Audit Report State Department of Assessments and Taxation October 2020 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY Joint Audit and Evaluation Committee Senator Clarence K. Lam, M.D. (Senate Chair) Delegate Carol L. Krimm (House Chair) Senator Malcolm L. Augustine Delegate Steven J. Arentz Senator Adelaide C. Eckardt Delegate Mark S. Chang Senator George C. Edwards Delegate Andrea Fletcher Harrison Senator Katie Fry Hester Delegate Keith E. Haynes Senator Cheryl C. Kagan Delegate Michael A. Jackson Senator Benjamin F. Kramer Delegate David Moon Senator Cory V. McCray Delegate April R. Rose Senator Justin D. Ready Delegate Geraldine Valentino-Smith Senator Craig J. Zucker Delegate Karen Lewis Young To Obtain Further Information Office of Legislative Audits 301 West Preston Street, Room 1202 Baltimore, Maryland 21201 Phone: 410-946-5900 ꞏ 301-970-5900 ꞏ 1-877-486-9964 (Toll Free in Maryland) Maryland Relay: 711 TTY: 410-946-5401 ꞏ 301-970-5401 E-mail: OLAWebmaster@ola.state.md.us Website: www.ola.state.md.us To Report Fraud The Office of Legislative Audits operates a Fraud Hotline to report fraud, waste, or abuse involving State of Maryland government resources. Reports of fraud, waste, or abuse may be communicated anonymously by a toll-free call to 1-877-FRAUD-11, by mail to the Fraud Hotline, c/o Office of Legislative Audits, or through the Office’s website. Nondiscrimination Statement The Department of Legislative Services does not discriminate on the basis of age, ancestry, color, creed, marital status, national origin, race, religion, gender, gender identity, sexual orientation, or disability in the admission or access to its programs, services, or activities. The Department’s Information Officer has been designated to coordinate compliance with the nondiscrimination requirements contained in Section 35.107 of the United States Department of Justice Regulations. Requests for assistance should be directed to the Information Officer at 410-946-5400 or 410-970-5400. October 5, 2020 Senator Clarence K. Lam, M.D., Senate Chair, Joint Audit and Evaluation Committee Delegate Carol L. Krimm, House Chair, Joint Audit and Evaluation Committee Members of Joint Audit and Evaluation Committee Annapolis, Maryland Ladies and Gentlemen: We have conducted a fiscal compliance audit of the State Department of Assessments and Taxation (DAT) for the period beginning November 12, 2015 and ending March 24, 2019. DAT is responsible for administering the State’s real and personal property tax laws, including various programs that provide property tax credits to homeowners and renters, as well as for administering various functions applicable to corporations. Our audit disclosed that DAT did not have adequate procedures to ensure that all required physical inspections of real property were performed to help determine the property’s assessed value. In addition, DAT did not use available automated reports of assessment appeals filed by homeowners to ensure that the results of all such appeals were subject to independent review and approval. Our audit also disclosed a lack of assurance by DAT that all personal property returns and filing fees were received in a timely manner and that all exemptions granted from paying personal property filing fees and taxes were valid. In addition, DAT did not pursue penalties provided by State regulations for untimely submission of personal property returns. Furthermore, DAT did not perform timely audits to help ensure the accuracy of awarded homeowners’ tax credits (HTC), did not verify that only authorized HTCs were redeemed by homeowners, and did not certify, as required, that reimbursement requests submitted to the State by local jurisdictions for redeemed HTCs were proper. In addition, our testing disclosed that HTCs were not always calculated correctly, and as a result, HTCs awarded to thousands of homeowners in certain jurisdictions were improperly reduced by at least $4.4 million, resulting in an overpayment of property taxes by the applicable homeowners. We also noted that DAT awarded paid administrative leave to a senior management employee for five months at a cost of $55,860, without any supporting documentation and in excess of the 10-day limit on administrative leave allowed by State regulations. Furthermore, adequate controls were not in place to ensure that collections were properly accounted for and deposited timely, and we found that additional fees to be charged for expedited processing services were not collected for over 3,200 documents that had been processed on an expedited basis. Finally, DAT’s procedures for logging and monitoring critical database and mainframe security events were not sufficient. Our audit also included a review to determine the status of the ten findings contained in our preceding audit report. We determined that DAT satisfactorily addressed seven of these findings. The remaining three findings are repeated in this report. DAT’s response to this audit is included as an appendix to this report. In accordance with State law, we have reviewed the response and, while DAT generally agrees with the recommendations in this report, we identified certain instances in which statements in the response conflict with or disagree with the report findings. In particular, DAT disagreed with our recommendation regarding the possible refund of certain miscalculated taxes collected from homeowners in one jurisdiction (Finding 5) and disputes our authority to question administrative leave improperly awarded to a senior management employee prior to leaving State service (Finding 6). In each instance, we reviewed and reassessed our audit documentation, and reaffirmed the validity of our finding. In accordance with generally accepted government auditing standards, we have included “auditor comments” within DAT’s response to explain our position. We will advise the Joint Audit and Evaluation Committee of any outstanding issues that we cannot resolve with DAT. Additionally, in a number of instances, although DAT’s response indicated agreement, certain actions indicated by DAT may be insufficient to comprehensively address all the audit issues. These responses will require further clarification, but we do not anticipate that these instances will require the Committee’s attention to resolve. Finally, we have edited DAT’s response to remove certain vendor names or products, as allowed by our policy. 2 We wish to acknowledge the cooperation extended to us during the audit by DAT, and its willingness to address the audit issues and implement corrective actions. Respectfully submitted, Gregory A. Hook, CPA Legislative Auditor 3 4 Table of Contents Background Information 7 Agency Responsibilities Status of Findings From Preceding Audit Report Findings and Recommendations 9 Real Property Assessments Finding 1 – The State Department of Assessments and Taxation (DAT) did not have adequate procedures to ensure all required physical property inspections were performed. Finding 2 – DAT did not use available output reports to ensure that all real property assessment appeals recorded in its Assessment and Administration Valuation System were subject to independent review and approval as required. * * 10 12 Personal Property Assessments Finding 3 – DAT did not ensure that all personal property returns and 13 filing fees were received timely and that exemptions from filing a return and paying the fee were valid. In addition, DAT did not pursue penalties for the untimely submission of returns in accordance with State regulations. Homeowners’ Tax Credit (HTC) Finding 4 – DAT did not perform timely audits of awarded HTCs or verify the propriety of redeemed HTCs and reimbursement requests from local jurisdictions. In addition, DAT did not ensure local jurisdictions recovered and remitted HTCs from homeowners that transferred their properties. Finding 5 – DAT did not ensure HTCs were properly calculated. As a result, HTCs awarded to thousands of homeowners in certain jurisdictions were improperly reduced by at least $4.4 million. * 7 7 Denotes item repeated in full or part from preceding audit report 5 16 18 Payroll Finding 6 – DAT awarded paid administrative leave to a senior 21 management employee over a five-month period at a cost of $55,860 without any documentation. The administrative leave granted was also in excess of the 10-day limit on administrative leave allowed by State regulations. Cash Receipts Finding 7 – DAT did not have adequate controls to ensure that collections were properly accounted for and deposited timely. Finding 8 – DAT did not perform an independent supervisory review of corporate charter transactions to ensure that the proper fees were charged and collected. Our review disclosed that expedited processing fees for 3,277 documents were not collected. * 23 Information Systems Security and Control Finding 9 – DAT’s procedures for logging and monitoring critical database and mainframe security events were not sufficient. 25 Audit Scope, Objectives, and Methodology 27 Agency Response * 22 Appendix Denotes item repeated in full or part from preceding audit report 6 Background Information Agency Responsibilities The State Department of Assessments and Taxation (DAT) is responsible for administering the State’s real and personal property tax laws and various functions applicable to corporations (for example, issuing corporate charters and collecting certain taxes, such as gross receipts tax). DAT also administers programs that provide property tax credits primarily to homeowners and renters who meet the related eligibility requirements (such as gross income limitations). DAT’s headquarters is located in Baltimore City and assessment and taxation offices are located in each of the State’s 24 local subdivisions. According to the State’s and DAT’s accounting records, during fiscal year 2019, DAT’s expenditures totaled approximately $145.7 million and revenue collected totaled $318.9 million. DAT’s records for the tax year beginning July 1, 2019, identified the total assessable real property tax base subject to State tax rates to be valued at approximately $770 billion, consisting of 2,354,753 individual properties. Status of Findings From Preceding Audit Report Our audit included a review to determine the status of the ten findings contained in our preceding audit report dated February 22, 2018. As disclosed in the following table, we determined that DAT satisfactorily addressed seven of these findings. The remaining three findings are repeated in this report. 7 Status of Preceding Findings Preceding Finding Finding 1 Finding 2 Finding 3 Finding 4 Finding 5 Finding 6 Finding 7 Finding 8 Finding 9 Finding 10 Finding Description Physical exterior inspections were not performed for all properties as required by State law. Supervisory reviews of property reassessments by the local office supervisors were not always performed and documented as required at the two local offices we reviewed. DAT did not ensure that real property data recorded in the Assessment and Administration Valuation System were complete and accurate, and did not document supervisory reviews of assessment appeals and real property exemptions. DAT did not use available information to identify entities that failed to register or file a personal property return and did not review and approve exemptions from personal property assessments that were granted by DAT employees. DAT also did not pursue late filing penalties in accordance with State regulations and waived or reduced penalty fees without any independent review and approval. DAT did not effectively use various automated reports it created to help identify improper credits for review and follow-up. DAT had not performed timely and comprehensive verification procedures to help ensure the accuracy of homeowners’ tax credits (HTCs) awarded, and did not verify the propriety of redeemed HTCs and related reimbursement requests from local jurisdictions. Procedures for logging and monitoring critical database and mainframe security events were not sufficient. Intrusion detection prevention systems protection did not exist for untrusted traffic entering the DAT network and numerous DAT workstations were running an outdated and unsupported operating system. Controls over the services provided by DoIT were not sufficient to properly secure the DAT network. Controls were not in place to ensure that personal property filing fee collections were properly accounted for, secured, and deposited. 8 Implementation Status Not repeated Not repeated Not repeated Repeated (Current Finding 3) Not repeated Repeated (Current Finding 4) Repeated (Current Finding 9) Not repeated Not repeated Not repeated Findings and Recommendations Real Property Assessments Background Under the provisions of the Tax-Property Article of the Annotated Code of Maryland, the State Department of Assessments and Taxation (DAT) is responsible for uniformly assessing real property throughout Maryland at market value on a three-year cycle. Property assessments are conducted by assessors working in the 24 local assessment offices under DAT’s direction and oversight. DAT maintains an Assessment and Administration Valuation System (AAVS) as its primary database system, which includes a wide range of information and history about individual properties, including assessed values, property transfers and sales, and building permits. DAT certifies the assessed values of these properties to the 24 local subdivisions for the properties within each county and Baltimore City and these values are used by these jurisdictions (and municipal governments, when applicable) to prepare property tax bills. According to DAT’s records for the tax year beginning July 1, 2019, the assessable real property tax base subject to State and local tax rates totaled approximately $770 billion, applicable to 2,354,753 individual properties. Chapter 651, Laws of Maryland 2018, effective June 1, 2018, eliminated the requirement for DAT to conduct an exterior physical inspection of all properties to determine the value. Instead, the valuation may be based on a variety of assessment techniques, including computer modeling, sales analysis, or physical inspection. Exterior physical inspections are still required under certain circumstances, such as establishing an initial value on new properties and for existing properties with improvements expected to add at least $100,000 in value. State law requires that when such improvements are substantially complete, the property value be reassessed and the tax base adjusted as of the following January 1 or June 30, regardless of where the property is within its three-year cycle. To identify new or improved properties requiring physical inspection, DAT depends heavily on its review of building permits filed by property owners and contractors with local jurisdictions. The permit data are transmitted by the local jurisdictions to DAT’s local offices where the data are recorded in AAVS. During the period between January 1, 2017 and June 12, 2019, approximately 28,000 permits (including new properties and improvements), each with an estimated increase in value of at least $100,000 and totaling $19.6 billion, were recorded in AAVS. 9 Finding 1 DAT did not have adequate procedures to ensure all required physical property inspections were performed. Analysis DAT did not have adequate procedures to ensure that all required physical property inspections were performed. DAT Did Not Verify Local Offices Properly Coded Building Permits DAT did not have adequate procedures to verify that its local offices properly coded building permits to ensure the related properties were subject to required physical inspections. Permits for new properties and improvements with an estimated increase in value of $100,000 or more are to be coded as “new construction” to enable DAT to identify the property for exterior physical inspection. The value of the permit is determined by the local assessor based on the project cost and the overall impact the project will have on the value of the property. For example, a renovation costing $75,000 may add $100,000 to the value of a property and therefore require a physical inspection. Although DAT area supervisors monitored local supervisors to ensure that the local supervisors were reviewing the permits, they did not ensure these reviews were comprehensive. We reviewed 4,681 open (construction not yet complete) residential permits with a project cost of $175,000 or more and 790 open commercial permits with a project cost of $300,000 or more that were recorded in AAVS as of June 12, 2019.1 Our review disclosed 152 residential (16 of which were issued after our audit period) and 177 commercial permits (27 issued after our audit period) totaling $338 million ($43 million of which related to permits issued after our audit period) that were not coded as “new construction”, and DAT did not have adequate procedures to ensure that these permits were properly coded. Although there may be legitimate reasons why these permits were not coded as “new construction” (such as a demolition project), no such rationale was recorded in AAVS. It is incumbent upon DAT to ensure that such permits have been properly coded. Permits that are not coded as “new construction” are normally not considered for physical inspection. 1 For testing purposes, we chose dollar amounts of $175,000 and $300,000 to ensure that we examined permits with estimated values well above the $100,000 threshold stated in the law and in DAT’s requirement for coding improvement and new construction permits as “new construction”. 10 Project Costs Were Not Always Obtained and Recorded in AAVS Our review of the 24 local DAT offices disclosed that two offices did not obtain or record project costs in AAVS as required. As noted above, the project cost is used by the local assessor to help determine the project’s effect on the property value, which is used as the basis for whether a physical inspection is needed. These two local offices accounted for approximately 13 percent of the total statewide assessable tax base for the tax year beginning July 1, 2019. Our review disclosed that one office recorded costs for only 20 of the 4,660 permits processed since the inception of AAVS in 2011 through June 2019. The second office recorded costs for only 39 of the 22,569 permits it processed during the same period. One office advised that cost estimates were not submitted by the local jurisdiction and the other advised that the costs were provided, but were not recorded in AAVS. DAT management was not aware that these local offices were not recording permit costs until we brought it to DAT’s attention in July 2019, at which time we were advised that the two local offices had then begun receiving and recording permit costs in AAVS. Required Inspections were Not Always Performed DAT did not always conduct periodic inspections of construction projects that were ongoing for extended periods to determine if the project was substantially complete and in need of an assessment. State law requires the properties to be assessed (for new properties) or reassessed (for improvements) within six months of when the project is substantially complete, which, according to DAT, generally infers that the structure is under roof, and any inside walling, woodwork, electrical, and plumbing work is complete or very near to completion. We tested 30 permits coded as new construction issued between August 2017 and March 2018 from 8 jurisdictions, and found 7 permits for which no inspections had been performed as of July 2019. For example, prior to our inquiry in July 2019, DAT had not performed any inspections for one permit with a cost of $451,000 issued in October 2017. Based on our research, the construction associated with this permit had been substantially completed by August 2018. Based on State law, the property should have been reassessed and the tax base adjusted no later than January 1, 2019. Recommendation 1 We recommend that DAT a. establish adequate procedures, such as reviewing AAVS for permits with material costs, to identify and investigate questionable coding of permits filed; b. take steps to ensure that all critical permit information, including permit costs, is received and recorded in AAVS; and 11 c. ensure that physical inspections are performed as required for new construction and improvements. Finding 2 DAT did not use available output reports to ensure that all real property assessment appeals recorded in AAVS were subject to independent review and approval as required. Analysis DAT did not use available output reports to ensure that all real property assessment appeals recorded in AAVS were subject to independent review and approval as required. Property owners may appeal their property assessment to their local DAT office, after which an assessor will make a decision as to whether a change in the assessment is necessary. The results of the appeal, including any necessary change to the assessment, are recorded in AAVS. DAT policies require office supervisory personnel to review and approve the results of the appeal recorded in AAVS and document their approval of the assessor’s decision on the corresponding documentation (an on-line approval process for this type of transaction did not exist in AAVS). Our review disclosed that supervisors relied on the assessors to advise them when an appeal had been processed and completed in AAVS instead of using available output reports from AAVS as the basis for initiating their review. As a result, there was a lack of assurance that all appeals were subject to supervisory review and approval. During fiscal year 2018, approximately 31,000 accounts had an appeal recorded in AAVS. Our test of 10 appeals recorded in AAVS disclosed that they all agreed with supporting paper documentation, and that nine had been approved by supervisory personnel, as required by DAT policy. Recommendation 2 We recommend that DAT ensure that supervisory personnel use available output reports of appeals processed in AAVS to verify that all decisions made and recorded by local assessors are proper. Personal Property Assessments Background Annually, DAT certifies the value of business-owned personal property (such as furniture, certain equipment, and inventory) based on returns filed by specific 12 entities (such as corporations, limited liability companies, and partnerships) as prescribed by State law. These entities must file annual personal property returns with DAT by April 15 and must pay a filing fee of $300 ($100 under limited circumstances). During fiscal year 2019, according to its records, DAT collected $99.1 million in personal property filing fees. Personal property assessed values are certified by DAT and are provided to Maryland’s 24 local subdivisions. These jurisdictions (and municipal governments, when applicable) use the assessed values to calculate the taxes due and then issue personal property tax bills to the applicable entities. The personal property tax rates, effective as of July 1, 2019, in the 17 local jurisdictions that collect personal property taxes, ranged from 1.79 percent to 5.62 percent (7 jurisdictions have no personal property taxes). According to its records, as of September 4, 2019, DAT had processed 347,126 accounts related to the filing of personal property returns for the calendar year ended 2018, providing the local jurisdictions with a personal property assessable tax base of $12.9 billion. State law exempts certain entities from paying personal property taxes and/or annual filing fees, such as non-profit organizations. According to DAT’s records, as of April 2019, approximately 54,800 entities were exempt from paying personal property taxes and approximately 54,300 were exempt from paying filing fees. DAT uses its Maryland Business Entity System (MBES) to record and process personal property assessment returns, as well as exemptions granted. Finding 3 DAT did not ensure that all required personal property returns and filing fees were received, and that exemptions from filing a return and paying the fee were valid. In addition, DAT did not pursue penalties for the untimely submission of returns in a timely manner. Analysis DAT did not ensure that all required personal property returns and filing fees were received, and that exemptions from filing a return and paying the fee were valid. In addition, DAT did not submit delinquent personal property penalties to the State’s Central Collection Unit (CCU) on a timely basis. Penalties are assessed when personal property returns are filed late.  DAT did not use available information to identify entities that failed to register with DAT and file personal property returns. Specifically, DAT did not review Comptroller of Maryland records of entities receiving payments from the State and/or with active sales tax accounts to identify non-registered entities that were conducting business in the State. As of July 2019, no 13 matches between DAT and Comptroller records had been performed since calendar year 2014 and four jurisdictions had not been subject to any reviews since calendar year 2005. We were advised by DAT management that the individuals responsible for conducting the previous matches were no longer employed at DAT. A similar condition was commented upon in our preceding audit report.  DAT did not investigate all returns with significant fluctuations or variances. Our review of 17 returns that had been identified by DAT as high risk on output reports for filing years 2016, 2017, or 2018 due to certain fluctuations or variances, disclosed that a supervisory review had not been performed for 6 of the returns. For one return, DAT’s records indicated an assessable tax basis of $1,513,040 in 2015, $0 for 2016, and $183,490 in 2017; however, no supervisory review of this return was performed. Subsequent to our inquiry, DAT investigated these returns and updated the entity’s assessable tax basis to $242,660 for the 2016 filing year. The review of returns identified by DAT as high risk is critical since DAT does not otherwise perform a comprehensive supervisory review of returns filed.  DAT did not have a comprehensive process to ensure the propriety of exemptions from personal property assessments and filing fees granted to entities. Specifically, supervisory personnel conducted periodic reviews to ensure that entities with existing assessment exemptions were still eligible for those exemptions. However, entities to be reviewed were selected from a log of initial exemption applications rather than from system output reports of exemptions granted and currently in place. This log was manually maintained and posted by a DAT employee upon receipt of applications, but no periodic verification was performed to ensure that the log included all existing exemptions. Consequently, there was a lack of assurance that all exemptions currently in place were subject to review. In addition, DAT did not verify to supporting documentation, such as proof of non-profit status, the propriety of business codes assigned to each entity. These codes, such as the codes assigned to charitable organizations, dictate whether or not the entity is exempt from paying filing fees. Furthermore, DAT had not established sufficient online controls over its automated systems, which enabled an employee to exempt entities from filing fees. Specifically, our review disclosed that 46 DAT employees, including 16 with access to collections, had the capability to change business entity codes in MBES without independent review and approval. Similar conditions regarding insufficient online controls were commented upon in our preceding audit report. 14  As of August 2019, DAT has not referred entities with delinquent personal property penalties to CCU since June 2018. DAT management advised us that CCU stopped accepting delinquent debt referrals in June 2018 because it was implementing a new collection system, and that DAT was unaware that that CCU resumed accepting referrals in July 2018. According to DAT records, as of May 21, 2019, there were 2,354 accounts totaling $184,872 that had been delinquent for 3 to 172 months that had not been referred to CCU. Penalties are assessed when personal property returns are filed late and are generally a percentage of the county assessment plus interest (with the initial penalty ranging from $30 to $500). State regulations require three written demands for payment be made at 30-day intervals after which the account is to be sent to CCU. Similar conditions were commented upon in our preceding audit report. Recommendation 3 We recommend that DAT a. use available Comptroller of Maryland records to identify and pursue entities that have not registered and filed a personal property return (repeat); b. establish procedures, using system output reports, to ensure that higher risk returns are identified and reviewed for propriety by independent supervisory personnel; c. ensure that new and existing exemptions from personal property assessments and filing fees are periodically reviewed for propriety by independent supervisory personnel using system output reports of exemptions granted and newly incorporated entities, including assigned business codes (repeat); and d. refer accounts to CCU for collection assistance on a timely basis (repeat). Homeowners’ Tax Credit Background According to the State’s records, during fiscal year 2019, DAT approved 45,822 homeowners’ tax credits (HTC) totaling approximately $65.5 million. HTCs are awarded to homeowners with a combined household income up to $60,000, allowing a credit against the homeowner’s property tax bill when the property taxes exceed a fixed percentage of the household’s gross income. To receive the HTC, homeowners must submit an application, along with supporting documentation, to DAT by September 1 of the fiscal year for which the HTC is 15 being requested. For example, applications for the fiscal year 2019 property taxes were due by September 1, 2018. DAT headquarters staff process the HTC applications, determine the amount of each credit, and notify the local jurisdictions which issue the credits on the tax bills or as refunds, depending on when the application was received. State law requires the local jurisdictions to submit reimbursement requests for redeemed HTCs to DAT who is to certify to the Comptroller of Maryland that the requested reimbursement is due. Homeowners that receive an HTC and then transfer ownership of the property during the year of the award must return the HTC on a prorated basis. Finding 4 DAT did not perform timely audits of awarded HTCs or verify the propriety of redeemed HTCs and reimbursement requests from local jurisdictions. In addition, DAT did not ensure local jurisdictions recovered and remitted HTCs from homeowners that transferred their properties. Analysis DAT did not perform timely audits to help ensure the accuracy of awarded HTCs, did not verify the propriety of redeemed HTCs and reimbursement requests from local jurisdictions, and did not ensure local jurisdictions recovered HTCs from homeowners who transferred their properties and remitted the HTCs to DAT.  DAT did not complete audits of HTC applications to ensure they were processed correctly. It was DAT’s policy to conduct both random audits of HTC applications and focused audits of applications using reports of discrepancies and fluctuations in applicant reported income. Specifically, DAT generates reports that identify (a) discrepancies between income reported on the application and the applicant’s State income tax return and (b) significant fluctuations in applicant income from the previous year. As of June 2019, DAT had not performed any audits of randomly selected applications since 2009. In addition, DAT had not audited the applicants identified on the 2015, 2016, and 2017 income discrepancy reports (2018 was not yet available), and the 2014, 2017, and 2018 income fluctuation reports. These audits are critical because the awarded HTCs are not subject to independent review and approval at the time of their processing. We obtained the 2017 income discrepancy report and the 2017 and 2018 income fluctuation reports. We noted these reports identified 2,067 and 5,411 accounts, respectively, that should have been subject to focused audits, per DAT policy. 16  DAT did not verify the propriety of HTCs redeemed by homeowners. DAT relies on reports of homeowner-redeemed HTCs prepared by the local jurisdictions to ensure that only HTCs it had authorized were redeemed. Our review disclosed that nine jurisdictions with HTCs totaling $12 million during fiscal year 2018 did not submit some or all of the required monthly reports. Specifically, as of May 2019, three jurisdictions had not submitted any of the required reports since at least June 2012. Six other jurisdictions had not submitted the reports for periods ranging from 2 to 41 months. In addition, DAT management advised us that effective March 2019, DAT was no longer reviewing any reports due to resource limitations. As a result, there is a lack of assurance that HTCs redeemed by homeowners were proper.  DAT did not ensure that local jurisdictions submitted requests for reimbursement for redeemed HTCs to DAT as required by State law. Instead, local jurisdictions submitted reimbursement requests directly to the Comptroller for payment without DAT first certifying to the Comptroller that the requested reimbursement was due to the jurisdiction, as required by the law. Furthermore, DAT could not readily explain differences we identified between the amounts reimbursed to certain local jurisdictions and the amount of redeemed HTCs as reported by those jurisdictions. Our comparison of reimbursement requests submitted by the 24 local jurisdictions to the Comptroller for July 2018 and February 2019, which totaled approximately $19.1 million and $1.4 million, respectively, to available reports from those jurisdictions of redeemed HTCs disclosed certain significant differences. For example, the July 2018 reimbursement requests submitted by one jurisdiction exceeded redeemed HTCs by $3.5 million and, for five other jurisdictions, reimbursement requests exceeded redeemed HTCs by amounts ranging from $21,000 to $366,000. DAT could not readily provide explanations for the differences noted, which depending on the cause, could indicate a potential overpayment condition. During fiscal year 2019, reimbursements to local jurisdictions for HTCs totaled approximately $68.2 million.  DAT did not have procedures to ensure that local jurisdictions recovered and remitted to DAT HTCs when homeowners transferred their property during the year of the award. DAT receives property transfer data from local jurisdictions, which is used to identify and generate reports of HTCs that need to be recovered. Local jurisdictions are responsible for recovering the HTCs and forwarding them to DAT. DAT did not have a process to ensure the adequacy of the local jurisdictions’ collection efforts and completeness of the amounts submitted to DAT. Our review of the February 2019 DAT report that identified approximately $102,000 in HTCs to be recovered in 16 local jurisdictions disclosed that, as of July 2019, a total of only $29,000 was 17 reported as having been recovered by 7 jurisdictions and DAT could only document the receipt of $27,000. The failure to conduct timely audits of HTCs has been commented upon in our three preceding audit reports dating back to 2010, and the lack of verification of redeemed HTCs and local jurisdiction reimbursement requests was commented upon in our preceding audit report. Recommendation 4 We recommend that DAT a. perform timely audits of HTC applications (repeat); b. ensure local jurisdictions submit monthly reports of redeemed HTCs, review and investigate differences between redeemed HTCs and those authorized by DAT, and use the reports to certify to the Comptroller the propriety of reimbursement requests prior to payment as required (repeat); and c. use its reports of HTCs to be recovered to ensure that all such amounts are received from local jurisdictions. Finding 5 DAT did not ensure HTCs were properly calculated. As a result, HTCs awarded to thousands of homeowners in certain jurisdictions were improperly reduced by at least $4.4 million. Analysis DAT did not ensure HTCs were properly calculated. As a result, HTCs awarded to thousands of homeowners in certain jurisdictions were improperly reduced by at least $4.4 million in fiscal year 2019. Most HTCs are calculated automatically by DAT’s automated system based on applicant income data entered in the system by DAT employees. Certain HTCs are calculated manually by DAT employees when a homeowner does not receive an individual real property tax bill (such as in the case of a housing cooperative) or for new home purchases where the tax credit must be prorated for less than a year. The improper HTC calculations that we address in this finding were the result of DAT’s incorrect treatment of certain additional tax credits offered by certain local jurisdictions. Because each local jurisdiction may or may not provide its residents with other tax credits, which are in addition to the HTC provided for in State law and are paid for by the State, each jurisdiction could be impacted differently or not at all by this finding. 18 We received a referral to our fraud, waste, and abuse hotline, regarding HTCs that were improperly reduced for homeowners in one local jurisdiction (Montgomery County). As a result, we reviewed the procedures and controls and conducted testing of HTCs in this and nine other jurisdictions and noted the following conditions: Ineffective Controls Over HTC Calculations DAT did not establish effective controls over automated and manually processed HTC calculations.  DAT did not periodically review the programming of its automated system to verify that it was calculating HTCs in an accurate manner and in accordance with the law. As a result, DAT was not aware that it had incorrectly programmed the system and that HTCs for residents of at least one jurisdiction (Montgomery County) were not being calculated consistent with the law as further described below.  DAT did not segregate duties for manually calculating, processing, and approving HTCs and did not ensure the HTCs were properly documented and adequately supported. Specifically, our test of 21 manually processed HTCs from 8 jurisdictions disclosed that 5 HTCs totaling $11,282 were calculated and processed by the same DAT management employee who was also responsible for reviewing and approving manual calculations, and authorizing the disbursement forms submitted to process the related payments. DAT generated an output report of these transactions that was subject to a supervisory review. However, the review did not include supporting documentation for the calculations. We noted that two of these calculations were not performed properly, resulting in excess tax payments by the homeowners totaling $626. For 8 other HTCs totaling $18,500, DAT did not document its calculations of the HTC or obtain and retain the documentation necessary to support its calculations. As a result, we could not determine whether these HTCs were properly calculated. Automated and Manual Processing Errors in Calculating Certain HTCs DAT improperly calculated HTCs in at least two jurisdictions (Montgomery County and Baltimore City) resulting in thousands of homeowners paying excessive property tax amounts. DAT administers the State HTC and certain supplemental credits awarded to eligible homeowners by their local jurisdictions, such as Montgomery County’s supplemental tax credit for senior citizens 65 or older with limited incomes. 19  DAT’s automated system improperly deducted the income tax offset credit (ITOC) administered by Montgomery County from homeowners’ State and County real property tax liabilities, resulting in the HTCs awarded to homeowners in Montgomery County being improperly reduced.2 Specifically, individual homeowners under the age of 65 had their State and County HTCs improperly reduced by amounts up to a total of $692, and homeowners at least 65 years old had their HTCs reduced by amounts up to a total of $1,0383. Based on our analysis of HTC applications processed in DAT’s automated system for Montgomery County residents in fiscal year 2019, the improper reduction of homeowners’ tax Example of Impact of Incorrect DAT Calculation liabilities resulted in OLA DAT reduced HTCs awarded Calculation Calculation 1 Tax liability (TL) $ 3,274 $ 3,274 to 5,388 applicants 2 County ITOC N/A 692 totaling $4.4 million. We 3 TL Used for HTC (1-2) 3,274 2,582 4 Max Allowed Based on Income 1,610 1,610 determined that, based on 5 Calculated HTC (3-4) 1,664 972 the automated system’s 6 Homeowner Tax Liability (1-5)* $ 1,610 $ 2,302 Difference (OLA-SDAT) $ (692) programming for *Excludes other taxes and fees on the tax bill Montgomery County, DAT improperly calculated HTCs dating back to at least 2005 in the same manner. We could not readily determine the amount by which HTCs were improperly reduced for years prior to fiscal year 2019.  A similar condition was noted with HTCs manually processed by DAT employees. Specifically, our test of 22 manually calculated HTCs for homeowners that received property credits administered by Montgomery County and 3 other jurisdictions disclosed that DAT employees had improperly deducted these credits from the tax liabilities of 13 homeowners from 2 jurisdictions (Montgomery and Baltimore City). It appears that the manual calculations mirrored those programmed into the automated system for Montgomery County. Consequently, the HTCs awarded to these 13 homeowners were improperly reduced by $6,500. DAT received advice from its legal counsel on January 23, 2019 that confirmed our determination that DAT’s HTC methodology commented upon above was incorrect. 2 Since HTCs are calculated based on real property tax liabilities, the improper calculation resulted in too low of a liability, which resulted in a too low of a credit. 3 Montgomery County homeowners that were at least 65 years old were eligible to receive a supplemental tax credit equal to half of their State HTC amount. 20 Recommendation 5 We recommend that DAT a. establish procedures to periodically review the programming of its automated system to ensure that HTCs for all jurisdictions are being processed accurately and in accordance with the law; b. segregate duties over manually processed HTCs and ensure they are properly calculated, documented, and supported; c. comply with advice of legal counsel and discontinue the practice of deducting other tax credits from applicants’ total property tax liabilities, except as allowed by State law; and d. consult with legal counsel on how to proceed regarding any refunds resulting from the HTC miscalculations including the $4.4 million noted above. Payroll Finding 6 DAT awarded paid administrative leave to a senior management employee over a five-month period at a cost of $55,860 without any documentation. The administrative leave granted was also in excess of the 10-day limit on administrative leave allowed by State regulations. Analysis DAT awarded paid administrative leave to a senior management employee for five months at a cost of $55,860, without any documentation (for example, basis for the award or a formal legal agreement with the employee). The administrative leave granted was also in excess of the 10-day limit on administrative leave allowed by State regulations. The leave was awarded every pay period from May 2, 2019 thru the employee’s termination on September 24, 2019. We were advised by DAT management personnel that the decision was made by other senior DAT management without documented approval of legal counsel. The senior management employee would not provide us with an explanation claiming executive privilege and DAT could not provide us with any documentation to support this decision or of the approvals received from legal counsel. DAT management advised us that when administrative leave is granted to an employee, supporting documentation is normally included in the employee’s personnel file. Recommendation 6 We recommend that DAT a. ensure administrative leave is only awarded within the 10-day limit allowed by State regulations and adequately documented; and 21 b. in conjunction with legal counsel, determine the feasibility of recovering the aforementioned administrative leave that was improperly awarded. Cash Receipts Finding 7 DAT did not have adequate controls to ensure that collections were properly accounted for and deposited timely. Analysis Adequate controls were not established to ensure that collections were properly accounted for and deposited timely. According to DAT’s records, during fiscal year 2019, collections totaled $137.3 million including approximately $48.9 million in lockbox collections, $45.4 million received and processed at DAT headquarters, and $43.0 million received online via the DAT website.  DAT did not have an adequate process in place to verify that all lockbox collections were deposited into the State’s account. Specifically, DAT did not adequately reconcile month-end balances of lockbox activity as reflected in the State’s records to the corresponding totals reported by the bank. For the 12 months of fiscal year 2019, unexplained month-end differences between the two records totaled between $48,900 and $92,700. In addition, the reconciliations performed were not subject to an independent supervisory review. As a result, there is a lack of assurance that all lockbox funds were properly transferred to the State’s bank account.  Collections received at DAT headquarters were not always deposited timely. Our test of eight deposits totaling $18.6 million made between April 2018 and March 2019, disclosed that 4,571 checks totaling $18.4 million included in five of the deposits were deposited between four and five business days after receipt, with the majority of checks, totaling over $17 million, related to one deposit from April 2018. The Comptroller of Maryland’s Accounting Procedures Manual requires the establishment of sufficient internal controls over cash receipts, including independent verification of collections to deposit, and the depositing of cash receipts within one working day. 22 Recommendation 7 We recommend that DAT a. ensure that lockbox reconciliations are properly completed, that the reconciliations are reviewed and approved by supervisory personnel, and that the supervisory approval be documented; and b. ensure that all collections are deposited in a timely manner as required by the Comptroller’s Accounting Procedures Manual. Finding 8 DAT did not perform an independent supervisory review of corporate charter transactions to ensure that the proper fees were charged and collected. Our review disclosed that expedited processing fees for 3,277 documents were not collected. Analysis DAT did not perform an independent supervisory review of corporate charter transactions to ensure that the proper fees were charged and collected. DAT charges various fees for processing corporate charter transactions including an expedited transaction fee for processing documents in an expedited manner. DAT employees manually calculate the fees for each transaction and record the fees on the applicable DAT forms. These forms were used by the cashier to process the transactions in the cash register system and DAT’s work order system. According to DAT’s records, corporate charter transaction fees totaled $22.7 million during fiscal year 2019. We received a referral to our fraud, waste, and abuse hotline related to the collection of expedited processing fees. Based on this allegation, we reviewed DAT’s procedures and conducted testing of expedited fee collections and noted that DAT did not conduct independent supervisory reviews of corporate charter transactions to ensure that the proper fees (including expedited fees) were calculated, charged, and collected. As a result, DAT employees could fail to charge the proper fees or misappropriate the fees charged on transactions without detection. Our test of seven corporate charter transactions that received expedited services disclosed that DAT did not charge and collect expedited service fees totaling $250 for four of the transactions. There was no documentation to justify why the expedited fees were not collected for these transactions. To help determine the extent of this problem, we obtained reports from DAT’s work order system of corporate charter transactions completed in fiscal years 2017 through 2019. We analyzed this data and identified 3,277 documents (189 of which were processed 23 after our audit period) that DAT expedited without charging and collecting a fee for the expedited service. These set fees range from $20 to $425, depending on the type of document processed and if the customer requests same day or twohour service. Consequently, the minimum value of expedited fees not collected (based on the lowest fee of $20 per document) for the three-year period may be approximately $65,000, but is likely higher. Recommendation 8 We recommend that DAT a. establish procedures to require independent supervisory reviews of corporate charter transactions to ensure the proper fees (including expedited fees) were charged and collected, and b. investigate the aforementioned expedited fees that were not charged and take appropriate corrective action. Information Systems Security and Control Overview DAT’s Office of Information Technology (OIT) is responsible for the Department’s information technology (IT) support. Before and during our audit period, DAT converted to using various State of Maryland Department of Information Technology’s (DoIT) IT support services, including the following functions, as of July 2019:     Network and Information Technology Security Services (including firewall and intrusion detection prevention systems and malware protection) IT Service Desk Hardware Support Certain Software Support OIT is responsible for mainframe and server-based systems operations and maintenance, including monitoring of application and database security. DoIT operates a statewide network that connects DAT’s local offices and DAT headquarters. The statewide network provides DAT users’ access to various IT services including the Assessment and Administration Valuation System, Annapolis Data Center mainframe based applications (including the Maryland Business Entity System, and the Homeowner and Homestead Tax Credit Systems), network services, email services, and internet access. 24 Finding 9 DAT’s procedures for logging and monitoring critical database and mainframe security events were not sufficient. Analysis DAT’s procedures for logging and monitoring critical database and mainframe security events were not sufficient.  For a critical production database, numerous critical security and audit events (for example database create, change or delete events, and direct changes to critical tables) were not logged. For certain other security and audit events that were logged, DAT personnel advised us that these logs were reviewed; however, documentation did not exist to support such reviews. Accordingly, unauthorized changes to this database could have occurred resulting in inappropriate changes to production data without detection by management. A similar condition concerning insufficient logging processes was commented upon in our two preceding audit reports.  For several key mainframe systems, security reporting or monitoring procedures were not adequate. We determined that logging reports presenting changes to security rules governing critical mainframe transactions were not generated for subsequent review. Additionally, other significant logging activity reports were generated, but were not reviewed. These reports listed mainframe activity for modifications of significant data and programs files, and for additions, changes, and deletions of security software rules governing these same data and program files. Accordingly, DAT lacked assurance that modifications made to significant data and program files, and the changes made to security software rules governing file access and mainframe transactions, were proper. Similar conditions were commented upon in our preceding audit report. The State of Maryland Information Technology Security Manual requires that information systems must generate audit records for all security-relevant events, including all security and system administrator accesses and procedures must be developed to routinely (for example daily or weekly) review audit records for indications of unusual activities, suspicious activities or suspected violations, and report findings to appropriate officials for prompt resolution. Recommendation 9 We recommend that DAT a. log all critical database security and audit events, regularly generate reports of these logged events, review these reports on a timely basis, 25 document these reviews, and retain the documentation for future reference; (repeat) and b. generate reports of critical mainframe security events and transactions, perform reviews of these reports (including examination of supporting documentation), document these reviews, and retain the documentation for future reference (repeat). 26 Audit Scope, Objectives, and Methodology We have conducted a fiscal compliance audit of the State Department of Assessments and Taxation (DAT) for the period beginning November 12, 2015 and ending March 25, 2019. The audit was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. As prescribed by the State Government Article, Section 2-1221 of the Annotated Code of Maryland, the objectives of this audit were to examine DAT’s financial transactions, records, and internal control, and to evaluate its compliance with applicable State laws, rules, and regulations. In planning and conducting our audit, we focused on the major financial-related areas of operations based on assessments of significance and risk. The areas addressed by the audit included corporate fees and taxes, homeowners and homestead property tax credits, real property assessments, personal property assessments, information systems security and control, cash receipts, and payroll. Our audit also included various support services (such as purchasing, payroll, maintenance of accounting records and related fiscal functions) provided by DAT to the Property Tax Assessment Appeals Board, which is audited separately. Furthermore, we reviewed the calculation of Homeowners’ Tax Credits and the collection of expedited processing fees regarding a referral received on our fraud, waste, and abuse hotline. We also determined the status of the findings contained in our preceding audit report. Our assessment of internal controls was based on agency procedures and controls in place at the time of our fieldwork. Our tests of transactions and other auditing procedures were generally focused on the transactions occurring during our audit period of November 12, 2015 to March 25, 2019, but may include transactions before or after this period as we considered necessary to achieve our audit objectives. To accomplish our audit objectives, our audit procedures included inquiries of appropriate personnel, inspections of documents and records, observations of DAT’s operations, and tests of transactions. Generally, transactions were selected for testing based on auditor judgment, which primarily considers risk. Unless otherwise specifically indicated, neither statistical nor non-statistical audit sampling was used to select the transactions tested. Therefore, the results of the 27 tests cannot be used to project those results to the entire population from which the test items were selected. We also performed various data extracts of pertinent information from the State’s Financial Management Information System (such as revenue and expenditure data) and the State’s Central Payroll Bureau (payroll data). These extracts are performed as part of ongoing internal processes established by the Office of Legislative Audits and were subject to various tests to determine data reliability. We determined that the data extracted from these sources were sufficiently reliable for the purposes the data were used during this audit. We also extracted data from the Assessment and Administration Valuation System, the Maryland Business Entity System, the Homeowners’ Tax Credit System, and the Homestead Credit Application System for the purpose of testing certain area, such as real property assessments, corporate fees and taxes, and tax credits. We performed various tests of the relevant data and determined that the data were sufficiently reliable for the purposes the data were used during the audit. Finally, we performed other auditing procedures that we considered necessary to achieve our audit objectives. The reliability of data used in this report for background or informational purposes was not assessed. DAT’s management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records; effectiveness and efficiency of operations, including safeguarding of assets; and compliance with applicable laws, rules, and regulations are achieved. As provided in Government Auditing Standards, there are five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. Each of the five components, when significant to the audit objectives, and as applicable to DAT, were considered by us during the course of this audit. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. 28 This report includes findings relating to conditions that we consider to be significant deficiencies in the design or operation of internal control that could adversely affect DAT’s ability to maintain reliable financial records, operate effectively and efficiently, and/or comply with applicable laws, rules, and regulations. Our report also includes findings regarding significant instances of noncompliance with applicable laws, rules, or regulations. Other less significant findings were communicated to DAT that did not warrant inclusion in this report. The response from DAT to our findings and recommendations is included as an appendix to this report. As prescribed in the State Government Article, Section 21224 of the Annotated Code of Maryland, we will advise DAT regarding the results of our review of its response. 29 APPENDIX Larry Hogan, Governor ∙ Boyd K. Rutherford, Lt. Governor ∙ Michael L. Higgs, Jr., Director September 18, 2020 Mr. Gregory Hook, CPA Legislative Auditor Office of Legislative Audits 301 West Preston Street, Room 1202 Baltimore, MD 21201 Re: OLA Audit of the Maryland State Department of Assessments and Taxation Dear Mr. Hook: Enclosed, please find the State Department of Assessments and Taxation’s (SDAT) response to the legislative audit by your office conducted for the period beginning November 12, 2020 and ending March 25, 2019. Please contact me if any further information is needed. Very truly yours, Michael Higgs, Director cc: Corbett Webb, Associate Director Christina Trotta, Chief Financial Officer Rebecca Copperberg, Compliance Director Office of the Director 300 W. Preston St., Room 605, Baltimore, MD 21201 www.dat.maryland.gov 410-767-1184 (phone) 1-800-552-7724 (MD Relay) 410-333-5873 (fax) 1-888-246-5941 (toll free) State Department of Assessments and Taxation Agency Response Form Real Property Assessments Finding 1 DAT did not have adequate procedures to ensure all required physical property inspections were performed. We recommend that DAT a. establish adequate procedures, such as reviewing AAVS for permits with material costs, to identify and investigate questionable coding of permits filed; b. take steps to ensure that all critical permit information, including permit costs, is received and recorded in AAVS; and c. ensure that physical inspections are performed as required for new construction and improvements. Agency Response Analysis Please provide additional comments as deemed necessary. Recommendation 1a Agree Estimated Completion Date: Complete Please provide details of Real Property completes a physical inspection of a property when a corrective action or permit has both a material cost greater than or equal to $100,000 and a explain disagreement. county SDAT office determines that the assessed value will increase $100,000 or more. The permit is coded NCP, New Construction Permit, and that ensures that the property receives a New Construction Cycle Review, meaning that property will be inspected and reassessed. There are times when a permit has a material cost greater than or equal to $100,000, but the county SDAT office has determined that the assessed value will not increase by at least $100,000 and therefore does not need to be reassessed. To handle these instances, the Department will amend its procedures to ensure proper coding and documentation. A checkbox will be added to the permit screen of the AAVS system. When assessor staff check this box, it means that the material cost is greater than or equal to $100,000, the permit has been reviewed and been determined that the assessed value will not increase by at least $100,000, and the permit type selected is RAP, Reassessment Permit.. Comments must also be entered into the permit note section stating the reason that the permit has been coded RAP, i.e. the reason the property does not need to be reassessed. Page 1 of 20 State Department of Assessments and Taxation Agency Response Form To ensure this procedure is followed, an error check has been added to the weekly error report that looks for RAP permits with a material cost of $100,000 or more that does not have the checkbox marked. The error report is already part of a monthly schedule of items that the Area Supervisors are responsible for reviewing. In addition, the AAVS Supervisor will generate a random sample of RAP permits that have the checkbox marked. This sample will be distributed to the county offices twice a year (February and August) to verify that a note was entered into the system explaining the RAP coding despite the material cost. Procedure 019-110-012 has been amended. Recommendation 1b Agree Estimated Completion Date: Complete Please provide details of The two county offices mentioned in this finding are now entering all corrective action or critical permit information, including permit costs, into AAVS. The RA explain disagreement. Guidelines detail a random sample check for permits to ensure that all critical permit information is entered into AAVS. In addition, a new error report was created that lists all active permits where the material cost is zero. This report will be run quarterly and each county office will be required to review the results and enter a material cost into the system or add a note to the system stating why the material cost is empty, i.e. not listed on the permit. Agree Estimated Completion Date: Complete Please provide details of SDAT has a Structured Query Language (SQL) in AAVS that checks for corrective action or New Construction Permits that are missing a recheck action. This SQL explain disagreement. will be run by the county offices after each new construction cycle. The Area Supervisors will work with the county offices to ensure that the SQL is run and reviewed after full-year and half-year new construction pick up. Completed reports are kept at each county office and the Area Supervisors have the ability to run this report at any time to check the county’s progress. Each county office has a goal of no accounts listed on the report. This would mean that all permits have been checked in a timely manner. Recommendation 1c In addition, the county monthly progress report (AIMS 22) was revised effective December 1, 2019, to reflect the changes to Chapter 651, Laws of Maryland 2018, effective June 1, 2018. This bill was sponsored by SDAT and eliminated the requirement for SDAT to conduct an exterior inspection of all properties to determine the value, providing assessors with more bandwidth to perform physical inspections for construction and improvement. The revised AIMS 22 now concentrates on reassessment permits and sales. This change will help to ensure that Page 2 of 20 State Department of Assessments and Taxation Agency Response Form reassessment permits are reviewed in a timely manner and have a recheck action entered in AAVS if they are not yet complete. Finding 2 DAT did not use available output reports to ensure that all real property assessment appeals recorded in AAVS were subject to independent review and approval as required. We recommend that DAT ensure that supervisory personnel use available output reports of appeals processed in AAVS to verify that all decisions made and recorded by local assessors are proper. Agency Response Analysis Please provide additional comments as deemed necessary. Agree Estimated Completion Date: Complete Please provide details of The AAVS Supervisor will generate a random sample of 20 residential corrective action or appeals and 10 commercial appeals for each county on August 1st of explain disagreement. each year. This random sample will be distributed to each county office for review to ensure that the value on the final notice matches the value on the appeal paperwork that was approved by the assessor’s supervisor. Each county office will maintain the report and each Area Supervisor is responsible for reviewing and certifying this task was completed. Recommendation 2 In addition, Real Property will create a spreadsheet for the county offices to track and verify the following appeal elements: Proper Supervisor Signature Approval, Value on Appeal Paperwork, Value on Final Notice, and Current Value in AAVS. Finally, Real Property will adjust the RA Guidelines to detail these changes. Page 3 of 20 State Department of Assessments and Taxation Agency Response Form Personal Property Assessments Finding 3 DAT did not ensure that all required personal property returns and filing fees were received, and that exemptions from filing a return and paying the fee were valid. In addition, DAT did not pursue penalties for the untimely submission of returns in a timely manner. We recommend that DAT a. use available Comptroller of Maryland records to identify and pursue entities that have not registered and filed a personal property return (repeat); b. establish procedures, using system output reports, to ensure that higher risk returns are identified and reviewed for propriety by independent supervisory personnel; c. ensure that new and existing exemptions from personal property assessments and filing fees are periodically reviewed for propriety by independent supervisory personnel using system output reports of exemptions granted and newly incorporated entities, including assigned business codes (repeat); and d. refer accounts to CCU for collection assistance on a timely basis (repeat). Agency Response Analysis Please provide “[E]nsuring that all required personal property returns and filing fees additional comments as [are] received”, is an ideal but unattainable goal. The Department deemed necessary. has/will take actions as discussed below to ensure that more returns and filing fees are received. Recommendation 3a Agree February 2021 Please provide details of The Department modified its MOU with the Comptroller August 2018, corrective action or to state that the data they are to provide annually is, “for compliance explain disagreement. audits of annual business entity filings to identify possible business personal property tax fraud and evasion of annual report filing.” In addition, SDAT reached out to the Comptroller in July of 2019, requesting the SDAT Identification Number be made a required field on the Combined Registration Application. The Comptroller’s position is that not all businesses paying taxes need to be registered with SDAT, so this field cannot be required. Some businesses registering with SDAT also do not need to file with the Comptroller or obtain a FEIN. Because these agencies use either an SDAT ID #, CRA ID #, or FEIN, there is no easy or complete way to match SDAT and Comptroller records. Estimated Completion Date: Page 4 of 20 State Department of Assessments and Taxation Agency Response Form In 2018, SDAT added an optional FEIN field on its Annual Report form, and the Comptroller has an optional SDAT Identification Number on its CRA. Although the Department hopes to enhance this report in the future, annually and beginning February 2021, SDAT will: 1. send the Comptroller a list of all businesses that are in a forfeited status; 2. ask the Comptroller to respond with a list of those entities with corresponding SDAT ID numbers that have continued to make filings with the Comptroller; and 3. SDAT will send a communication to inform those businesses how to become compliant. 4. Recommendation 3b Agree Estimated Completion Date: October 2020 Please provide details of The Department performs audits on returns that have been identified as corrective action or high risk. The No Assessment Audit, 40% Increase/Decrease Audit, and explain disagreement. Skipped Assessment Audit are a few of the audits that are to be completed annually. The audits are currently worked in an online spreadsheet. Beginning October 2020, the Department will continue to work the above mentioned reports in an online spreadsheet; however, it will be required that all system-generated reports be kept and a reconciliation performed once the audit is complete, based on the system-generated reports. The Department will replace the Skipped Assessment audit, which is duplicative, with an annual Random 5% Audit. A systemgenerated report will pull a random selection of 5% of the returns processed, and independent personnel will review that year’s assessment and compare it with previous years’ assessment, data, and calculations, and verify that documentation and assessor comments have been entered. SDAT encourages and continues to see an increase in the number of returns filed on line. When a return is submitted through NIC, the system will instantly compare it to the previous year’s filing and when there is a 40% increase or decrease in original cost, it is moved into a queue for an assessor to review and explain the change. An annual 40% Increase/Decrease audit is also completed. The Department will be adjusting these parameters so that in both instances, the queue and report will list entities with a 20% decrease or $100,000 decrease in total cost. The Department feels as though it is a better use of audit resources, and certainly is preferable to county governments, to focus on those assessments that decrease significantly, than those that increase significantly. Page 5 of 20 State Department of Assessments and Taxation Agency Response Form In addition, after certification, the Audit team independently reviews the top 100 accounts in the state and top 50 accounts in each county. Beginning 2021, they will be initialing the accounts they have reviewed. Also, by 2021, all Personal Property Returns will be scanned as they are received, making it significantly easier to pull documents and perform audits. Recommendation 3c Agree Estimated Completion Date: October 2020 Please provide details of All exemption applications are currently logged and reviewed within 30 corrective action or days of receipt, and only a supervisor or member of the Audit team explain disagreement. processes these applications. Beginning October 2020, all exemption applications will be scanned into a content management system. In previous years, the exemption has not been removed when an entity is made inactive or forfeited. Beginning October 2020, OIT will remove the exemption on all inactive and forfeited entities and will remove the exemption when an entity becomes inactive or forfeited. Inactive or forfeited entities with exemptions that are reviving will need to resubmit a new exemption application to receive it. Entities are to report when any changes are made that may disqualify them from an exemption. A system-generated report of all active entities in good standing that are receiving a manufactured or charitable exemption will be reviewed every two years to ensure they still qualify. In addition, SDAT will initiate an annual Random 5% Review of all other entities receiving an exemption to ensure they qualify. Dependent on the type of business code assigned, certain types of businesses may not have to pay an annual filing fee. This code is determined at the time of formation by the Charter division, and is based on how the customer completes the form. The Department has no way of knowing whether the customer is creating the “right” type of entity for their business purposes. Charter will implement a 5% Random Audit of these formation filings to ensure that the staff are keying in the proper business code according to how the customer completes the form. Charter is working with OIT to create an “Inquiry Only” screen so that employees will have the ability to search and review entities but access to enter a business code is limited only to those who key in documents. The ability to change a business code once entered is already appropriately restricted. Page 6 of 20 State Department of Assessments and Taxation Agency Response Form Recommendation 3d Agree Estimated Completion Date: Complete Please provide details of CCU’s new electronic delivery system has been established and the corrective action or Department sent its first successful transmission, which included all explain disagreement. accounts to be referred since the last successful transmission under CCU’s old system. Beginning July 2020, all accounts to be referred will be transmitted by the 15th of every month. Page 7 of 20 State Department of Assessments and Taxation Agency Response Form Homeowners’ Tax Credit Finding 4 DAT did not perform timely audits of awarded HTCs or verify the propriety of redeemed HTCs and reimbursement requests from local jurisdictions. In addition, DAT did not ensure local jurisdictions recovered and remitted HTCs from homeowners that transferred their properties. We recommend that DAT a. perform timely audits of HTC applications (repeat); b. ensure local jurisdictions submit monthly reports of redeemed HTCs, review and investigate differences between redeemed HTCs and those authorized by DAT, and use the reports to certify to the Comptroller the propriety of reimbursement requests prior to payment as required (repeat); and c. use its reports of HTCs to be recovered to ensure that all such amounts are received from local jurisdictions. Agency Response Analysis Please provide additional comments as deemed necessary. Recommendation 4a Agree Estimated Completion Date: April 2021 Please provide details of In May 2019, the Department hired Tax Credits’ first Deputy Program corrective action or Manager, whose primary focus is to oversee the Tax Credit Audit team. explain disagreement. Six months later, three auditors and one support staff were added to the Tax Credits Audit team, doubling the size of that team. In August 2019, a Random 5% Front-End Audit was introduced where the audit team reviews 5% of all applications processed within onemonth of their being processed. The auditors initially began reviewing 2% of all applications processed within the prior month and will increase to 5% over the next year. Since implementation, there has been a significant decrease in the number of departmental errors made. Supervisors now provide retraining, which will make subsequent audits significantly easier. With additional staff and a weekly audit goal established, the Department expects to begin performing timely back-end audits by April 2021, and has set a benchmark date of December 1, 2020, for having Page 8 of 20 State Department of Assessments and Taxation Agency Response Form half of all outstanding HTC audits complete. This includes the 2015, 2016, and 2017 Income Discrepancy Audit (Income/Comptroller Audit) and the 2015/2016, 2016/2017, and 2017/2018 Fluctuation Audit (20% Audit). Notably, the Income Discrepancy Audit will always be delayed two years as the 2018 data is not available and the Internal Revenue Service data is a year behind and delivered once a year in October. Recommendation 4b Agree Estimated Completion Date: Complete Please provide details of Effective March 1, 2020, the reimbursement policy was changed so that corrective action or SDAT certifies the amount of reimbursement due each county, instead of explain disagreement. the counties reporting that information directly to the Comptroller. To receive reimbursements, each jurisdiction is required to submit three reports to SDAT on a monthly basis. 1. Verification of Recaptured Homeowners’ Tax Credits on Property Transfers by Collector of State Taxes (Form AT8-71) 2. Verification Report of Collector of State Taxes (HTC Form-103) 3. Electronic Redemption Report Previously, SDAT did not verify that each county submitted all three reports every month. Three counties had never submitted the electronic redemption report and six other counties were delinquent in sending theirs. Upon receipt of all three reports, Form AT8-71 is filed to be reviewed at a later date and matched against the recaptured payments; HTC Form103 is reviewed and matched to the Electronic Redemption Report for redeemed credits during the prior months; and the Electronic Redemption Report is reviewed and matched to the HTC Form-103. In addition, the Credit Exception Report, which is attached to the Redemption Report, is reviewed and confirmed against information processed in CICS confirming transfers, social security number voids, and credit corrections. Once the reviews are complete, the redemption reimbursement totals are recorded and the Spreadsheet Log and Invoice are completed and forwarded to SDAT’s Accounting Department. This department then submits them to the Annapolis General Accounting Dept. (GAD) for disbursement. Page 9 of 20 State Department of Assessments and Taxation Agency Response Form November 2020 Please provide details of The Transfer Audit Report is generated on a weekly basis and lists corrective action or property accounts with a new deed recorded. Tax Credits is working explain disagreement. with OIT to modify the Transfer Audit Report so only transfers with a change in ownership name appear. SDAT confirms the tax credits issued on these properties are recaptured by comparing them to the Verification of Recaptured Homeowners’ Tax Credits on Property Transfers by Collector of State Taxes (Form AT8-71). SDAT and the counties use the recordation date to determine the recapture amount. SDAT will reach out to the county finance or treasurer’s office with discrepancies. Recommendation 4c Agree Estimated Completion Date: Page 10 of 20 State Department of Assessments and Taxation Agency Response Form Finding 5 DAT did not ensure HTCs were properly calculated. As a result, HTCs awarded to thousands of homeowners in certain jurisdictions were improperly reduced by at least $4.4 million. We recommend that DAT a. establish procedures to periodically review the programming of its automated system to ensure that HTCs for all jurisdictions are being processed accurately and in accordance with the law; b. segregate duties over manually processed HTCs and ensure they are properly calculated, documented, and supported; c. comply with advice of legal counsel and discontinue the practice of deducting other tax credits from applicants’ total property tax liabilities, except as allowed by State law; and d. consult with legal counsel on how to proceed regarding any refunds resulting from the HTC miscalculations including the $4.4 million noted above. Agency Response Analysis Please provide SDAT disagrees with the sentiment of impropriety in the statement additional comments as “HTCs awarded to thousands of homeowners in certain jurisdictions deemed necessary. were improperly reduced by at least $4.4 million.” Before OLA began their audit, SDAT made a policy determination that increased the amount of tax credits received by certain jurisdictions in future years. Subsequent conversations with SDAT’s Assistant Attorney General confirmed that this is the appropriate course of action moving forward, but the Department does not feel as though prior year calculations were inaccurate as they were consistent with the Department’s practice at the time and implicitly upheld by PTAAB and Maryland Tax Court decisions. Auditor’s Comment: DAT’s statement that the PTAAB and the Maryland Tax Court “implicitly upheld” the specific calculation method we addressed in our report is not consistent with its position during our audit fieldwork or subsequent to the audit when we discussed the finding with DAT management. Furthermore, the statement is questionable since the specific calculation method we addressed was demonstrably improper, and our assessment that the calculation method was improper was consistent with advice DAT received from its legal counsel in January 2019 as noted in our report. Page 11 of 20 State Department of Assessments and Taxation Agency Response Form Recommendation 5a Agree Estimated Completion Date: October, 2020 Please provide details of Local jurisdictions are required by law to inform SDAT of changes made corrective action or to their programs. The Department verifies that the programming of its explain disagreement. automated system is accurate annually or whenever a change is made by a jurisdiction or OIT. The annual process begins the day after the jurisdiction’s cut-off date. The Program Manager is responsible for verifying that the tax rate and calculations are accurate. When a change is made to the system, OIT informs the Program Manager the day after it has been implemented; and the Program Manager manually verifies the program is making accurate calculations. Beginning October 2020, the Department will establish procedures to ensure each jurisdiction’s tax rate and calculations are verified annually or when a change has been made. A log will be created and an entry made whenever a calculation is verified. Tax Credits’ new system will be handling the calculations for each jurisdiction beginning 2021. The programming will be reviewed annually to ensure the homeowners’ tax credit is being calculated accurately and in accordance with the law. Recommendation 5b Agree September 2020 Please provide details of SDAT has enhanced its process of manually calculating, processing, and corrective action or approving homeowners’ tax credits by including additional personnel in explain disagreement. the initial calculations, implementing multiple checks throughout the process, and generating an output report for periodic review. Estimated Completion Date: The processing supervisors and other appointed persons are responsible for calculating all manually processed homeowners’ tax credit applications. Once the calculations are complete, the application and all required supporting documentation is given to the Office Secretary. The Office Secretary enters data from the application into an online spreadsheet and prepares a weekly transmittal. The Office Secretary gives the Program Manager the transmittal and applications along with all supporting documents and calculations. The Program Manager is responsible for ensuring all applicable supplemental tax credits are included in the calculation. Upon completion, the Program Manager will initial each document to indicate it has been reviewed and verified accurate. Page 12 of 20 State Department of Assessments and Taxation Agency Response Form The Program Manager gives everything to the Office Secretary who is responsible for ensuring all documentation is initialed before submitting the transmittal to Accounting. The Office Secretary will place a copy of the transmittal in a binder and keep the original with the documents that will be taken to be scanned. Upon return of the documents, the Office Secretary will verify the transmittal and all pages of the documents have been scanned. Finally, the Department will generate an output report that will be reviewed annually by the Deputy Program Manager or member of the audit team. Recommendation 5c Agree Estimated Completion Date: Complete Please provide details of Prior to OLA completing their audit, the Department agreed upon a corrective action or change in procedure on how it calculates the Homeowners’ Tax Credit, explain disagreement. to be implemented in 2020. Beginning with the 2020 application, property tax credit calculations will consider only the Homestead Credit as a deduction, and no other real property credits. OIT made the necessary program changes to the automated system. In early June, it was verified by the Program Manager that the only tax credit being deducted is the Homestead Tax Credit. This has also been relayed to those processing applications manually. Subsequent conversations with SDAT’s Assistant Attorney General confirmed that this is the appropriate course of action moving forward, but the Department does not feel as though prior year calculations were in accurate as they were consistent with the Department’s practice at the time and implicitly upheld by PTAAB and Maryland Tax Court decisions. Recommendation 5d Disagree Estimated Completion Date: Please provide details of As stated above, the Department does not feel as though prior corrective action or calculations were inappropriate and therefore doesn’t plan on issuing any explain disagreement. additional payments for prior-year tax credits. These payments are also not appropriately classified as “refunds”. After discussing this policy change with SDAT’s Assistant Attorney General, that office agreed that there was no legal authority that compels the Department to issue additional homeowners’ tax credit payments for prior years. Page 13 of 20 State Department of Assessments and Taxation Agency Response Form Payroll Finding 6 DAT awarded paid administrative leave to a senior management employee over a fivemonth period at a cost of $55,860 without any documentation. The administrative leave granted was also in excess of the 10-day limit on administrative leave allowed by State regulations. We recommend that DAT a. ensure administrative leave is only awarded within the 10-day limit allowed by State regulations and adequately documented; and b. in conjunction with legal counsel, determine the feasibility of recovering the aforementioned administrative leave that was improperly awarded. Agency Response Analysis Please provide Agency respectfully disagrees with Finding 6 as it acted appropriately in additional comments as handling a personnel matter, and avers that the facts alleged in this item deemed necessary. are outside of the scope of this audit, both in terms of timeframe and subject matter. However, the Human Resources Department has pledged to redouble its considerable efforts to ensure that all leave policies continue to be fully enforced and adhered to. Recommendation 6a Disagree Please provide details of See above. Estimated Completion Date: n/a Recommendation 6b Disagree Please provide details of See above. Estimated Completion Date: n/a corrective action or explain disagreement. corrective action or explain disagreement. Auditor’s Comment: Although indicating disagreement, DAT’s response does not dispute the facts presented in the finding. Personnel matters, including compliance with related State regulations, are within the scope of our audits. In fact, the evaluation of compliance with applicable State laws, rules and regulations is one of the primary objectives of our audits. In addition, significant events which come to our attention that occur after our stated audit period end date, but prior to report issuance, cannot be Page 14 of 20 State Department of Assessments and Taxation Agency Response Form ignored. The period covered by our audit, which can include transactions occurring subsequent to the audit period end date, is clearly enumerated in the Audit Scope, Objectives, and Methodology section of our report. Cash Receipts Finding 7 DAT did not have adequate controls to ensure that collections were properly accounted for and deposited timely. We recommend that DAT a. ensure that lockbox reconciliations are properly completed, that the reconciliations are reviewed and approved by supervisory personnel, and that the supervisory approval be documented; and b. ensure that all collections are deposited in a timely manner as required by the Comptroller’s Accounting Procedures Manual. Agency Response Analysis Please provide additional comments as deemed necessary. Recommendation 7a Agree Estimated Completion Date: Complete Please provide details of The Department hired a new Accounting Director in April 2019. In corrective action or completing a review of the reconciliation, it was observed that an explain disagreement. incorrect formula was being used. It has been corrected and supervisory personnel perform and document a monthly, independent review of the reconciliation. Recommendation 7b Agree Estimated Completion Date: Complete Please provide details of As indicated above, the Department hired a new Accounting Director in corrective action or April 2019. Efforts have been focused on making changes to processes explain disagreement. when deficiencies are found and working to ensure procedures and practices are in compliance with the Comptroller’s Manual and State Treasure’s policies. During this audit cycle (pre-COVID), Cash Receipts were verified and deposited on a daily basis and in accordance with Comptroller of Page 15 of 20 State Department of Assessments and Taxation Agency Response Form Maryland’s Accounting Procedures Manual. Cash from prior day transactions was counted and verified by Charter and Accounting staff each operating morning, then prepared and picked up for deposit via courier service the same day. Beginning March 16, 2020, cash is no longer a payment option, even post-COVID. Check collections are verified the next business day and deposited via desktop deposit, typically within one to two business days. While every effort is made to deposit checks within one business day, the Department is aware that check verification and deposit times may increase in the month of April as Business Personal Property Returns’ are due by April 15 and there is a significant influx of check payments. Due to COVID, payments received are work ordered daily but verified and deposited by Accounting twice a week, with plans to increase that to daily soon. Page 16 of 20 State Department of Assessments and Taxation Agency Response Form Finding 8 DAT did not perform an independent supervisory review of corporate charter transactions to ensure that the proper fees were charged and collected. Our review disclosed that expedited processing fees for 3,277 documents were not collected. We recommend that DAT a. establish procedures to require independent supervisory reviews of corporate charter transactions to ensure the proper fees (including expedited fees) were charged and collected, and b. investigate the aforementioned expedited fees that were not charged and take appropriate corrective action. Agency Response Analysis Please provide additional comments as deemed necessary. Recommendation 8a Agree Estimated Completion Date: October 2020 Please provide details of As discussed previously, the Department will implement a Random 5% corrective action or Audit of all non-electronic Charter transactions to ensure that data is explain disagreement. keyed in correctly and the proper fees are charged and collected. Beginning August 2020, the Program Managers and Deputy Program Managers for Charter Filing and Charter Legal, and the Associate Director will be the only SDAT employees with the authority to waive fees and only according to certain parameters. The Department will create a comment section in the Management Menu screen in MBES. This will allow management to enter a note indicating their approval and the reason the expedited fee was waived. OIT is currently looking into implementing this enhancement. Until the comment section is implemented, SDAT will create a log where management will document the date, payment option, work order number, entity name, SDAT ID (if available), reason the expedited fee was waived and any other pertinent data. A monthly report showing documents that were processed as expedited without paying the expedited fee will also be generated by the system, reviewed by a member of a soon-to-be-created Charter Filing Audit team, and signed off on individually. Page 17 of 20 State Department of Assessments and Taxation Agency Response Form The Department plans on utilizing the following reasons for waiving fees: 1. Departmental Error a. mailed in document and/or check was clearly misplaced or lost; b. document was rejected in error and returned to the customer for a correction that is not required; c. incorrect guidance that resulted in the document being rejected or the filing being delayed; or d. incorrect information keyed in. 2. In-person Filing a. customer wait-time was longer than anticipated as determined by SDAT procedures to receive in-person service. Any fee waivers not falling into these categories must be approved by the Associate Director, who will be required to include a comment justifying the waiver. Reference waivers will be done only as allowed by state law and regulations. Recommendation 8b Agree Estimated Completion Date: Complete Please provide details of The Department has reviewed the documentation provided but generally corrective action or does not plan on taking corrective action. As mentioned above, there are explain disagreement. some instances when fees are waived appropriately, which will be documented moving forward. Less than 1% of all charter filings had fees waived. Additionally, there are a number of reasons from the past why fees may appear as waived on OIT reports, when they were actually not. Until September 2018, it was the Department’s practice not to work order trade names until they were processed, giving the appearance that they were inappropriately expedited when they were not. Pre-COVID, the Department allowed customers access to pull microfilm documents themselves for SDAT to certify, in which instance an expedited fee is not charged (all of these images will be digitized by the end of 2020). The Department’s procedures moving forward will ensure that fees are waived appropriately. The Department did identify five employees who filed documents with the Department for businesses they own. Management completed its investigation and found one instance where the expedited fee was potentially inappropriately waived and the employee voluntarily paid the fee retroactively. Counseling memos were issued to all employees. Page 18 of 20 State Department of Assessments and Taxation Agency Response Form Beginning September 2020, all Taxpayer Services personnel with either a business or tax credit interest will be required to proactively report that information to the Compliance Director, and policy will be revised to clearly state that employees are not to process any transactions in which they have an interest. Page 19 of 20 State Department of Assessments and Taxation Agency Response Form Information Systems Security and Control Finding 9 DAT’s procedures for logging and monitoring critical database and mainframe security events were not sufficient. We recommend that DAT a. log all critical database security and audit events, regularly generate reports of these logged events, review these reports on a timely basis, document these reviews, and retain the documentation for future reference; (repeat) and b. generate reports of critical mainframe security events and transactions, perform reviews of these reports (including examination of supporting documentation), document these reviews, and retain the documentation for future reference (repeat). Agency Response Analysis Please provide additional comments as deemed necessary. Recommendation 9a Agree Estimated Completion Date: Complete Please provide details of Beginning January 30, 2020, SDAT implemented a daily review corrective action or schedule for all Security Reports. Questionable or unusual items are explain disagreement. marked and investigated. All reviews and investigation results are documented and retained for future reference. Recommendation 9b Agree Estimated Completion Date: Complete Please provide details of Beginning January 30, 2020, SDAT implemented a monthly report corrective action or exports from critical database systems which gets reviewed. explain disagreement. Questionable or unusual items are marked and investigated. All reviews and investigation results are documented and retained for future reference. Page 20 of 20 AUDIT TEAM Adam J. Westover, CPA Audit Manager Richard L. Carter, CISA R. Brendan Coffey, CPA, CISA Information Systems Audit Managers Menachem Katz, CPA Nathan H. Suffin, CPA Senior Auditors Edward O. Kendall, CISA Edwin L. Paul, CPA, CISA Information Systems Senior Auditors Thea A. Chimento Albert E. Davison Matthew P. Henry Staff Auditors Dominick R. Abril Malcolm J. Woodard Information Systems Staff Auditors