Audit of the City’s Vendor Master File Maintenance and 1099...Regular interaction and maintenance...
Transcript of Audit of the City’s Vendor Master File Maintenance and 1099...Regular interaction and maintenance...
Internal Audit City Manager’s Office A18-FIN-VMF05
Audit of the City’s Vendor Master File Maintenance and 1099
Processes
Office of the City Manager
Internal Audit City Manager’s Office A18-FIN-VMF05
DATE: October 29, 2018 TO: Steve Mermell, City Manager FROM: Ruthe Holden and Rebecca Takahashi, Internal Audit Division SUBJECT: Audit of the City’s Vendor Master File and 1099 Processes As part of our FY 2018 Audit Plan, Internal Audit conducted an audit of the City’s compliance to City policies related to the accuracy and completeness of the City’s vendor master file and 1099 processes. Based on our audit, we identified seven issues related to these processes that need to be addressed of which four are considered high priority and three are medium priority. There are 15 recommendations associated with these seven findings which when implemented should strengthen the internal controls. One issue was corrected during the course of the audit. A description of our prioritization is located on page 22. We would like to thank the Finance, Information Technology, Humans Resources, and the various departments we engaged for their cooperation and providing key data needed for this review. cc: Julie Gutierrez, Assistant City Manager Nicholas Rodriguez, Assistant City Manager
Jennifer Curtis, Director, Human Resources Matthew Hawkesworth, Director, Finance
Phillip LeClair, Director, Information Technology William Huang, Director, Housing and Career Services
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 1 A18-FIN-VMF05
INTERNAL AUDIT OCTOBER 29, 2018
VENDOR MASTER FILE & 1099 PROCESS
AUDIT REPORT HIGHLIGHTS
1. Why We Did This Audit
The 2014 KPMG and the 2015 Citizen Task
Force reports were prepared as a result of the
alleged misappropriation of City of Pasadena
(City) funds, and both recommended that the
VMF be audited on a periodic basis.
The VMF is an important internal control to
ensure that the purchasing and payment of
goods and services is appropriate and that
only legitimate City vendors are paid.
The VMF is a database that contains a
considerable amount of data on vendors doing
business with the City. As such, it is important
that best practices are employed when
adding, maintaining and deactivating vendors.
The Internal Revenue Service (IRS) requires
that certain vendors be issued a form 1099 at
year-end summarizing the revenue received
from the City. The City may incur significant
penalties if the 1099s are not issued timely or
if not all required vendors receive a 1099.
The purpose of this audit is to evaluate the
accuracy and completeness of the VMF
database and of the vendors that should
receive an IRS Form 1099.
2. What We Found
There has been significant improvement in
the maintenance of the vendor master file
(VMF) and the process of issuing an IRS
Form 1099 to vendors since KPMG and the
Task Force on Financial Administration and
Internal Controls issued their reports.
Based on our audit, there are four high-risk
issues and three medium risk issues that
should be addressed to further strengthen
the internal controls over the vendor master
file database.
The high-risk issues identified are:
Inadequate Segregation of Duties
Strengthen Access to VMF
Collect potential conflict of interest data
Strengthen review of nonprofits/ charities
3. What We Recommend
The 18 recommendations detailed in the report include
updating current processes & forms,
limiting or eliminating current access to the VMF database,
updating City outside employment related forms and policy, and
updating vendor information in VMF.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 2 A18-FIN-VMF05
Background
Why We Are Doing This Audit
In 2014, KPMG issued a report based on its review of suspected misappropriation and misuse of
City funds concerning the City’s Underground Utility Program. The report contained several
comments related to improving the City’s internal controls over the vendor master file (VMF),
including a recommendation for periodic audits of the VMF.
In 2015, the Task Force on Financial Administration and Internal Controls issued a report after
reviewing and assessing the City’s financial statements, administration and controls. The Task
Force made recommendations for change to prevent future misappropriations of funds and
improve the integrity and usability of City financial statements and information. The Task Force
made several recommendations, including increasing the control over the master list of vendors
and contractors and verifying the legitimacy of vendors in the VMF database.
The City’s List of Payees are Maintained in the Vendor Master File within Munis
The vendor master file (VMF) is a database composed of vital business information for
individuals or businesses that provide goods and services to the City of Pasadena. Important
vendor information found in the VMF include data such as a vendor’s business name, physical
and mailing addresses, W-9 form containing a tax identification number (TIN)1, and other
needed documentation. The VMF also tracks vendors that are required to be provided an
Internal Revenue Service (IRS) Form 1099 based on the specific payment type, amount, and
business. This information is stored and maintained in Munis, including images of hardcopy
documents provided by a vendor or department.
The IRS can issue a penalty of $50 to $260 for each form that is not issued timely, with a
maximum penalty of $3,218,500 per year. The penalty for form 1099s that have intentionally
been disregarded and not issued is $530 per form, with no maximum penalty. It is important
that the information contained in the VMF is accurate and complete as it relates to 1099
information to minimize the risk of incurring IRS penalties.
The City’s Purchasing and Accounts Payable processes depend on a properly managed and
functioning VMF. Regular interaction and maintenance of the vendor data within the VMF is the
primary responsibility of the Purchasing division within the Finance department. The Purchasing
Administrator is the person responsible for monitoring compliance to the VMF policy. However,
staff and management citywide are responsible for gathering and updating vendor information
for their procurements. It is critical that VMF policies and procedures prevent unauthorized or
inappropriate activity, duplicate payments, or inefficiencies.
1 A TIN is assigned either by the Social Security Administration (social security number) or by the Internal Revenue Service (Federal Employer Identification Number).
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 3 A18-FIN-VMF05
Vendor Status Classification
As of February 15, 2018, there are 10,605 vendor entries in the VMF. Table1 shows the count of
vendors by status. In the VMF within Munis, a vendor is coded as active, inactive, stop/do not
use or other status type.
Table 1: Vendor Master File Status by Count
Status Count Description of Status
A (Active) 8474 Vendors actively doing business with the City in the last 2 years. Allows for a requisition or contract to be assigned to them, and payment to be processed by Accounts Payable.
I (Inactive) 903
Vendors that are not currently doing business with the City. This status allows a requisition or contract to be assigned to them, but does not allow for AP to process a payment. In order to be paid, an inactive vendor would need to be reactivated.
Stop 1216 Vendors that are no longer doing business with the City and are not able to assigned a requisition within the financial system or receive payment.
Other status type
12 Identified as another status type (One time and B)2
Source: Analysis of Vendor Master File export provided by the Finance Department as of 2/15/2018
In addition to vendors that provide contracted goods and services, the VMF also contains
vendor records related to employee reimbursements, refunds and rebates for utility customers,
permit refunds related to construction and development projects, course registrations,
transportation citation or permit refunds, liabilities/claims payees, and other one-time
payments. Additionally, landlords/property managers participating in the City’s Section 8
housing program receiving monthly housing assistance payments are vendors in the VMF
database.
Process for Adding New Vendors to the Vendor Master File (VMF)
To setup a new vendor in the VMF, designated employees within each department collect the
required information from the vendors and forward to vendor set up for processing.
Department staff are expected to conduct a search for the vendor in Munis, the City’s financial
systems software for the VMF to avoid adding a duplicate vendor. To request a new vendor be
added to the VMF, the designated employee(s) must submit required documentation including
a completed vendor questionnaire form, signed and dated W-9 form with a physical address, a
Pasadena business license (if applicable) at the time of the award, and a remittance address. If
the vendor lists a PO Box as a primary address, then the vendor is required to provide a physical
street address via the vendor questionnaire or a signed/dated letter on their letterhead. A high
2 “O” vendor status type is used for one-time vendors, such as refund or rebates to customers. “B” status is for bidder not currently being used, according to Finance staff because it is linked to a Munis module that has not been purchased by the City. There is one vendor that has been coded with a “B” status.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 4 A18-FIN-VMF05
level overview of the process whereby the City adds new vendors to the VMF is provided below
in Figure 2.
Source: Analysis of Vendor Master File Policies and Procedures
IRS 1099 Process
As part of the vendor information entry process, through the W-9 review, Purchasing staff
determine if a vendor is required to file a Form 1099-MISC with the IRS. A Form 1099-MISC is
required for each person and/or entity the City has paid at least $10 in royalties, broker
payments, or tax-exempt interest and at least $600 in rents, services performed by a non-
employee, prizes, and other specific business activities. Payments that do not have to be
reported on Form 1099-MISC, include payments to a corporation (except doctors and lawyers),
wages paid to employees, payments to tax-exempt organization, and other business activities.
The City is responsible for establishing 1099 reporting and backup withholding compliance
standards for 1099 eligible payments. Figure 3 below provides the general overview of the
process the City uses to issue a master 1099 report to the IRS annually.
Figure 2 - Steps to Add a New Vendor to the Vendor Master
File
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 5 A18-FIN-VMF05
Source: Analysis of 1099 Reporting Policies and Procedures
In addition to regular vendors, the City of Pasadena also files 1099s for vendors paid for
worker’s compensation-related services. The City uses a third-party administrator (TPA) to
process worker’s compensation medical services, including the payment of service providers.
The TPA pays the providers, and then requests reimbursement from the City on a monthly
basis. The City then pays the TPA for the expenses incurred through a trust fund account. The
TPA is required to verify that the service providers are legitimate and collect evidence of their
existence as a service provider, including the collection of TINs and other identifying
information needed to provide 1099’s to these providers.
Figure 3 - Steps to Issue a Master 1099 Report to the IRS
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 6 A18-FIN-VMF05
Objectives
The objectives of this audit were to review the accuracy and completeness of:
vendor information in the VMF database used to review and approve payments; and
vendors classified as required to receive IRS 1099 reports from the City of Pasadena.
Scope
The scope of our review were payments made to vendors from July 1, 2016 through December 31, 2017. In order to determine trends or systemic issues, we also reviewed prior payments or documents relevant to transactions that occurred in the scope period.
Methodology
In order to test our objectives, our review included the following procedures:
Reviewed relevant Federal, State, and local laws and regulations concerning vendors
Reviewed relevant Citywide and Departmental policies and procedures related to adding and updating vendors to the VMF database
Reviewed available documentation and transaction history in Munis
Reviewed best practices related to VMF management and maintenance
Interviewed staff and management from Finance, DoIT, and relevant City Departments
Compiled and analyzed Accounts Payable and VMF data from Munis
Using an outside contractor, ran comprehensive data mining inquiries to extract vendor data for duplicates, addresses with PO Boxes, and matches to employee/beneficiary names and addresses3
Using IDEA4, compiled and summarized transaction data for statistical sampling and trend analysis
Requested and analyzed a list of the top paid vendors during the scope
Reviewed select department files for samples of vendor documentation from Housing, Water and Power, Planning, Public Works, Transportation, and Finance for validation
Considered and assessed the adequacy of internal controls governing citywide and
departmental procedures for paying vendors
This project is an audit and was conducted in accordance with the Standards of the Institute of Internal Auditors (Standards). These Standards encompass such matters as the independence of City of Pasadena Internal Audit Division, objectivity, proficiency of staff, due professional care, the scope and performance of work activities, and the management of the internal auditing function. Our work included examining, on a test basis, evidence supporting transactions in the operating records and applying other procedures we considered necessary under the circumstances. It also included assessing the judgments and decisions made by management.
3 The contractor was provided with the VMF as of 02/15/2018. Subsequent analysis of the results occurred after this date, where updates to the vendor’s status may have occurred as part of ongoing VMF maintenance by the Purchasing division. 4 IDEA software is a data analysis tool used by the City to analyze data.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 7 A18-FIN-VMF05
We believe that our work provides a reasonable basis for our issues, conclusions, and recommendations.
Overall Results
Significant improvements have occurred in the last 3 years to enhance processes and internal controls to verify the accuracy and completeness of vendor information in the City’s vendor database and in the accuracy of vendors classified as 1099 reportable vendors.
However, during the course of our audit, we identified seven issues with corresponding recommendations that will strengthen internal controls and improve processes related to Vendor Master File maintenance and issuance of IRS Form 1099s. There are four issues categorized as high risk and three issues categorized as medium risk5.
The high-risk issues identified during the audit are:
1. Inadequate segregation of duties when processing refunds or rebates 2. Strengthening access to VMF database 3. Potential conflict of interest data for procurements not collected 4. Nonprofit and charitable organizations not adequately reviewed
The medium risk issues identified during the audit are:
5. Potential duplicate vendors identified in VMF database 6. Updated W-9s needed for vendors receiving Housing Assistance Payments 7. Accuracy of 1099 related information
A detailed description of the 7 issues and 18 associated recommendations are discussed in detail on the following pages. The issues are listed in this report in the order of the risk associated with the issue.
5 The risk ranking criteria used to rank the issues identified during this audit is included in Attachment A on page 28 of the report.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 8 A18-FIN-VMF05
Issues
Issue 1: Inadequate Segregation of Duties in Processing Refunds and Rebates
Issue Risk: High
Refunds and rebates were included in the scope of this audit because they are set up as one-
time vendors in the VMF database. One-time vendors is a known area of risk and so the
processes that used this function were reviewed.
Refunds and rebates from various departments are routinely compiled and submitted to
Accounts Payable by the same staff person in a department without review by the signature
authority, creating a segregation of duties issue that could lead to fraud or misuse.
Per the Committee on Sponsoring Organization’s Internal Control Framework (COSO), control
activities are the actions established through policies and procedures that help ensure that
management’s directives to mitigate risks to the achievement of objectives are carried out.
Control activities may be preventive or detective in nature and include a range of manual and
automated activities such as approvals, verifications, reconciliations, and business performance
reviews. Segregation of duties are usually built into development of control activities; however,
where segregation of duties is not possible, management must implement alternative control
procedures to compensate.
Individual Invoice Payment Process
In the current financial system, individual invoices and payment requests are processed through
a workflow approval sequence, where the request for payment is approved by an individual
that has the designated signature authority to do so after ensuring that the good or service was
received by another individual in accordance with terms and conditions. Once the needed
approvals are received, the payment is sent to Accounts Payable to pay the vendor. The
documentation supporting the individual invoice payment is accessed through the Accounts
Payable module.
Refund and Rebate Payment Process
However, in the case of refunds and rebates, there is no electronic payment workflow, these
payments are compiled for approval in excel documents and submitted and processed in Munis
using bulk batch requests. One issue identified when observing this process to pay bulk
requests for refunds, rebates, or other large batches of payments is that the financial system
Munis does not allow for large batches to be processed through a workflow. Instead, staff has
to compile refunds and rebates as a request for check for multiple payees, with the needed
information standardized on an excel file to be uploaded into Munis for Accounts Payable
processing. A request for check form is submitted with signatures, and supporting
documentation is loaded into Munis, but is accessed through the Journal attachments.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 9 A18-FIN-VMF05
We interviewed several City departments that utilize these types of requests, to learn about
their process to validate and verify refunds or rebates due. We found that in general, there is a
segregation of duties risk in their respective processes as the same person who prepares the
batch requests, also gathers the needed wet signature from an authorized individual, and
submits the final request and supporting documentation to Finance. Finance relies on the
manual request for check form signatures to process the request. Finance also communicates
and sends information about the payments to the same person submitting the request. In this
process, it is possible for someone to potentially manipulate payee information or add fictitious
vendors after obtaining the needed signatures. Without separating the duties required to make
these types of batch payments, there is a risk payments may be made to fictitious or otherwise
inappropriate vendors.
Recommendation 1: The Director of Finance or his designee should:
Direct each submitting department to have the authorized approver submit these batch
processed rebates/refunds directly to Accounts Payable with a copy to the Accounts Payable
Supervisor for processing with supporting documentation including item count and dollar
totals. The Accounts Payable Supervisor will verify that the control total and item counts match
to the actual disbursement.
Management Response:
The Finance Director agrees with this recommendation and has implemented an immediate
corrective action and is working with DoIT to implement an automated workflow to streamline
refunds and rebates as a long term solution. The Finance Director’s response to the audit is
included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 10 A18-FIN-VMF05
Issue 2: Access to VMF Database Needs Strengthening
Issue Risk: High
Certain DoIT and Finance staff have access to the VMF and other areas of the Accounts Payable
module within Munis that they may not need.
One key control activity to maintain the integrity of a VMF database is adequate segregation of
duties for both manual and automated processes. Industry best practices recommend having
the Controller responsible for approving system access to add/modify vendors in the VMF.
Additionally, Human Resources is responsible for notifying the Department of Information
Technology (DoIT) of terminated or transferred users. All changes to system access must be
made in writing and submitted to DoIT.
At present, department representatives submit a DoIT generated form for a new employee to
receive access to Munis, specifying which modules and functions that the employee will need
to have access. These requests are then sent to DoIT’s Enterprise Resource Planning (ERP) team
to review and approve. In our review of system user access by role and user, we found two
Finance users have been assigned roles with conflicting duties. The Purchasing Administrator in
Finance was granted system administrator access to allow completion of needed year-end
reporting, but this access was not disabled or monitored. The Fiscal Services Administrator had
the ability to review and approve payments, and was also granted access to the senior buyer
role, which allowed access to edit the vendor6. These represent a segregation of duties issue in
the accounts payable process, as the same users had the ability to edit vendor data and process
payments in the Financial System.
In addition, the ERP team has Test Users in the Production database to allow for easier set up of
the test environment when testing is needed on version upgrades. These Test User roles are
accessible to the ERP team, and because of the roles assigned to them, have the potential to be
misused by an employee with access to them in the production environment to set up fictitious
vendors and/or process payments. The Test User roles were not being monitored in the
production environment.
We also found that there is no periodic review of Munis user access to validate that the
requested access is valid and appropriate, other than the initial department request. There is
no systematic access review when an employee separates from the City, transfers to another
department or is promoted/reassigned within the same department to ensure they do not have
conflicting duties with their current and former roles. Additionally, Munis does not
automatically detect if a user is assigned potentially conflicting duties/roles in a module.
Without automated or manual processes to control access rights, employees may be granted
6 This employee is no longer employed by the City at the time of the review and this user’s access was terminated in the system after their separation.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 11 A18-FIN-VMF05
rights to access vendor data that would allow them to produce a false payment or other form of
vendor-related fraud.
As of March 2018, the City Controller and DoIT have agreed to develop a process to monitor
individual’s access rights for Munis financial modules based on the Controller’s determination
of signature authority, and DoIT will review access rights with department business owners for
all other modules on a periodic basis.
A summary of the conflicting access roles, data privileges, and staff assignments are
summarized in the tables 2 and 3 below.
Table 2: Munis Permissions and Segregation of Duties Conflicts Based on Role
ROLE
Accounts
Payable
Staff
Accounts
Payable
Supervisor
Buyer SR
Buyer
MUNIS Private
Role (System
Administrator)
ROLE PERMISSIONS
Add vendors on-the-fly X X X
Allow vendor name
maintenance X X X
Maintain vendors X X X X
View/maintain vendor
banking information X X
ROLE DATA ACCESS
Allow vendor address
maintenance
NONE NONE FULL FULL FULL
Vendor maintenance access
by type
NONE NONE FULL FULL FULL
Source: Auditor analysis of users and their assigned role permissions from Munis User Administration Reports
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 12 A18-FIN-VMF05
Table 3: Staff Assigned to Roles and Conflicts with Assignments
Department Staff Roles
Finance
Accounts
Payable
Staff
Accounts
Payable
Supervisor
Buyer Senior
Buyer
System
Administrator
Fiscal Services
Administrator X X
X
DoIT (4) X
Purchasing Administrator X X
Test User 1 X X X
Test User 2 and 3 X
Source: Auditor analysis of users and their assigned role permissions from Munis User Administration Reports.
Recommendation 2-1: In addition to the process developed by Finance and DoIT for reviewing
and granting access rights, the Director of Finance or his designee should also:
a) Require specific procedures to request written Finance Director approval for system
administrator roles and/ or otherwise conflicting roles. Additionally, employees granted
System Administrator rights should be monitored on a periodic basis to ensure their
access is still appropriate.
b) Develop procedures to remove granted access rights due to employee separation or
transfer.
Management Response:
The Finance Director agrees to work with DoIT to periodically review existing user access rights
and develop procedures for authorizing system administrator or otherwise conflicting roles.
The Finance department is working with DoIT to develop a procedure for removing access
rights due to employee separation or transfer. The Finance Director’s response to the audit is
included in Attachment B.
The Information Technology Director agrees that the implementation of the recommendations
will strengthen the internal controls associated with these functions and processes. In addition,
the test users in the production database have been deactivated. The Department of
Information Technology’s response to the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 13 A18-FIN-VMF05
Recommendation 2-2: The Director of Human Resources or her designee should:
a) As part of the personnel action process, develop a procedure to require departments to
indicate the citywide and department specific applications the separating employee has
access to, noting if this access should be deactivated or modified based on business
needs. This information should be provided to DoIT or department system administrator
to make the needed access changes.
Management Response:
The Human Resources Director agrees to provide a more formal mechanism to modify system
access for employees who promote or transfer as part of the personnel action approval
process. The Human Resources Director’s response to the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 14 A18-FIN-VMF05
Issue 3: Potential Conflict of Interest Information Not Collected
Issue Risk: High
The City is not effectively collecting vendor information that may require special oversight or
disclosure to prevent or detect conflicts of interest, or require special reporting to the IRS.
The City’s Manual of Personnel and Administrative Rules section on conflicts of interest strictly
prohibits any outside employment or other activities or relationships that create any actual,
potential or apparent conflict of interest. As a general rule, no employee shall engage in any
transactions or have any personal or financial interest, direct or indirect (as defined in the City’s
Conflict of Interest Code) which would lead an objective, reasonable person to believe that
independence of judgment or action in the performance of official duties would be impaired.
Based on these considerations, employees may not own or actively participate or engage in any
outside business activities or employment relationship without obtaining the prior, written
authorization of the employee’s department director and the Human Resources Department
for a specific outside relationship.
In our review of the VMF database, we performed name and address matching of employee
name and addresses. 21 vendors in the VMF database have addresses associated with current
or former employees that were paid for providing non-employment related services for the
department the employee either worked in, or had a direct relationship with a vendor that
provided services for the employee’s department. Of this 21, 12 vendors in the VMF database
may have a potential conflict of interest based on name or address association with an
employee7.
Of the 12 vendors with potential conflict, six of them clearly match a paid vendor to a City
employee. These relationships may present a conflict of interest as noted in the policy and
represent potential violations of the City’s purchase order terms and conditions, as well as the
City’s outside employment policy. None of these employees disclosed their business
relationship and payment via an outside employment form. These relationships on appearance
can present a conflict of interest as noted in the policy. Additionally, we identified one instance
of a department requesting payment to purchase tickets for an employee to attend an after-
hours retirement party.
The current vendor questionnaire does not require vendors to sign that they certify the
information they provide is true or hold them accountable to review and agree to the PO terms
and conditions. The form also does not provide a space for vendors to disclose or indicate if
they have a relationship with anyone in the City that may be perceived as a conflict, and if they
7 The remaining nine were associated with vendors that may have had the same surname or address as an employee, but provided services to a department different from the employees or could not be reasonably associated with the employee. The information on potential conflicts was provided to Human Resources to review and investigate as necessary.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 15 A18-FIN-VMF05
have taken the steps necessary to get the written authorization by the appropriate authority to
do business with the City.
Audit referred the identified potential conflicts to Human Resources to investigate. Human
Resources conducted their review, and noted that departments associated with the employees
with potential conflicts were advised to strengthen staff training on City procurement policies.
Employees Paid for Services as an Independent Contractor
The City’s purchasing terms and conditions that are attached to a purchase order require the
vendor to affirm they are an independent contractor and not an employee or agent of the City
and shall furnish such services in its own manner and method except as required by this
Agreement. The City’s purchase order terms and conditions also include a “No Conflict” clause,
which states:
“Vendor hereby represents, warrants and certifies that no officer or employee of the
Vendor is a director, officer or employee of the City of Pasadena, or a member of
any boards, commission or committees, except as permitted by law.”
Based on a December 2012 determination, the Internal Revenue Service (IRS) allows a worker
to be considered both an employee and independent contractor, but each position must be
examined on a case-by-case basis. Code Section 31.3121(d)-1(c) (2) notes that an employer and
employee relationship exists when the person for whom the services are performed has the
right to direct and control the individual who performs the services not only as to the result to
be accomplished by the work, but also as to the details and means by which that result is
accomplished. The employer does not necessarily have to actually direct or control the manner
in which the services are performed; it is sufficient if he or she has the right to do so. Section
31.3121(d)-1(a)(3) of the regulations provides that if the relationship of an employer and
employee exists, the designation or description of the relationship by the parties as anything
other than that of employer and employee is immaterial. Thus, if an employer-employee
relationship exists, it is of no consequence that the employee is designated as partner, agent,
independent contractor, or other title. The IRS can make an official determination when
requested by a business using an SS-8 form.
Employees Receiving Housing Assistance Payments
Although not part of our sample testing, we found that a small number of City employees are property owners that participate in the City’s rental housing assistance program. This program is administered by the Housing program, which provides tenant-based assistance under the housing choice voucher program (voucher program) of the U.S. Department of Housing and Urban Development (HUD), also known as Section 8. These participating landlords receive a monthly subsidy payment for rent for tenants with Section 8 vouchers based on the HUD income-based rental limits for the metropolitan region.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 16 A18-FIN-VMF05
Based on the current outside employment policy, it is unclear whether passive income or investment activities in the City of Pasadena such as rental income would be considered employment and therefore require disclosure by the employee. This information must be disclosed for employees subject to state California Fair Policy Practices Commission Form 700 filing, but not for other employee classifications. Without clarifying the policy of outside employment, the City is at risk of allowing an employee
to perform a job activity that could provide them a personal benefit or present another type of
conflict of interest. Also, by not strengthening and enforcing the current policies and
procedures for disclosing known conflicts of interests with a vendor, the City is at risk of
appearing to favor parties related to an employee and potentially prevent others from
competing for the City’s business. Additionally, it may be in the City’s best interest to seek an
official determination from the IRS for workers who are considered employees of the city and
also provide services as an independent contractor to ensure compliance with IRS rules related
to common law employees and 1099 reporting.
Recommendation 3-1: The Director of Finance or his designee should:
Incorporate the following evaluation guidelines into the Purchasing Handbook: Require
department directors to advise staff that select vendors for goods and services of the City’s
conflict of interest and disclosures policies, and develop a form or other document to provide
staff an opportunity to disclose any perceived or actual conflicts that arise in the vendor
selection process. Department directors should report on any conflicts of interest or absence
of any known conflicts by a department employee annually to Human Resources and Finance.
Management Response:
The Finance Director agrees with the recommendation and has revised the Purchasing
Handbook. In addition, the Finance Department will develop a form to annually solicit input
from each department director regarding the existence or absence of known conflicts of
interest unique to their department. The Finance Director’s response to the audit is included in
Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 17 A18-FIN-VMF05
Recommendation 3-2: The Director of Human Resources or her designee should:
a) Provide an official notification of any adopted changes to the outside employment
policy and disclosure process to current and new employees.
b) Review the current Outside Employment Policy and Disclosure form and update as
necessary to clarify what types of services or payments from the City would be
considered Outside Employment
c) Consult with the City Attorney’s Office and Director of Finance, if needed, to review and
determine which City employee-affiliated active vendors require an official IRS SS-8
determination.
Management Response:
The Human Resources department has agreed to discuss the need to broaden the outside
employment policy and to make needed changes if it is determined the policy should be
updated. The Human Resources Director’s response to the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 18 A18-FIN-VMF05
Issue 4: Nonprofit and Charitable Organizations Not Adequately Reviewed
Issue Risk: High
Special vendor types, such as nonprofit organizations that act as service providers for the City,
or receive charitable contributions are not being consistently validated using publicly available
IRS nonprofit and state business searches.
As noted in the City’s Purchasing Handbook8, there are conditions when new forms and
updated information may be required from prior or current City vendors, including the
questionnaire and W-9 form. This includes a vendor whose information was transferred from
the prior financial system, has worked with the City for more than three years, or if the vendor
has a change in ownership, name, or address.
We identified 18 vendors in the VMF database, which appear to be charitable or nonprofit
organizations that do not have any W-9, IRS, or other documentation to validate the
organization's existence. These organizations receive payroll deductions from employees as
part of a charitable donation program administered by the Employee Advisory Board. A total of
18 local and national nonprofit organizations receive payroll deductions from employees.
Figure 4: Organizations Registered as Nonprofits with the IRS
Source: Analysis of vendor types in Vendor Master File Database
8 Includes the policies and procedures referenced in the City’s Municipal Code and Financial Policies in the Manual of Personnel and Administrative Rules. This handbook is developed and maintained by the Purchasing division of the Finance Department.
11
6
1
Active
No Record
Status Revoked
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 19 A18-FIN-VMF05
Figure 5: Organizations Incorporated with the State of California
Source: Analysis of vendor types in Vendor Master File Database
Six of the 18 organizations in the VMF database are city employee associations9. These
associations are organizations formed by City employees for charitable or social purposes that
are funded by payroll contributions from City employees. Of these six organizations, only one is
an active nonprofit organization with the IRS and state. One organization had their IRS
nonprofit status auto-revoked and state designation revoked, while one other had their state
designation suspended. The remaining three have no record of being a tax-exempt entity or
other official entity with the IRS or the State of California.
Based on staff testimony, the nonprofits paid via payroll contributions have been participating
in the program for many years. They likely were not subject to the City’s vendor validation and
monitoring procedures outlined by the Purchasing Handbook. Purchasing’s primary validation
technique is to run a System for Award Management (SAM) report for all vendors. This report
was run for these 18 entities. This type of validation check is used to determine if a business
entity has been debarred from contracting with the Federal government. This type of check
would not identify if a nonprofit was a legitimate nonprofit registered with the IRS and/or a
respective state agency, or even in existence at present. Without conducting the proper
scrutiny of a nonprofit organization, the City may be processing payments from employee
contributions to organizations that are not valid or no longer in existence.
Recommendation 4: The Director of Finance or his designee should:
a) Require current and future nonprofit organizations receiving payments from the City or
its employees to submit W-9 forms, the vendor questionnaire, and any other
documentation necessary to validate their existence as a charitable or nonprofit entity.
b) Conduct an independent verification of nonprofit vendors using publically available tax-
exempt entity searches via the IRS and California Secretary of State. Update the
9 These do not include the employee unions.
13
2
1
2
Active
Suspended
Merged Out
Not Filed
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 20 A18-FIN-VMF05
Purchasing Handbook and any accompanying informational materials to reflect these
new procedures.
c) Notify any noncompliant nonprofit entity that all payroll deductions will cease by
December 31, 2018 if the nonprofit entity has not registered properly with the IRS and
California Secretary of State.
Management Response:
The Finance Director agrees with the recommendation and has amended its new vendor
process and ongoing vendor review process to include validation of nonprofit status as well as
documentation for for-profit businesses. Finance staff have notified the various employee
groups of the December 31, 2018 deadline and will follow-up as necessary. The Finance
Director’s response to the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 21 A18-FIN-VMF05
Issue 5: Potential Duplicate Vendors in VMF Database
Issue Risk: Medium
The Finance Department has begun to implement processes to refine and maintain the VMF so
that all active vendors are current, up to date, and valid; however, effort is still needed to
deactivate old vendors and conduct an independent validation of existing vendors.
Best practices for maintaining vendors in a database include:
Using standard forms and approvals to add or edit vendor data;
Conducting an independent validation of vendors using a 3rd party service or database;
Establishing routine processes to check for existing vendors before approving the
addition of a new vendor; and
Ensuring that appropriate vendor maintenance and modification rights are adequately
segregated.
Additionally, the City’s Purchasing Handbook outlines the procedures for a department to
request the setup of a new or maintenance of an existing vendor. This process is illustrated in
Figure 2 in the Background Section of this report.
Based on a review of the VMF process, we identified the following conditions:
There are 28 vendors in the VMF database that are duplicates but assigned unique
vendor numbers. These 28 consist of 13 unique vendor entities. For example, there are
five vendors named Chevron, but these are five gas stations in different cities.
126 vendor records contained address duplicates, of which 54 were identified as unique
addresses10. Of the 126 reviewed, 65 percent of remittance addresses could be tied to
the vendor based on available documentation in the VMF database or on the web.
Past practices in the maintenance of the VMF database resulted in the duplication of existing
vendors, maintenance of vendors that no longer did business with the City, and did not include
an independent validation of existing vendors. According to the Finance Department, two full-
time staff were involved in cleaning up the vendor data from the prior system (PeopleSoft), but
the data was not completely clean when it was transferred into Munis to prevent former or
inactive vendors from being added to the new Munis VMF database when the system went live
in FY 2016. There had been no systemic review of active or inactive vendors in the current VMF
database until 2017, this review is still ongoing.
At present, the Finance department is not able to completely segregate Purchasing staff in
maintaining and modifying the VMF database. To compensate for this segregation of duties
issue, the Finance Director has added a layer of routine monitoring. The Finance Director
independently queries a report in Munis that details modifications made to the VMF database.
10 The most frequent reason for the duplicates were individual property owners that had a combination of a utility rebate, permit refund, and/or are a Housing Assistance Payment property owner
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 22 A18-FIN-VMF05
The Finance Director then reviews the documentation supporting the modification and meets
with the Purchasing Administrator and Finance staff to review changes and obtain clarifying
information. These conversations at present are not documented, but the Finance Director will
begin to formally document these reviews and note issues he observed.
Another measure taken by the Finance department to strengthen their oversight of the VMF
database is conducting an annual verification of vendor Social Security Number (SSN) or Tax
Identification Numbers (TIN) using an online Internal Revenue Service verification service,
beginning with vendors paid in FY 2017. The Purchasing Division with assistance from DoIT was
able to conduct this IRS check of active vendors in the VMF database. A total of 2,477 records in
the VMF database were verified by the IRS, which matched as follows:
Figure 6: Results of Vendors’ TINs Matched to IRS Verification Service
Source: Analysis of IRS TIN Results Provided by Purchasing Division
Currently, IRS verifications are conducted before new requisitions are approved as POs. Also,
contracts are not processed for vendors without IRS verification on file.
Recommendation 5: As part of the ongoing maintenance effort, the Director of Finance or his
designee should:
a) Review all active vendors with duplicate addresses on file to consolidate information
into one entry and deactivate the other associated vendor number.
b) Review all active vendors using a PO Box as their business or remittance address and
receive confirmation of their existence at a physical location.
c) Review all vendors coded as 1099 vendor to verify they meet the IRS requirement to be
a 1099 vendor, and develop procedures to accurately categorize a new or current
vendor as a 1099 reportable vendor.
2241
33202
1
IRS TIN Match Results
Matched TIN Not Yet Issued Did Not Match Duplicate request
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 23 A18-FIN-VMF05
d) Document the meetings with the Purchasing Administrator to review any VMF database
changes, noting any specific issues or anomalies that need further review or correction.
Management Response:
The Finance Director agrees with this recommendation and is working to implement all items.
The Finance Director’s response to the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 24 A18-FIN-VMF05
Issue 6: Updated W-9s are Needed for Housing Assistance Payments
Issue Risk: Medium
The Housing Department is not consistently receiving updated W-9 forms from property
owners and managers that receive Housing Assistance Payments (HAP) to ensure payment is
being made to current and legitimate payees.
The Purchasing Handbook outlines conditions when documentation may be required from prior
or current vendors, including the questionnaire and W-9 form. These include if the vendor was
transferred from PeopleSoft, has done work for the City for more than three years, or if there
has been a change in ownership, name, or address. The Housing Department has their own
internal procedures for validating a prospective landlord to ensure they are the legitimate
owner or their designated representative and collect documentation to comply with HUD and
local regulations, including an independent ownership validation using a third party database.
Housing would typically request new ownership documentation when they are notified of a
change in ownership by the tenant or the owner. According to Housing staff, they began
collecting vendor questionnaires and W-9s forms to send to Purchasing in the last two years,
and have about 400 property owners participating in the program at present.
In our sample of HAP vendor documentation tested, we found that 40 of 55 (73%) vendors with
W-9s have signatures that pre-date 2015. Additionally, 9 payees (14%) of vendors were missing
W-9s in Munis. In our review of HAP owner files maintained by the department, six of the
landlords were no longer participants in the program, but were still listed as active vendors in
the VMF database. In addition, two property files reviewed on site also did not contain any
evidence of an independent ownership validation search performed by Housing. According to
Housing, both properties are owned by participating landlords that started with the program
prior to 2003, when Housing began to use an independent real estate ownership validation
service called RealQuest. The practice used by Housing staff prior to 2003 was to request copies
of grant deeds and property tax bills from participating landlords at the time of initial contract
signing to verify ownership. Housing then provided us evidence that these two properties
contained ownership validation evidence dated 1997 and 1992.
The conditions related to the lack of current W-9s for HAP stemmed from not having a formal
process or practice in place to request and receive updated W-9s from existing HAP landlords,
or to update the Purchasing Administrator to deactivate former HAP recipients during our
period of review. Without recent and verifiable landlord information, the Housing department
is at risk of approving payment for landlords that are no longer rightful owners or ceased
participating as a Section 8 rental unit.
Housing Department in conjunction with the Purchasing Division, has reached out to existing
HAP landlord/owners to get updated W-9s. According to Purchasing and Housing staff, as of
October 2018, there are 430 Active HAP landlord/owners in the VMF, however, 40 landlords do
not have current W-9s in the VMF. Of the 40 outstanding vendors, 16 have not yet responded
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 25 A18-FIN-VMF05
to the request for an updated W-9 and 15 returned W-9s that were either rejected for
incomplete data or missing physical addresses and nine submitted updated W-9s but did not
use the most current IRS form. Housing staff have committed to following up with the
landlords with outstanding W-9 updates.
Recommendation 6a: The Housing Director or his designee should work with Purchasing staff
to continue to obtain recent W-9s from landlords with outdated forms in the VMF; and require
landlords/owners to complete and sign a W-9 every 3 years as required by City policy.
Recommendation 6b: The Finance Director or his designee should consider implementing the
IRS 20% withholding for any landlords/owners that do not complete and submit an updated
W-9 form.
Management Response:
The Finance Director agrees with this recommendation and will make such considerations. The
Finance Director’s response to the audit is included in Attachment B.
The Housing Director agrees with the recommendation and is working to collect all required
W-9s from landlord/owners. Additionally, the Administrative Plan will be updated to include
this requirement beginning with the 2019 program year. The Housing Director’s response to the
audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 26 A18-FIN-VMF05
Issue 7: Accuracy of Worker’s Compensation Third Party Administrator Taxpayer
Identification Numbers (TINs) and Vendor Form 1099 Information
Issue Risk: Medium
The City is not consistently receiving accurate tax identification numbers for vendors used by
the Third Party Administrator.
The City contracts with a Third Party Administrator (TPA) to receive and process worker’s
compensation claims and treatment. The TPA directly pays worker’s compensation medical and
health care providers on behalf of the City of Pasadena. The TPA sends the Human Resources
Worker’s Compensation Supervisor a weekly check register of services provided for affected
employees that the Worker’s Compensation coordinator reviews and then approves for
payment by the Finance Department. A trust account for payment of workers’ compensation
claims is used to pay the TPA. Finance reconciles payments to the bank statements and the
Human Resources Worker’s Compensation Supervisor weekly reviews the check registers which
includes paper transactions, voids, stop pays, and vouchers. According to the policies and
procedures provided by the TPA, they require all new individuals or businesses that they do
business with to submit a completed IRS W-9 form upon submitting a request for payment. The
TPA cannot enter a vendor in their system without a tax ID and issue a second request if they
do not receive a W-9 by year end. The TPA also has additional procedures to follow if the
second attempt is not successful. The procedures did not include any formal processes for
validating the information the individual or business provides on their W-9. Upon request from
the City, the TPA now uses the IRS match process to validate that the vendor provided a correct
TIN.
In FY 2016, 50 total vendors paid by the City or TPA submitted an incorrect name or tax
identification number, of which 21 (42%) are worker's compensation vendors used by the TPA.
Of the 21, 12 had used a name that was different from the official TIN name, but eventually
were verified as having valid TINs. Eight of these vendors provided an updated W-9 form. One
vendor has yet to submit the requested information and per the Worker’s Compensation
Supervisor, is no longer receiving any payment from the City. The City’s Worker’s Compensation
Supervisor followed up with the TPA to determine what actions the TPA should take to remedy
this issue in the future. According to the Worker’s Compensation Supervisor, the TPA has
agreed to do update their procedures to include a preliminary IRS verification of TIN numbers
prior to adding this vendor to their database, as well as deactivate vendors that are
nonresponsive to W-9 requests.
By requiring the TPA to do preventative validation of their vendors/service providers, the City
can more effectively administer the 1099 process and reduce the risk of paying a fraudulent
vendor.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 27 A18-FIN-VMF05
Recommendation 7:
The Director of Human Resources should work with the Worker’s Compensation Supervisor to
conduct periodic monitoring of the TPA to ensure they are properly validating and managing
service providers used for City of Pasadena Worker’s Compensation claims.
Management Response:
The Human Resources Director agrees with the recommendation and the TPA has already
updated their Vendor W-9 policy and procedures will be required to provide quarterly
confirmation of compliance to these procedures. The Human Resources Director’s response to
the audit is included in Attachment B.
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 28 A18-FIN-VMF05
Attachment A: Findings Risk Ranking Criteria
High Risk Medium Risk Low Risk
Potential significant financial/operational losses to the City
Weakness that could cause moderate losses to the City
Control weaknesses exist but are mitigated by other controls
Significant internal control weaknesses that are Citywide or affect a department’s operations.
Internal control weaknesses at a division or unit level or non-compliance with citywide policies
Controls which, if eliminated or re-engineered, would benefit productivity or effectiveness
Violation of laws, regulations or Municipal Code/Ordinance
Non-compliance with grant requirements or other contractual agreements
Opportunities for process improvements or increased efficiencies
Audit of the City’s Vendor Master File and 1099 Process
Internal Audit City Manager’s Office 29 A18-FIN-VMF05
Attachment B: Management Responses to Audit Report
B1: Finance Department
B2: Department of Information Technology
B3: Human Resources Department
B4: Housing Department
30
31
Attachment B2
32
33
34
35
36
Attachment B4
37
38