BCC: Development Services Private Provider Refunds - Dated June 30, 2023

Summary

5 findings

1. Finding 1mediumpolicy

   Refunds lacked required supporting Sunbiz documentation per policy

   Four of 40 refunds tested (10%) did not have proper supporting Sunbiz documentation as required by the Private Provider Refund Policy and Procedure. For one refund, the name on the Release, Satisfaction, and Settlement Agreement did not match the Sunbiz documentation on file. For three refunds, Sunbiz documents were requested by the IG but not included in management's response, suggesting the documentation did not exist at the time of the refund. Documents later provided by the Department bore an electronic date stamp of May 10, 2022, indicating they may have been created after the fact.

   Recommendation: No formal recommendation was provided since compliance with policies and procedures is required. Management was expected to remediate.
   Management response: Acknowledged. Files were reviewed, verified, and updated in the filing system on site. Completed 4.30.2023.
2. Finding 2highdata access

   Accela permit report reflected unexplained gaps in sequential permit numbers

   Of 43,742 permits on the Accela permit report for the audit period, the IG identified 1,113 gaps (approximately 3%) in sequential permit numbers. Explanations provided by management included 1,054 permits with file creation dates outside the audit period, 10 deleted permits (the delete function was inadvertently enabled and used in error with no supporting documentation), 48 permits attributed to a system glitch or child record creation, and one permit marked inactive without supporting documentation. No formalized procedure existed for monitoring gaps in sequential permit numbers, and documented management approvals were not required for deletions or inactivations, increasing the risk of unauthorized transactions going undetected.

   Recommendation: Prohibit staff from deleting records in Accela; implement alternative methods for handling invalid permits. Collaborate with IT and Accela to understand reporting capabilities and generate ad-hoc status reports. Establish documented policies for monitoring sequential permit gaps and inactive permits. Require documented management pre-approvals and justifications for inactive status changes. Review the 1,054 out-of-period permits for workflow changes. Conduct a detailed review of the Deleted Permit Report for suspicious activity. Review Accela user permissions. Contact Accela to determine the cause of nonexistent permit number records.
   Management response: Acknowledged all recommendations. Delete option was removed for staff once identified. Accela's Enhanced Reporting Database was purchased December 2022. New IT ticket system active December 2022. Vendor confirmed skips in sequence do not cause data loss.
3. Finding 3highdata access

   Accela permit report lacked complete and reliable private provider data fields

   Of 41,951 permits eligible for outsourcing, approximately 77% (32,353 permits) had incomplete data fields for identifying whether inspections and/or plans reviews were outsourced to private providers. Specifically, 24,300 permits (approximately 58%) had at least two blank data fields and 8,053 permits (approximately 19%) had one blank data field. The outsourcing data fields were not mandatory in Accela, allowing permit technicians or customers to skip them, and no documented procedures required secondary review to verify accuracy and completeness of data entry.

   Recommendation: Review and document all permit types eligible for outsourcing. Establish a documented management review procedure for permit outsource information and create a tracking field in Accela for private provider status changes. Require outsource data fields to be mandatory and conduct periodic reviews for compliance, accuracy, and reliability.
   Management response: Acknowledged. Efficiency checklist will be updated to indicate eligible permit types. A Quality Control position was requested and a work plan developed. Outsource fields have been made mandatory. Periodic reviews will be completed by the Quality Control position.
4. Finding 4highdata access

   Accela outsource data fields contained frequent inaccurate permit information

   Testing of 53 permits found that 27 (approximately 51%) reflected an incorrect outsourcing status or a status that could not be verified. Seventeen permits had data entry errors including 'No' recorded instead of 'Yes' or vice versa, or blank fields instead of 'No.' Three permits that had received private provider refunds were not included on the Schedule of Refunds List because inaccurate 'No' entries in Accela caused them to be missed; they were only caught because contractors self-identified. Ten permits had one blank outsource field for plans review and the IG could not independently verify whether those permits were owed a refund. No formalized policy required staff to update outsource fields when new or corrected information became available.

   Recommendation: Develop a plan to review and correct all outsource fields in Accela. Document and implement a periodic quality review process in the permit workflow for outsource data accuracy. Implement a policy requiring timely updates to Accela when errors or omissions are detected.
   Management response: Acknowledged. Outsource fields have been changed to mandatory. A Quality Control position work plan has been developed. A process/procedure for updating records modified after the application process has been established.
5. Finding 5mediumcash handling$450,704

   Private Provider Refund Log and Schedule of Refunds List not reconciled to general ledger

   The Private Provider Refund Log and Schedule of Refunds List did not agree with the Vendor 20 Payment Report (general ledger) as of November 18, 2021. Of 307 refund checks on the refund log, five unmatched records were identified including two checks with incorrect dollar amounts, one with an incorrect date, one check number not found on the Vendor 20 Payment Report, and one voided check whose replacement check number was not recorded. After reconciliation, the Schedule of Refunds List still reflected a variance of $155.46 from the Vendor 20 Payment Report. No formal written policy requiring periodic reconciliations of private provider refunds to the general ledger existed.

   Recommendation: Develop and document procedures for periodic reconciliations of refunds from applicable reports, lists, and logs to the general ledger to ensure accuracy and completeness of private provider refund data.
   Management response: Acknowledged. Management recognizes the need to document periodic reconciliations. Fiscal will update the reconciliation process with additional formal procedures and enhanced controls to manage and monitor the process and address future variances. Target completion: June 2023.