OPERATIONAL AUDIT Oklahoma Office of the Attorney General For the period July 1, 2009 through June 30, 2015 Oklahoma State Auditor & Inspector Gary A. Jones, CPA, CFE Audit Report of the Oklahoma Office of the Attorney General For the Period July 1, 2009 through June 30, 2015 This publication, issued by the Oklahoma State Auditor and Inspector?s Of?ce as authorized by 74 0.8. 212, has not been printed, but is available on the agency?s website and in the Oklahoma Department of Libraries Publications Clearinghouse Digital Collection pursuant to 65 0.8. 3-114. 0klahoma State Auditor Inspector Wncoln Bl:d. . State Capitol, R00 Fax. 452136. October 4, 2016 TO THE OKLAHOMA OFFICE OF THE ATTORNEY GENERAL This is the audit report of the Oklahoma Office of the Attorney General for the period July 1, 2009 through June 30, 2015. The goal of the State Auditor and Inspector is to promote accountability and fiscal integrity in state and local government. Maintaining our independence as we provide this service to the taxpayers of Oklahoma is of utmost importance. We Wish to take this opportunity to express our appreciation for the assistance and cooperation extended to our office during our engagement. This report is a public document pursuant to the Oklahoma Open Records Act (51 0.8. 24A.1 et seq.), and shall be open to any person for inspection and copying. Sincerely, 41 065% .3, LISA HODGES, CFE, CGFM OKLAHOMA STATE DEPUTY AUDITOR INSPECTOR Oklahoma Of?ce of the Attorney General Operational Audit Background The Oklahoma Office of the Attorney General (Agency) provides legal counsel and representation for state agencies and employees as well as represents the interests of Oklahoma consumers, the state's natural resources and Oklahoma crime victims. The Agency is overseen by the Attorney General, an elected official. The following information illustrates the Agency?s budgeted-to?actual revenues and expenditures.1 BUDGET TO ACTUAL COMPARISON FY 2014 FY 2015 REVENUES Budgeted Actual Variance Budgeted Actual Variance General Appropriations (Excluding Carryover Funds) 14,323,415 15,228,141 904,726 13,693,008 14,579,934 886,926 Funds 70000 and 70500 38,895,691 26,787,058 (12,108,633) 16,004,849 14,981,297 (1,023,552) Taxes - 637,760 637,760 - 637,680 637,680 Licenses, Permits, and Fees 224,625 2,521,314 2,296,689 1,061,705 1,423,857 362,152 Fines, Forfeits and Penalties 500,000 31,806 (468,194) 541,615 5,582 (536,033) Grants, Refunds and Reimbursements 7,593,986 7,562,109 (31,877) 7,174,082 7,194,810 20,728 Sales and Services 11,813 566,849 555,036 79,552 68,590 (10,962) Non Revenue Receipts 12,192,767 16,866,414 4,673,647 10,286,210 2,566,430 (7,719,780) Total Revenues 73,742,297 70,201,451 (3,540,846) 48,841,021 41,458,179 (7,382,842) EXPENDITURES (Including Funds 57600, 70000, 70500) Personnel Services 19,104,946 16,878,239 (2,226,707) 20,201,445 19,043,834 (1,157,611) Professional Services 4,197,089 1,977,329 (2,219,760) 2,114,119 1,720,940 (393,179) Travel Expenses 847,402 243,363 (604,039) 516,881 276,093 (240,788) Administrative Expenses 12,880,185 22,955,203 10,075,018 9,725,424 6,944,466 (2,780,958) Property, Furniture, Equipment, and Related Debt 1,937,907 304,206 (1,633,701) 567,438 694,711 127,273 General Assistance, Awards, Grants, Program Payments 32,549,387 12,350,792 (20,198,595) 16,496,162 15,892,233 (603,929) Transfers and Other Disbursements 1,500,000 1,001,941 (498,059) 4,333,333 4,032,692 (300,641) Total Expenses 73,016,916 55,711,072 (17,305,844) 53,954,802 48,604,970 (5,349,832) Expenditures Over (Under) Revenues (14,490,378) 7,146,791 1 This information was obtained from the Oklahoma PeopleSoft accounting system. It is for informational purposes only and has not been audited. See summary of management?s explanation of variances on page 2 of this report. Oklahoma Of?ce of the Attorney General Operational Audit Summary of agency responses to budgeted-to-actual variances This information is a summary of responses obtained from the Oklahoma Office of the Attorney General. It is for informational purposes only and has not been audited. See budgeted-to?actual analysis on page 1 of this report. Revenues When budgeting, the Office of Attorney General anticipates and must plan for revenue, including general appropriations, case settlements, fines, fees, and grants. The timing and the sum of these revenue sources ?most specifically case settlements cannot always be determined with exactitude. In Fiscal Year 2014, we anticipated $73,742,297 in budgeted revenues. Actual revenues amounted to $70,201,451. Similarly, in Fiscal Year 2015, we anticipated $48,841,021. Actual revenues amounted to $41,458,179. These revenue variances stem from the timing and distribution of case settlements which did not occur as anticipated. Expenditures In Fiscal Year 2014, the Office of Attorney General, in light of uncertainty faced with case settlements, elected to spend less than budgeted. For example, the Office declined to expend the total budgeted for ?Personnel Services,? and ?Property, Furniture, Equipment, and Related Debt.? That is, the Office declined to expand certain units and delayed purchasing badly- needed IT equipment and programs. This savings combined with our case settlements allowed the Office to transfer in excess of $8,000,000 to the State General Revenue Fund in Fiscal Year 2015. Additionally, certain expenses in Fiscal Year 2014 were, in fact, restitution sums that must be distributed to impacted citizens. For example, a $10,000,000 partial case settlement distribution for those impacted by a mortgage settlement was placed with the Office for payment to those affected citizens. This distribution was coded to ?Administrative ees? and budgeted under ?General Assistance, Awards, Grants, and Other Program-Directed Payments? thus causing an offsetting variance in both line items. This distribution was only one such example of pass- through funds that must be expended over time. In Fiscal Year 2015 and in View of Oklahoma?s recession, the Office again opted to spend less than budgeted for Personnel Services and Administrative Needs. This continued belt-tightening allowed the Office to seek no general appropriation for Fiscal Year 2017. Oklahoma Of?ce of the Attorney General Operational Audit Scope and Methodology OBJECTIVE Our audit was conducted in response to 74 0.8. 212, which requires the State Auditor and Inspector?s office to audit the books and accounts of all state agencies whose duties it is to collect, disburse, or manage funds of the state. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In planning and conducting our audit, we focused on the major financial- related areas of operations based on assessment of materiality and risk for the period July 1, 2009 through June 30, 2015. Detailed audit procedures focused on the period of July 1, 2013 through June 30, 2015, addressing the most current financial processes and providing the most relevant and timely recommendations for management. Our audit procedures included inquiries of appropriate personnel, inspections of documents and records, and observations of the Oklahoma Office of the Attorney General?s operations. We utilized sampling of transactions to achieve our objectives. To ensure the samples were representative of the population and provided sufficient, appropriate evidence, the random sample methodology was used. We identified specific attributes for testing each of the samples and when appropriate, we projected our results to the population. Because of the inherent limitations of an audit, combined with the inherent limitations of internal control, errors or fraud may occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. Determine whether the Agency?s internal controls provide reasonable assurance that revenue, expenditures (including payroll), and inventory were accurately reported in the accounting records. Conclusion The Agency?s internal controls provide reasonable assurance that expenditures (including payroll) were accurately reported in the accounting records. However, the Agency's internal controls do not provide reasonable assurance that revenues or inventory were accurately reported in the accounting records. Oklahoma Of?ce of the Attorney General Operational Audit FINDINGS AND RECOMMENDATIONS Inadequate Segregation of Duties over Revenues The United States Government Accountability Office?s Standards for Internal Control in the Federal Government (2014 Revision)2 states, ?Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event." Furthermore, 62 0.5. 34.57 requires the agency to make deposit of receipts of $100 or more on a daily basis. One file clerk opens and sorts all check payments, and subsequently a second file clerk creates an Excel spreadsheet listing the checks received and delivers them to the assistant finance officer to continue the deposit process. Documentation accompanying the payments is dispersed to various agency divisions. Because it is difficult for the Agency to accurately forecast how much revenue should be received each month and because not all revenue-generating activity is independently reconciled against deposits, the opportunity for either of the file clerks to misappropriate a check exists. In addition, checks exceeding $100 in value are often held for more than one business day prior to deposit. This arrangement of duties coupled with the absence of a detailed reconciliation process creates the risk that revenue could be misappropriated without detection. In addition, retaining funds at the agency for longer than the statutorily authorized time period increases the risk of misappropriation and misstatement in the accounting records. It appears management was not aware of the risks created by this arrangement of duties or the lack of appropriate reconciliation controls, as well as the lack of timely deposits. Payments received by check that are at risk due to this deficiency represent approximately 15% of Agency revenues or $6 million, based on the Agency?s FY 2015 deposit records. In the division responsible for Do Not Call list registration and vending, the lack of an appropriate reconciliation resulted in failure to actively bill all registrants and to maintain complete electronic records of registrants and receipts. Because of the lack of reliable records, we were unable to conclude as to whether the agency was in compliance with 15 0.5. 7753.7, which requires the deposit of Do Not Call revenues into the Agency?s Fund 205. 2 Although this publication addresses controls in the federal government, this criterion can be treated as best practices. The theory of controls applies uniformly to federal or state government. Oklahoma Of?ce of the Attorney General Operational Audit It appears management was not aware of the risks created by this arrangement of duties or the lack of appropriate reconciliation controls resulting in the potential loss of over $10,000 in revenues per year. Recommendation We recommend management implement procedures where two individuals, at least one of whom is independent of the receipting and deposit process, sort and open the mail together, create the Excel check log together, and both sign and date the Excel log. The assistant finance officer should ensure this log agrees to revenue amounts recorded later in the deposit process. Management should implement procedures for billing, tracking, and reconciling revenues associated with the Do Not Call list to ensure all revenues due to the Agency are collected and deposited to the proper fund. Management should also implement a process to immediately receipt and deposit funds when they are received to ensure compliance with 62 0.8. 34.57. Views of Responsible Officials During the course of the Operational Audit, the Oklahoma State Auditor and Inspector?s Office notified the Oklahoma Office of the Attorney General that the opening of mail containing checks by one person in the mail room prior to deposit by the finance department created the potential for abuse. The OAG immediately implemented the recommendation to have two employees open the mail and document checks received. In addition, the OAG has requested and been approved to scan and deposit all incoming checks electronically as they are received. The necessary equipment will be secured and required training completed by no later than November 1, 2016. In 1999, the Legislature passed the Commercial Telephone Solicitation Act (?the Solicitation Act?), 15 0.5. 775A.1. The Solicitation Act required commercial telephone sellers (?telemarketers?) to register yearly with the OAG. The fees for first time registrations are $250 and $100 for renewal years. In 2002, the Legislature passed the Telemarketer Restriction Act (?the Restriction Act?), 15 0.5. 7753.1 et. seq., commonly known as the Do Not Call or Don?t Call Program (?the Do Not Call Program?). The Lack of Annual Inventory Counts and Reporting Oklahoma Of?ce of the Attorney General Operational Audit Restriction Act required the OAG to set up a regisz of consumers who did not want to be called by telemarketers and to circulate this list on a quarterly basis to the telemarketers that were registered under the Solicitation Act. The OAG promulgated rules to carry out this task. Under the rules, telemarketers must pay for this registry if they are calling Oklahoma consumers. The registry can be purchased yearly at $600 or quarterly for $150. During the Operational Audit, we were notified of concerns regarding how the OAG tracks billing under the Solicitation Act and the maintenance of the Do Not Call Program. The OAG launched an internal review and discovered that an employee had misapplied the rules applicable to the Solicitation and Restriction Acts. The following procedural changes have since been made to ensure records are accurate and properly maintained. 1. All annual renewal notices and invoices are now sent electronically to ensure proper documentation exists. 2. All invoicing and payments received are maintained electronically and reviewed and approved by a Supervisor. 3. A quarterly review process has been implemented with Finance to reconcile all billing and payment information. The United States Government Accountability Office?s Standards for Internal Control in the Federal Government (2014 Revision) state that in order to safeguard vulnerable assets, ?Such assets should be periodically counted and compared to control records. In addition, the Oklahoma Administrative Rules require that ?All agencies must submit an annual report of current inventory of tangible assets owned by the agency as of June 30 of the preceding fiscal year to the Office of Management and Enterprise Services by August 15.? The agency did not perform annual physical inventory counts during the audit period nor did they submit required annual asset reports to the Office of Management and Enterprise Services after 2012. It appears management has chosen not to comply with GAO standards requiring annual inventory counts nor the Oklahoma Administrative Rules requiring the annual reporting of current inventory of tangible assets. Without periodic inventory counts inventory may be misstated or misappropriated without detection. Oklahoma Of?ce of the Attorney General Operational Audit Recommendation We recommend management ensure that a comprehensive annual physical inventory count is performed and documented by someone independent from purchasing assets, maintaining inventory items and inventory records, and disposing of surplus assets. We further recommend that management submit required annual inventory reports to OMES. Views of Responsible Officials The OAG will ensure that an annual inventory count is accomplished by someone independent of maintaining inventory records and has done so since 2015. The OAG currently maintains a comprehensive annual inventory as required by OMES and has submitted OMES?required inventory reports since 2015. Indeed, since the period of the Operational Audit, two such inventory reports have been submitted, accounting for all current inventory of tangible assets. OFFICE OF THE STATE AUDITOR & INSPECTOR 2300 N. LINCOLN BOULEVARD, ROOM 100 OKLAHOMA CITY, OK 73105-4896 WWW.SAI.OK.GOV