project, which enables deputies to quickly access information about schools via MDCs in LASD patrol cars, to assist in emergency response situations. ln addition, the LASD implementation of Palantir provided deputies with access to Palantir's data analytics from their MDCs. We reviewed LASD purchase order #SH-13322578 (transaction 6) and supporting documentation, and found that the purchase was properly approved by LASD executive management. We also found that the purchase was reviewed and approved by the ClO, and ISD approved the PO as a sole source. According to transaction detail from eCAPS, LASD used Federal Forfeiture Special Funds to pay for this purchase. According to the U.S. Department of Justice's Guide to Equitable Sharing for State and Local Law Enforcement Agencres, Federal Forfeiture funds may be used for costs associated with the purchase, lease, maintenance, or operation of law enforcement equipment, including computers, computer accessories, and software. We found no violations of County policy or law related to this transaction Transaction 7 - Palantir Purchase for JRIG This transaction, totaling $1 million, differed from transactions 2-5 and 8-11 in that the product description on Palantir's quote indicates the purchase is for "Palantir Operations and Maintenance for 1 core," and software, hardware, etc., were not bundled in. The product description on the invoice also differed slightly from the quote, and stated "Annual Support and Maintenance for 1 Palantir Government License, per server core." Although the invoice indicates that what was purchased was annual support and maintenance, there is no period of service indicated on any of the purchasing documents for this transaction. We noted that the product description on the LASD requisition is the same as that on Palantir's quote. However, the description on the PO includes additional language: "Software-license-core-perpetual-to include all support services, product upgrades, implementation and integration services-hardware-Palantir." ISD staff indicated that at the time, this purchase appeared to be the same as the previous Palantir purchases. Therefore, they added the language from the prior Palantir POs for consistency. Palantir indicated that this purchase was for software operations and maintenance only; no software licenses, servers, or other hardware were included. County Purchasing Policy #M-1400, Software Upgrades, Maintenance and Support, differentiates between acquisitions related to software maintenance, whích is considered personal property (a commodity), and software support, which is considered a service. County procurement policies mandate that Departments obtain a Board contract if requirements for services exceed $100,000. ln addition, County Purchasing Policy #P-3600, Purchase Orders for Services, states when services (e.9., installation, training, etc.) are bundled with the purchase of commodities (including software upgrades, maintenance, etc.) "a Board contract is not required when the service AU DITOR-CONTROLLER COUNTY OF LOS AA'GELES Review of Countv Transactions with Palantir Page l0 component is less than or equal to 30% of the total cost," and the purchase is deemed commodity driven. The product descriptions used by Palantir for this purchase are inconsistent (using the term "operations" on the quote and "support" on the invoice) and do not provide sufficient detail to determine if Palantir provided maintenance, service, or some combination thereof, as defined in County policy. Also, if both maintenance and service were provided, Palanti/s bundled pricing does not make it possible to determine if the service component is less than 30%, as the costs of each component are not discretely identified. Because of the ambiguity related to this purchase, and because the product descriptÍon was different than prior purchases, ISD should have consulted with the Sheriff at the time of the purchase to verify precisely what was being procured, as the Department is the best source of this information. Palantir subsequently indicated that this invoice was for software maintenance, a commodity purchase according to County policy. As indicated, the issues related to Palantids bundled pricing model as well as our recommendations are addressed in the Other lssues section of this report. Maintenance Period Palantir's invoice, dated April 1 , 2013, states it is for annual support and maintenance for the government licenses held by LASD/JRIC, but the annual period is not indicated on any Palantir or LASD/JRIC purchasing documentation. The Palantir License and Services Agreement indicates that support services will be provided, "for the period of time specified on the first page of this Agreement." However, no term is indicated for the "Support Services and Product Upgrades" listed in this Agreement. Any services that were listed on the Palantir purchases for cores were noted as "included" at zero cost to the Sheriff. Palantir staff indicated that one year of support and maintenance from the date of purchase is included with each core, and this invoice was for the service period of March 1, 2013 through February 28, 2014. Palantir staff told us that because the LASD/JR C cores were purchased at various times (between October 2011 and March 2013), the company billed for all cores at one time to consolidate the maintenance billing to once per year. We noted that based on the number of cores for which Palantir billed for maintenance (52), the company appropriately did not bill for maintenance of the 4 cores purchased in March 2013. LASD approved payment of this invoice although it did not list the period for which operations and maintenance were to be provided. Vendor invoices must contain sufficient information for the recipient of the goods/services to determine whether the items billed were actually received, are in accordance with the agreement under which they were procured, and are appropriate for payment. Also, invoices should be reviewed by an employee with sufficient knowledge of the purchase to certify that the correct goods/services were received. Absent sufficient information on the invoice or AU DITOR.CONTROLLER COUNTY OF ¿OS AA/GELES Review of County Transactions with Palantir Pase l1 other supporting documents specifying the period of service purchased, it appears thÍs invoice lacked sufficient information to justify payment. Recommendations 5. Sheriffs management ensure that prior to approving payment, invoices contain sufficient information, ê.g., term of service for annual supporUmaintenance, etc., to determine that items billed were received and are in accordance with the agreement under which they were procured. Also, invoices should be reviewed by an employee with sufficient knowledge to certify that all items billed for have been received. 6. lnternal Se¡vices Department management ensure that prior to issuing a purchase order, the requesting department provides sufficient information, ê.g., term of service for annual support/maintenance, product description, etc., to determine precisely what goods/services are being procured, and whether the items are being procured in accordance with applicable agreements. Approvals Documentation provided by the Sheriff indicates that the City and Cal OES approved the use of UASI grant funds for this purchase. As indicated, lSD approved the PO as a sole source commodity purchase. This purchase was made in April 2013, before the requirements of the CIO's lT Procurement matrix were developed, and it was not submitted to, or reviewed by, the ClO. As noted above, the CIO identified the need for and has developed enhanced protocols to ensure that departments obtain any appropriate CIO reviews and/or approvals prior to lT-related purchases. Transactlon 12 - Retroactive Payment On April 3,2015, LASD submitted a letter notifying your Board of the need to make an immediate $1.05 million payment to Palantir, and that the requested PO from ISD would be retroactive for the period that began on March 1, 2014. LASD's letter also indicated that the request was deemed urgent as the original March 31, 2015 deadline for submitting requests to the City for UASI grant reimbursement had passed, but was subsequently extended until April 1O,2015. Purchasing documentation indicates that in early 2014, Palantir billed the Sheriff for core support and maintenance for the upcoming service year, i.e., the maintenance period of March 1,2014 through February 28,2015 (this period was later modified, as discussed below). We noted that this purchase, as with transaction 7, was different from the other Palantir purchases in that it did not include bundled commodity items such as software licenses, product upgrades, hardware, etc., and was instead a AU DITOR-CONTROLLER COUNTY OF LOS A,VGE¿ES Review of County Transactions with Palantir Pase 12 purchase of "operations and maintenance seryices." lt appears that this difference, as well as unexplained delays and other factors, impacted the processing of this purchase resulting in the retroactive payment. Specifically: a According to JRIC, Palantir submitted its first quote on January 9, 2014. However, JRIC staff rejected the quote because it specified the wrong service period. The revised quote included with the Sheriffls purchasing documents is dated September 30, 2014, and the Sheriff did not give final approval for payment until November 3,2014. Neither JRIC nor the Sheriff could explain the delay in obtaining a corrected quote or processing it for payment. LASD indicated that JRIC should have provided the quote to LASD, but did not in this case. LASD staff indicated that upon receiving the invoice (on an unknown date), it was determined to be for services rather than a commodity, and that the invoice was returned to JRIC to obtain a contract, as required by County purchasing policíes. On January 26, 2015, LASD management requested assistance from ISD to obtain a maintenance and support services contract with Palantir. o CIO staff indicated they initially did not approve this purchase upon their first review, on March 24, 2014. CIO staff also indicated they recommended that LASD obtain a contract with Palantir, since they were procuring services only. However, by mid-2014, LASD had not made any progress toward obtaining a contract. Ultimately, the CIO approved the purchase on November 24, 2014, without a contract. a As with transaction 7, the product description stated "Annual Support and Maintenance" for one year wíthout separately identifying the costs of support (i.e., service) and maintenance (commodity). ISD moved fonryard with the PO on approximately April 8, 2015, after receiving a County Counsel opinion that the Palantir invoice for annual maintenance was considered a commodity and fell within the ISD Purchasing Agent's authority to procure. a UASI grant performance periods vary from year to year, and purchases may only be made for a given grant period if they are pre-approved by Cal OES. Thís purchase did not have such approval because the service period on the invoice fell within a grant period which had already closed. The Palantir invoice indicated the term as March 1, 2014 through February 28, 2015, and LASD submitted its request to the City to use "UAS 13" funding, i.e., funding from UASI grant, performance period 13 (August29,2013 through May 31 ,2015). LASD did not have pre-approval to use UAS 13 funds for the sole source purchase from Palantir for the entire term invoiced. LASD was later able to obtain approval for grant funding for two six-month periods, March 1,2014 through August 15, 2014, and December 4, 2014 through May 31 , 2015. Palantir waived its service charges for the interim period. AU DITOR-CONTROLLER COUNTY OF LOS AA'GE¿ES ln 2007, the CEO established the Retroactive Contract Review Committee (RCRC) in response to prior Board concerns regarding retroactive contracts. The CEO also created procedures that require departments to notify the CEO in advance of seeking Board approval for retroactive contracts/payments, and state that departments must provide the RCRC with a written report indicating the cause and corrective action plan to help prevent recurrence. In an April 3, 2015 letter to your Board, the Sheriff stated that the Department plans to work with the CEO's RCRC for disposition and approval of a corrective action plan to mitigate the issue of retroactive payments. Recommendations Sheriff's management: 7. Ensure that Sheriff's procurement staff are appropriately trained on County policies related to contracting, retroactive payments, and the importance of ensuring that agreements are in place, where required, before incurring costs for services. 8. Follow through with the Chief Executive Office Retroactive Gontract procedures prevent help Review Gommittee's established to additional retroactive payments. Federal and State Grant Reimbursement As indicated, LASD made 11 of the 12 purchases from Palantir on behalf of JRIC, which is UASI grant funded. (The exception was transaction 6, which was for LASD only, using Federal Asset Forfeiture funds). We found that LASD properly submitted claims to the City and was reimbursed for all of the Palantir purchases for JRIC. Other lssues Palantir Pricinq Model As noted above, Palantir uses an opaque pricing model and does not discretely identify to customers the costs of software, hardware, equipment, and professional services. This bundled pricing model impaired the application of County policies requiring that certain categories of purchases be approved by the Board, and that capital assets be identified and recorded in the County's accounting system. The following issues should be resolved to prevent future problems with similar purchases: Commod ities Versus Services The County's purchasing policies differentiate between purchases of commodities and services. County Purchasing Policy #P-3600 states that service contracts that exceed $100,000 annually must be awarded bythe Board. As indicated, the Policyalso states that when services are bundled with the purchase of commodities, a Board contract is not required when the service component is less than or equal to 30% of the total cost, AU DITOR-CO NTRO LLER COUNTY OF ¿OS AA'GELES Review of Gounty Transactions with Palantir Pase 14 i.e., the purchase is deemed commodity driven. ln addition, County Purchasíng Policy #M-1400 provides that for purchases of software, upgrades and maintenance are both treated as commodities, but software support is a service and subject to the $100,000 limit. On its quotes to LASD, Palantir listed support services at zero cost (or in one instance, at less than 30% of the total cost). ISD purchasing managers determined that because of this bundled pricing, the Palantir purchases subsequent to the pilot were commodity driven. As indicated, a Palantir core is generally described on its invoices as including perpetual software licenses, support services, product upgrades, implementation and integration, and hardware appliances. This bundled pricing model does not allow the County to differentiate the portions of cost associated with commodities (e.9., software licenses and maintenance) from the cost of services (e.9., support services), and creates uncertainty concerning the appropriate authority to approve the purchase and which purchasing process to follow. ISD provided correspondence indicating that prior to issuing the PO for transaction 12, management sought additional information from Palantir concerning the cost of the service portion, as well as guidance from County Counsel to determine if this transaction met the criteria for commodíty purchase. Based on Palantir's representation, County Counsel deemed the transaction a commodity purchase. a ISD is in the process of implementing additional management review related to sole source purchases over $1 million, and ISD staff are drafting a policy to address this. To ensure that departments meet County purchasing requirements related to services, such additional oversight should also be applied to purchases where the service component may exceed $100,000 (i.e., may require a Board contract). Recommendation 9. lnternal Services Department management finalize procurement policies that provide guidelines for additional management review and oversight of purchases that may include a service component exceeding $100,000 annually, where the costs of goods and commodities and services are not separately identifiable. Palantir Pricinq We obtained the U.S. General Services Administration (GSA) Awarded Federal Pricelist for Palantir from the GSA website and found that the GSA price for the Palantir Perpetual License is $141,015 per seryer core, which includes initial year operations and maintenance (similar to the Sheriff's purchases). Compared with GSA pricing, it appears that LASD paid approximately $16,000 less per core than Palantir charges the federal government. According to LASD's Sole Source Request for the pilot program, LASD received a "specíal discount because it will be the first in the L.A. basin to use this software." Palantir staff indicated that at the time of the original purchase, Palantir AU DITOR.CONTROLLER COUNTY OF ¿OS A'VGELES Review of Countv Transactions with Palantir Paqe 15 provided JRIC a discount because they viewed working with the fusion center as a good partnership. LAPD and Palantir According to an LAPD representative, LAPD independently procured its own Palantir platform with grant funds it received from the Los Angeles Police Foundation. The Foundation applied for the grant from the Target Corporation, and the Foundation subsequently donated the funds received to LAPD. We learned that the LAPD interviewed five vendors for intelligence software, and ultimately selected Palantir. However, they did not go through the standard City procurement process since the purchase was grant funded. LAPD is a member of JRIC, and when they discovered JRIC used Palantir, LAPD established a data sharing agreement with JRIC in 2011. LAPD did not respond to follow up calls regarding the price paid per core by LAPD. Recommendations 10. Sheriffs management work with County Counsel, Palantir, and ¡f applicable, the lnternal Services Department to negotiate pre-approved and the most economic pricing for future Palantir core purchases. 11. lnternal Services Department management work with Gounty Gounsel to develop procurement policies that provide guidance to Departments in situations where a vendor cannot or will not discretely identify the costs of commodity and service components of a purchase, to ensure such purchases are properly disclosed to the Board when required. Future Contract for lT Services Currently, maintenance and support for JRIC's Palantir platform are paid for via an ISDissued purchase order. As indicated, the CIO initially did not approve the $1.05 million invoice for maintenance and support due to the lack of a formal agreement. ISD and LASD management also expressed concerns regarding the lack of documented and defined specifications for JRIC's data analysis system, and the potential need for a County contract with Palantir. LASD correspondence related to the maintenance and support purchase indicates the JRIC's Palantir system will require annual support services, and that the Department intends to negotiate a service contract with Palantir. County Purchasing Policy #P-3600 indicates that, "Seryice is the performance of labor by an outside firm or contractor for and/or on behalf of County departments. lt can be rendered to the County by a firm or individual, with or without the furnishing of materials." Given the varying descriptions of products/services indicated on Palantir's quotes and invoices, LASD should ensure that any future contract with Palantir contains sufficient information so that services can be differentiated from commodities. AU DITOR-CONTROLLER COUNTY OF LOS AA/GE¿ES Recommendations Sheriff's management: 12. Work with County Counsel and Palantir to establish agreed-upon contract terminology such that Palantir's products can be classified and differentiated as "commodities" and "seryices." 13. Work with Gounty Counsel and if applicable, the Internal Services Department, to establish purchases from Palantir. a Board-approved contract for service Californía Sales Tax on Equipment - Servers Palantir indicated that ten of the purchases included servers, which are tangible property. According to the State Board of Equalization (BOE), Regulation 1502, purchases of tangible property are subject to sales tax. This Regulation, which addresses computers, programs, and data processing, also provides that sales taxes may be applicable to the sale of storage media for computer programs, but custom computer programs and service-related purchases, such as for training, etc., are not taxable. However, service charges may be taxable if the services are "performed as part of the sale of tangible personal property." We noted that the Palantir License and Services Agreement specifically states that the customer is responsible for all applicable taxes, including sales tax. The invoices for the ten transactions do not list sales taxes, the POs all indicate that the tax due is $0, and we found no evidence that the Sheriff paid sales tax on these purchases. Also, ISD staff indicated that because they were not aware that the purchases included servers, they did not believe sales tax was applicable. Palantir's counsel indicated that, "LASD/JRIC did not get charged any sales tax for these purchases, and Palantir paid any applicable sales tax on LASD/JRIC's behalf as part of our commitment to the firmfixed price," i.ê., the pricing mechanism offered to LASD/JRIC. While the BOE holds the vendor responsible for payment of sales taxes, if the vendor does not pay, the sales tax may become a County liability. Since the purchases in question included servers (i.e., tangible property), and there is no evidence that taxes were collected or paid (other than Palantir's statement), the County may incur a tax liability as a result of this transaction. Palantir's practice of bundling equipment and services, and its refusal to provide a breakdown of costs, makes it difficult to estimate the amount of any possible tax liability. AU DITOR.CONTROLLER COUNTY OF ¿OS AAlGE¿ES Review of Countv Transactions with ntir Pase 17 Recommendations Sheriffs and lnternal Services Department management: 14. Work with Palantir to determine the cost basis of any taxable items purchased and the taxability of any services received under these purchases, and obtain written verification of all State sales tax paid by Palantir related to each purchase. 15. Request that Palantir include in all future invoices a separate line item for sales tax, and a representation as to who has paid or is responsible for paying the taxes to the Board of Equalization. AU DITOR.CONTROLLER COUNTY OF LOS ^AA'GELES Attachment ll Page I of 5 Cou¡vrY op Los A¡¡cer.r-s @ædfæ Jnr McDox¡mr¡ Srcn¡rr Augþet 17, eO15 ctohrr ÀIalmo, ¿{uditor- Controllen Department of Audltor-Controller 528 Kenneth Hal¡n HaIl of Admi¡istra.ülon. Ioe Angeles, Ca,llfornin 9OOl8 Dean lf¡. Natmo LOS.AIUGEI.ES E,oUITE SEEA.EF'8 DEPAEIMEIIT'8 R.ESPOIÚ8E TO TEE AIIDT¡OR"@¡ITROIJ,EN,'8 N,T¡VIEW OF IBANEACTIOIÙ8 BETIVEEN I¡g .â¡IGEI,E8 COÏIII T AIID PAI,AIITIA, ITCETIOLq}IES, I¡[C. Enclosed is t'he Ioe Angeles County (Coì¡nW) Bb.eriffs Depa.r'tnenü'e (Deparbment) responee to tJne Audftor-Cont¡oller'B BÉvierw of Transactions beüween the County and PaJa¡rtl¡ Technolog.ee, Ino., ae dlrected. at tJre Boa¡d of Supervlsore meetJng (Board Agenda ltem 7) on April 14, Ê016. The Def¡a¡tm.ent'e responee acknowledgee lts contlnued supporb as ühe ñduola.r¡r fon tJre clolnt Be$onal Intelligence Center (cInIC), lncludlng reeponsibillty to approprtate\y mÊna,€ie tJre ÏInlted Statee Depe,rtneut of lromele.nd Beourlt¡r Gra,nt prcoÉFetns on bebalf of .IB^IC. ltre Department iB ln a,tFeenent wttJr the Audftor-Cont¡oller'B flndln¡ls, a,nd. wlll contlnue to work wlth tJre Internal Servlcee Department,, Gblef I¡¡fornatlon Offi.ce, a¡rd Cou¡rty Counsel to implemenü tJre recourmendatlone ln tJre report. If you have an¡r queetlor¡.s or require addttlonal lnformatlon, please contast Divielon Di¡estor Cllen Dragovlch, Ad.mJalotratfi¡e a¡rd fi'nrnlnÉlDlvlolon, at (A16) Aeg-6191 or ll[anager Chuck Porter aù (2Iõ) ?,P,9-6,6.?,0. Sincereþr, SHEB,IT'F e t r W'nsr Tr¡ær¡ Srnrrr, Los À¡rcn¡.us, C u.rron¡n a, goole Attachment ll Page 2 of 5 IEE LOg A¡TCIELEB COIIIVIY gEEnffi'B DEPAnTMEII¡1['8 R'E8POIÛBE TO AIIDTTON,-COIUIIIOT.T.T B'g NEMIEW OT TN.A¡ÚEACTIOIVB BETWEEIV IO8 .AIVG3I.,ES COUNIY ÂIID PAI..AI{ITIB TBOEIÜOLOGIES, INC. IEE lna¡¡aotton I - Pals,ntJr Pllot ProJect Eor¡lpmæt - 8s'vens A.EOOIIMETiIDA.TTOII I : SherifPe management re\rise lts Ustirxg of equipment purchaeed witñ. Urba¡r Areae Securlty Inltiatir¡e and State Homela¡rd Securlt'y Gra,nt Proeram fiJteds to compþ with tJre record keeplng requJrements epeoifi.ed in litle 44 Code of Federal l,egUJatlons (CFB), Pa¡t 16. Sb.eriffle B,egponse -to l,ecommendatlon I: A-ereq The Depa,rtment is i¡ tJxe process of updatJng the irrventorXr llatln$ of genrere/haxdware in accord.n.nce w1üh reportln$ reqtr.lrement's of CFn, 44,Pafi 16 arrd the County Ftecal Ma,nual (CFM) section 6.1.O Capltal Aseets. N,ECOMMEIIDAÍIO}Ï 2: Sb.er ffs mâ.na,Elemenü determirre or eetimate ttre acquislüoa ooet of PaJanür ser\rere, record, ao¡r PalantJr ba.ldwa,re that meets tÀe County'e deñrrlt'lon of a Capltal Aseet (1.e., costing $5,O0O or more) ln eCAPS, eB reqlÍ-red by CFM Section 6.1.0, and.lmplement procedr:reg üo ensu.re ühat futr¡¡e caplt¿,lagget purchaees ane approprlateþ recorded. Shgr,fffs Regponee to Recommep.ds,tlon Ê: A-gree Tbe Depart¡nent is e\/alrJs,ting eacb. of tJre 44 eenrele Burch,esed. from Pal¡rrtir to d.etermtrre eactr Berver's acquieitlon coet a,¡¡d wlll record in eCAPS ùtroee Bervers meeting CFM'e 6.1,O capital asset d.efiniüion. In addttlon, procedrxes will be implemented to ensu-re ühaü futt¡¡e capltal aeset purobases a,re approBrlaüeþ recorded. Iþe¡saßttoD.s ß-6 a,od 8-11 IùE COûnfi tti[DaÍIo]I - PaJs,nür Purohneee for çIRIC 5: Sherfff e rnana,gement ensu.re that all app]lcable Chlef Informatlon Ofñ.oe revlevûe/appror¡als related to f¡rformatlon tech¡olog$r procuremenf a,re obta.i¡ed. prlor to approvLng Depa,ftmental purchase reql¡este. 1 Attachment ll Page 3 of 5 Sberiffs l,eeoonee to necomnend.ation 5: A€ree the Departnent ie ln the process of developlng procedrlres that eneìrre aII informatlon tech-nolory pr.l¡ohaeee a,te re\¡leweÜapproræd. by the Chtef Informaüion OfEce prlor to approvl-ng DeBa,rtmental pulobaelng reque8ts. ha¡.Baú'tLon 7 - PaJånür h¡rclrn¡e fon cIRIC N,ECOMMEIVDATTOII E: Sherüfle mana,gement ensu.re tJrat, prlor to approving peJruoent, i.nvoices contain eufñclent f.rrformaüioD, ê.8., term of senrlce for an¡rual supporVmaJntena,nce, eüc., to determtrre tùat lteme biDed were recefi¡ed ar¡d are lD. accorda¡rce witb. the a6reement under whlch tlrey were procured. AlEo, lnr¡olceg ehould be reviewed by a,n srnployee \Àritö sufficient knowled$e to certlff tb.at a.ll items bllled for har¡e been reoefired. STrerlff e l,esponse.tp necoE-¡r.end-a,tion 5: Agree Îhe Depart¡nent wlll eneu¡e ùh¿t proceduree for tÏre revlew a.nd appronal of lnr¡olcea are stricùl¡r enfo¡ced to ensure all requJred lnformation le conta^tned i¡r tTre tnvolce, and tJrat tJ:e appropriate ler¡el of mana,gement bae rsviewed all lteme btlted for a¡rd b.ave been receir¡ed.. Tra¡ss^gH,on. lA - n€t,roaÆûhte Pqlrment nEcoìfTurnI[DAIIOtI 7: Sheriffle ma.nagement engure that procurement eta,ff ane epproprtateþ tæatned on Courrty pollclea relaüed üo contraothg, retroactlve pa¡rments, a,ûd ¿l¡s 'lrntrrorÈa,nce of eûBurlng ths,t egreementg a.re in place, wbere reqtrJred, befone lncu¡rlng coeüe for ger't¡loes. Sb.erfffs neer¡onee to Becommendç,tlon 7: AÆee vrlll eneure that all operational dlvlelon et€,ff are approprtateþ trs.jned on County pollcies related. to contractd-n$, (1.e., 1b.e Department eole sou.rce aÉleements), retroaoüirre pa¡rmeats, aled aegurance thaü agteemerxts are ix. pla,ce before coets for een,rlceg a.re inculred. 2 Attachment ll Page 4 of 5 Ilð OOMtrl,f.nÎm A rrTOtr[ I : thertffls managernent follow througþ with the Chlef Execuùir¡e Ofñ.cer's (CEO) Letroactfi¡e Cont¡act, Eeview Com-mlttee's (B,CRC) eetabüshed proceduree to b.elp prevent addlttonal ret¡oactlve pa¡p.ente. therlffls F,eeponge üo Becommçndp,tlon 8: -A.4ree April g, eOl5, letter to the Boe¡d. of Superwlsoro, tJre Depaætment lndlcated lts plans to work vrfth the CEO A,CFC for rìlnpoottton and. In a^n approval of a comeoüir¡e actlon plan to mtt'lgate the iseue of ret¡oactive paJilDxents. O'thæ fgsues PaJsûñr Prfdng Model R.ECOMME}TDAIIO$ IO: ShertfPe manaÉSement work rryith Counüy Couneel, PaJsJatJ-r, s.nd if applleable, the Internal Servioes Department to negotlate pre-approved and tJre moet economlc prtclng for futu¡e Pala^nùir core prrcbaeee. Sheriffle neeponse üo Reoommendatlon 1O: A.€ree Tlre Departm.ent will work wttb' County Cou.neel, Pala.:rtir, a¡rd tJre Internal Serwlces Department to negotiâ,te ple-s,pproved and economtcally prlced flrtu¡e Pala.ntlr core purchaees. Coutrarcû for If Bervloee RtCOr,Tr,rtrIüDAIIOIt lR : Work v¡'ith County Cou¡reel a,nd Pala,ntJr to estÉ,blieh agreed.-upon conüract terminolory such that Pala,nti¡'e products ca¡r be cl,aeei.fi.ed a,nd. dlfferenüiated. &B "ooxo"moditleg" a¡td. "gervlces. " Sh.erifÍs B,esponee to Beco[nm,end¿tlqn lR: AÊee The Depa,rtment wlll work with Cor¡nty Cor¡nsel and Pals.ntlr to eetablleh agþeed-upon conüract termirrolory sucb. that Pala¡rtir's products ca,n be claeeifled a¡:.d differentl¿ted. as "oommodltleg" and "ger.triceg." N.ECOMIIEtrTDATIO}I I õ: witJr Cou:rty Couneel a,nd. if appltcable, the Interna.l Servlces Department, to est€,blJeh a Boa¡d.-appror¡ed cont¡act for eenrlce purchaees from Palanti-r. Inrlork 3 Attachment ll Page 5 of 5 SherifFs l,esponee to n'ecomm.endatlon 15: A.eree The Depa,ltm.ent will work with County Cor¡nsel and the Inüernel Servlces Department to eetabllsh a Boa.rd.-a,ppror¡ed cont¡act for gen¡ice pu¡chasee fnom Palantl¡. Callfornla Sales Tax on Equlpmeot - Serve¡'a N.ECOtrIMEIiIDATTO}I8 : $herffe aûd Internåf Eenrtoee Dspartû,ent manaÍl€rmoÊt: NEOOTIMEIIDAgIOIV 14. TlVork wlth Pala,ntJ¡ to determlne tbe coet baele of any taxabte items purohased a,nd tlre taxablllty of any services recelr¡ed u¡.der tJreee purchases, a,nd. obt¡.tn writüen r¡erif.cation of all sta,te sales tax paid by PaJantdr lelat'ed to each pr:rchase. Strerlffls nesponee to necommendatlon 14: AÊee Sherfffe ma,Då,gement,, tn coneultå'ülon wlth the Internal Services Department, a,nd tJre Audtt-Controller'B Disbu-rsement Divlslon, w-ill deüermlne the cosü basls and applicable tarc liabllity of sel'tricee recehæd. a¡rd products purchased from Pala,ntf¡ and obtain mltten verÍñcation ths,t s,U Californla Sales laxee h¿,r¡e been pald. B,ECOMÌÍEIUDJITTO}T I 8. H,equest thåt PaJs^Dtir include ln' alt futu¡e inr¡olces a separats llns item for sales tax, and a repreeent¿tion as üo who has paid or 19 lesponeible for pqying tJre tp.¡ces to tJre Bos.rd of Equalization. therlffle nestronge to Recom-mendatlon 15: AÈee Sb.erlffle rns,någement wlll reqtÍ.re PaJa.ntf.r to lnclude in all firtr¡¡e lnr¡oicee a sepaæate llne ltem for ealee ts^:( and acknowledÉle itg reeponsiblliùy as a Callfornla Corporatlon to pay tlre approprlate ta:c to th.e Boa¡d. of EqtæJ'jzatlon. 4 Attachment lll Page I of 3 County of Los Angeles INTERNAL SERVICES DEPARTi'ENT 1100 Nofth Eastern Avenue Los Angeles, California 9m63 JIM JONES Dlr€ctor "To enrích líves through efiective and caring ser-více" Tclcphone: (323',, 267-2103 FA)(: (323) 264-7138 August 24,201.5 To John Naimo Auditor€ontroller From Dave Chittenden Chief Depug Subject: RESPONSE TO THE SHERIFF'S DEPARTIT¡IENT REVIEW OF TRANSACTIONS BETWEEN LOS ANGELES COUNTY AND PALANTIR TECHNOLOGIES, lNC. (Board Agenda ltem 7, April 14,2015) to the recommendations involving lntemal Servlces Deparfrnent contained in your report (attached). Aüached are our Íesponses lf you need any addltional information, please contact me or your staff may contact Dave Yamashita at (323) 267-2136 or via email at dvamashita@islJ.lacountv.qov. DC:DY:rc Attachment c: CIO Attachment lll Page 2 of 3 INTERNAL SERVICES DEPARTMENT RESPONSE TO THE AUDITOR.CONTROLLER AUDIT REPORT SHERIFF'S DEPARTMENT - REVIEW OF TRANSACTIONS BETWEEN LOS ANGELES COUNTY AND PALANT¡R TECHNOLOGIES, INC. (Board Agenda ltem 7, April 14, 2015) Becommendation 6: lnternal Services Department ensure that prior to issuing a purchase order, the requesting department provides suffÌcient informatiotr, ê.g., term of sewice for annual support/maintenance, product description, etc., to determine precisely what goods/services are being procured, and whether the items are being procured in accordance wíth applicable agreements. ISD Response_: We concur. ISD will enhance its existing internal procedures to ensure that Purchasing staff (buyers) review all purchasing requests and requlre all relevant information from the Departments prior to issuing the purchase orders. Target Date: November 30, 2015 Reg-oJnmendation _9: lnternal Servlces Department management finalize procurement policies that provide guidelines for additional management review and oversight of purchases that may lnclude a service component exceeding S100,000 annuall¡ where the costs of goods and commodities and services are not separately identifiable. ISD Response: We concur. ISD is in the process of revising its existing intemal procedures to incorporate additional management approval levels, to ensure adequate oversight for all purchases, lncluding sole source purchases. Target Date: November 30, 2015 Recommendation 11: lnternal Services Department management work with County Counsel to develop procurement policies that províde guidance to Departments in situations where a vendor cannot or will not discretely identify the costs of commodlty and service components of a purchase, to ensure such purchases are prop€rly disclosed to the Board when requlred. Page 1 ol 2 Attachment lll Page 3 of 3 INTERNAL SERVICES DEPARTMENT RESPONSE TO THE AUDITOR.CONTROLLER AUDIT REPORT SHERIFF'S DEPARTMENT - REVIEW OF TRANSACT¡ONS BETWEEN LOS ANGELES COUNTY AND PALANTIR TEGHNOLOGIES, INC. (Board Agenda ltem 7, April 14, 2015) ISD Response: We concur. ISD will work wíth County Counsel in revising existing procurement policies to require vendors to itemize commodity and service components of a purchase separately. Target Date; February 29,2016 Recommendation 15: lnternal Services Department request that Palantir include in all future invoices a separate line item for sales tax, and a representation as to who has paid or is responsible for paying the taxes to the Board of Equalization. ISD Rçspg¡nqe: We concur. See ISD response to Recommendation 11. ISD will work with County Counsel in revising existing procurement policies to ensure that each purchase includes sales tax information and identify the party responsible for the payrnent of taxes. Target Date: February 29,2016 Page 2 ot 2 Attachment lV Page 1 of 1 COUNTY OF LOS ANGELES CHIEF INFORMATION OFFICE Los Angeles World Trade Center 350 South Figueroa Street, Suite 188 Los Angeles, CA 90012 RICHAFD SANCHEZ CHIEF INFORMÂTION OFFICER Telephone: (213) 253-5600 Facsimile: (213) 633-4733 August 24,2015 TO FROM: John Naimo Auditor-Controller Richard Sanchez Chief lnformation Officer PALANTIR REVIEW Thank you for prov¡ding an opportunity to participate, review and discuss findings of your recent audit concerning the Sheriff and Palantir Technologies. The Chief lnformation Office concurs with the recommended action and we wish to commend the staff of the Auditor-Controller for their professionalism, patíence and demeanor in this effort. RS:lc "To Enrich Llves Through Effêctive And Carlng Servtce"