Page 1 of 6
Semi-annual Implementation Status
internal Audit Report #12-05
july 10, 2012
Scope
This report reflects the status, as of May 2012, of outstanding audit corrective action plans (CAP’s)and monitoring projects.
Status highlights
Internal Audit tracked 11 audits during the Spring 2012 status cycle which included a total of 167 individual CAP’s of which 107(64.1%) are now either fully implemented or substantially complete. The timeliness of implementing CAPs on schedule has risen slightly-- from 36.9% in Fall 2011 to 42.4% in Spring 2012. The CAP’s for 1 of the 11 audits are now fully implemented and the audit is now closed.
CAP implementation updates are listed in chronological order by date of audit report issuance. Thestatus highlights were selected based upon the auditor’s professional judgment and do not represent everychange within the last six months. Appendix A provides a detailed summary of the implementation status of all CAP’s.
To facilitate a review of this report, status codingis as follows:
/ Significant delays or conditions which impede implementation of planned corrective actions. / Moderate delays or conditions exist which slow implementation of corrective actions.
/ Implementation of corrective actionsis complete or progressing onschedule.
Security Audit & FTA Implementation Status Review
Report #07-11, October 22, 2007
/ Department of Homeland Security (DHS) continues to track progress in addressing security recommendations. The TSA returned in August 2011 to perform a follow-up on the implementation status of their July 2010 Baseline Assessment & Security Enhancement (BASE) recommendations. According to the DHS, while Capital Metro has improved, they will continue to closely monitor the Authority’s progress in resolving identified security vulnerabilities. A follow-up review was performed inJune 2012. If Capital Metro receives a satisfactory score in this review, BASE assessments will be conducted every five years thereafter.Fuel Controls Audit
Report #08-12, October 27, 2008
/ All corrective actions completed: The final corrective action plan item regarding performance of monthly fuel audits of a MetroBus contractor is complete. The audit is now closed.Capital Planning & Management Performance Audit
Report #09-06, March 22, 2010
/ Capital Project Status Reporting: The Capital Improvement Program (CIP) Policy requires quarterly project status updates to the Board of Directors including the “percentage of CIP projects within original budget and the percentage of CIP projects completed on original schedule.” Quarterly capital project status updates have not included these project completion metrics. In addition, reported project expenditure data is not consistently reliable. To correct this, the Finance Departmenthas developed a capital project spending report which is currently being tested by capital project managers. In addition, written instructions for updatingcapital project profiles are being documented and will include a requirement for project managers to verify project spending each month.MetroAccess Performance Audit
Report #10-06, August 20, 2010
/ Cost Allocation Policy & Model: A Cost Allocation Policy was approved in February 2012. The new policy recognizes four allocation methodologies: (1) Internal-for management reporting and analysis, (2) National Transit Database-for reporting federal transit statistics, (3) OMB-A-87-for allocating indirect costs to federal grants, and (4) Service Expansion-for pricing transportation services for communities outside of the Capital Metro service area. / Validation of questionable no-show trips: MetroAccess is developing reports to facilitate identifying and correcting questionable no-show trips. Monitoring and validating questionable no-show trips will require continued emphasis when MetroAccess service is outsourced as an erroneous “no show” could likely be reclassified as a “missed trip” which wouldthen incur a financial penalty under the new contract.
Rail Inventory Audit
Report #10-02, November 18, 2010
/ Maintenance of Way plan accepted. Capital project proposed to improve physical security of rail materials: The contractor’s Maintenance of Way (MOW) plan was submitted in January 2012 and has been formally accepted by Capital Metro. The MOW Plan now supports rail material budgeting, purchasing, and scheduling decisions. However, it does not yet address audit findings related to physical security and storage of rail materials. The Rail Department has requested capital funds in FY2013 to provide two additional fenced areas for storage of rail inventory. If approved, the contractor will have increased access tosecure areas and will be required to adjust itspractices for storing Authority-owned rail materialsRevenue Collections & Controls Audit
Report #10-08, January 12, 2011
/ Transit Store operations: A consultant was recently hired to expedite the implementation of a new point-of-sale (POS) system. Revenue and fare media reconciliation procedures using POS reports are scheduled to be implemented by July 16, 2012. (The original planned implementation date for these procedures was February 28, 2011.) Management oversight of the Transit Store has shifted to the Customer Service Manager and periodic “surprise” audits are planned once the POS system is in place. An investigation of revenue irregularities was performed resulting in the dismissal of a Transit Store employee. New procedures and controls, once implemented, will assist in preventing and detecting potential fraud. / Monitoring Rail Fare Evasion: The Revenue Manager now receives reports from the rail fare inspector. A 1.5% fare evasion “tolerance” threshold has been established for rail operations, consistent with fixed route services. Variances in excess of this amount require investigation by the Revenue Manager and/or Security Manager. The Customer Service Advisory Committee has endorsed administrative penalties for fare evasion. Staff has evaluated this option and determined it is currently more cost effective to continue the present policy of enforcement through contract APD officers.
/ Security-sensitive key accounting and security alert notifications transitioning to contractors: Responsibility for tracking farebox keys and other security-sensitive components and reviewing security alert notifications will transition to the FRS contractor in August 2012. The Bus & Paratransit ServicesDepartment plans to include monitoring procedures for these elements in the Contract Management Plan (CMP). Implementation status will be reassessed following transition for the Fall 2012 status update.
IT Governance Audit
Report #11-07, April 13, 2011
/ Technology Strategic Plan & Technology Infrastructure Plan: Development of a Technology Strategic Plan and the supporting Technology Infrastructure Plan has been deferredby six months (from March to September 2012.) In preparation for these items, this summer, the CIO will brief the Planning & Operations on technology strategies and initiatives including new phone /communication systems; data center infrastructure including storage & server systems and productivity software. / Contract Risk Assessments –The contract risk assessment template is being amended to include a section for IT procurements. Once implemented, the Contracts Administrator and Project Manager will jointly review the completed risk assessment to identify any special provisions such as bonding, liquidated damages, incentives, etc. that can mitigate identified contract risks. The risk assessment rating will also be provided to the Board as part of the standard procurement summary. The completion date has been delayed 7 months to September 30, 2012.
Property Management & Space Planning Audit
Report #11-06, May 11, 2011
/ Rail Right-of-Way (ROW) Business Plan: The Capital Projects & Real Estate Department has drafted a Railroad ROW Business Plan to identify and more effectively capitalize on ROW revenue-generating activities. To complete this plan, a ROW “Use and Fee Policy” should be developed in coordination with Rail Operations. The Rail Department owns Strategic Plan Objective 2.1 task to develop a business plan for freight rail operations. This initiative has subtasks that may affect easements and other agreements which are negotiated by the Real Estate Department.MetroRapid Project Implementation Monitoring
Monitoring Project #11-01
/ Project Management & Quality Assurance Plan: After a nine month delay, the Project Construction Grant Agreement (PCGA)was approved in April 2012. The official Project Management Plan, including schedule and budget, are being updated and will be submitted to the FTA in late Summer 2012. The Project Manager will also coordinate a “gap analysis” with the sub-project managers which will be used to develop a comprehensive Quality Assurance (QA) Plan. The QA Plan will be submitted for FTA’s review and, once approved, will be incorporated into the Project Management Plan.To facilitate project monitoring, detailed project status reporting templates have been established for critical MetroRapid sub-projects, e.g., station design and construction. These will be updated and reviewed monthly.
/ Project Risk Mitigation Continues: Steps taken to mitigate known project risks include initiating an interlocal agreement (ILA) with the City of Austin to assign a staff member from both the City’s Transportation and Public Works Departments to participate on the MetroRapid Project Team during the project’s design and construction phases. The ILA has been in development for over a year, but is scheduled for City Council action in August 2012. Secondly, a contract for a Capital Metro Construction Inspector/Coordinator was awarded in June 2012. The consultant will be responsible for assuring quality and timely construction of all MetroRapid Stations. Lastly, the contract for the construction of the MetroRapid Route 1 Bus Stations was structured to include costing options which can be adjusted or removed to control, as needed, overall construction project costs.
First Transit Contract Audit
Report #11-12, September 14, 2011
/ Contract Management Plan: Implementation of the outstanding corrective action items is dependent on developing an enhanced Contract Management Plan (CMP). The CMP is on target to be completed by August 1, 2012, the original due date.Small & Micro Purchasing Audit
Report #11-11, November 30, 2011
/ Small purchasing risks will significantly decrease: With the pending outsourcing of vehicle and building maintenance functions, the financial risk previously associated with smallcontracts for vehicle parts and other maintenance materials will be predominatelytransferred to the new contractors. In recognition of this, the Contracts & Procurement Departmentplans to reviewthe remaining purchasing activities to identify opportunities, if any, to consolidate multiple small purchases into larger and more cost-effective contracts.Labor Transition Monitoring
RepMonitoring Project #11-14
/ Mobilization Plan: The labor transition project remains on target to meet the August 19, 2012 cutover. As of May 31, 2012, 25% of the mobilization plan tasks for Fixed Route and Metro Access services have been completed. Development of Contract Management Plans which will be used to monitor contractor operations is approximately 85% complete. / Project Lessons Learned: Documenting “lessons learned” helps the project team identify project success as well as opportunities that can be used to improve the management of future projects. The lessons identified covered all areas of the project including communications, human resources, contracting and procurement, technology, and legal strategy. Two of the project’s most significant successes included strong cross-functional project steering and implementation committees and extensive vendor communications which included visiting other outsourced properties to learn from their successes and mistakes. The most significant project challenge identified by the team was balancing the procurement process while simultaneously addressing long-standing legal questions.
Why status updates are important
United States General Accountability Office (GAO) standards specify that management is responsible for “addressing the findings and recommendations of auditors, and for establishing and maintaining a process to track the status of such findings and recommendations.”[1] Internal auditors are required to follow-up to determine whether appropriate corrective actions have been taken.[2]
Closing
Internal Audit is grateful to Capital Metro management and staff who have worked to implement improvements in controls and processes. Their cooperation and assistance is instrumental to the success of the Authority.
______
Caroline M. Beyer, CPA, CISA
VP, Internal Audit
cc:Capital Metro Board of Directors
Linda Watson, President / CEO
Elaine Timbes, EVP / Chief Operating Officer
Doug Allen, EVP / Chief Development Officer
Billy Hamilton, Interim EVP Finance & Administration
Kerri Butcher, Interim Chief Counsel
Capital Metro Leadership Team
Appendix A: Implementation Status Detail
Report Date / Exec Sponsor / Project Name / Implementation Status / TimelyComplete / Substantially Complete / In
Process / Not
Implem. / Not YetDue**
10/22/07 / Timbes / Security Program Audit / 6 / 0 / 0 / 2 / 0 / -
3/31/08 / Hamilton / Accounts Receivable Audit / 7 / 0 / 0 / 2 / 0 / -
10/27/08 / Timbes / Fuel Controls Audit – Audit Closed / 23 / 0 / 0 / 1 / 0 / 16.7%
3/22/10 / Hamilton / Capital Planning & Management Performance Audit / 9 / 1 / 0 / 0 / 4 / 90.0%
8/20/10 / Timbes / MetroAccess Performance Audit / 21 / 1 / 1 / 1 / 0 / 37.5%
11/18/10 / Clark / Rail Inventory Audit / 9 / 1 / 2 / 0 / 0 / 50.0%
1/12/11 / Hamilton / Revenue Collections & Controls Audit / 16 / 1 / 4 / 3 / 3 / 44.4%
4/13/11 / Iannello / IT Governance / 7 / 0 / 4 / 2 / 8 / 46.2%
7/13/11 / Hodges / Property Management & Space Planning Audit / 3 / 0 / 5 / 2 / 3 / 42.9%
9/14/11 / Timbes / First Transit Contract Audit / 2 / 0 / 1 / 0 / 4 / 66.7%
TOTALS / Current
5/2012 / Quantity / 103 / 4 / 21 / 15 / 24 / 42.4%
Percentage / 61.7% / 2.4% / 12.6% / 9.0% / 14%
Previous
11/2011 / Quantity / 113 / 9 / 14 / 14 / -- / 36.9%
Percentage / 75.3% / 6.0% / 9.3% / 9.3% / --
Action item status categories:
CompleteIntent of the corrective action plan item has been met and no further corrective action is required. In some instances, Internal Audit monitors to ensure continuity.
Substantially CompleteGreater degree of progress towards completion than “In Process” and may not require further steps beyond continued performance, monitoring, and/or experience with the implemented action plan.
In ProcessSome progress towards implementation of corrective action plan has been made but additional actions are required before intent is met.
Not ImplementedNo measurable progress towards implementation of corrective action plan (excludes action plan items for which the target date has not yet been reached).
Not Yet Due (**NEW)The original CAP implementation date has not been reached and/or other conditions needed to assess implementation status have not materialized.
TimelyThis represents the relative percentage of all corrective action plans for which intent was met by the stated target date. The total figure represents a weighted average for all applicable updates.
internal audit | July 10, 2012
[1]GAO-12-331G Government Auditing Standards, 2011 Revision, Section A1.08.f.
[2]GAO-12-331G Government Auditing Standards, 2011 Revision, Section 7.05.