Audit # Compliance with Polk County Cell Phone Policy

Transcription

1 Audit # Compliance with Polk County Cell Phone Policy Department of Inspector General Stacy M. Butterfield, CPA Clerk of the Circuit Court and County Comptroller

2 Stacy M. Butterfield, CPA Clerk of the Circuit Court and County Comptroller Polk County, Florida December 18, 2013 INSPECTOR GENERAL AUDIT REPORT AUDIT COMPLIANCE WITH CELLULAR TELEPHONE POLICY The Honorable Board of County Commissioners We have conducted an au_dit of compliance with the Polk County Cellular Telephone Policy, as revised Our audit objectives were to determine if Polk County employees using cellular telephones are in compliance with the policy; determine that services and equipment for cell phones and smart phones serve a County purpose; determine adequacy of Division monitoring of employee usage; evaluate whether departments are utilizing the most economical plans; and evaluate overall administration of the policy. We have presented recommendations in this report. We appreciate the cooperation shown by the staff of the Comptroller's Accounts Payable and the County Information Technology, as well as all County Divisions contacted during the audit. We hope you find this report useful in ensuring Polk County government provides the best possible services to our citizens. Respectfully submitted, Approved: Stacy M. utterfield, CPA Clerk of the Circuit Court and County Comptroller

3 AUDIT OF COMPLIANCE WITH PURPOSE The Department of Inspector General of the Clerk of the Circuit Court and County Comptroller has completed an audit of compliance with the Polk County Cellular Telephone Policy, as revised The audit scope included cell phones and smart phones, both personally owned and County owned, used to conduct County business. Our audit objectives were to determine if Polk County employees using cellular telephones are in compliance with the policy; determine that services and equipment for cell phones and smart phones serve a County purpose; determine adequacy of departmental monitoring of employee usage; evaluate whether County Divisions are utilizing the most economical plans; and evaluate overall administration of the policy. BACKGROUND The County currently employs approximately 2,000 people, many of whom are provided cellular telephones as an effective means of conducting Polk County business. The business use of cellular phones helps assure that necessary communications take place among staff members. Justifiable needs for cellular communications include enhanced productivity, remote communication, emergencies, and instances whereby the employee is not readily available or needs to be accessible both on and off duty. On February 1, 2011, the Board of County Commissioners approved a revision to the existing Cellular Telephone Policy under Section 10.08/Electronic Communications of the Employee Handbook. The purpose of the revision was to better meet IRS regulations and to streamline record keeping and billing processes. The County cell phone issuance system is under the direction of the Division of Information Technology (IT), except for Public Safety, which issues and maintains its own inventory of cell phones. Division management submits cell phone requests to IT for approval based on employees job responsibilities. Justification of the need for a cellular telephone, selection of an appropriate Cellular Plan Option, and acknowledgment of the employee s responsibility under the policy is required prior to the issuance of a cellular telephone or an allowance. Division Directors, Administration, Finance and Accounting to the BoCC, and Information Technology (IT) are responsible for administering adequate controls to assure compliance with the policy and to assure cost efficiency of the option selected for the employee. Cell phone options and plans are selected for each employee by Division management. Available plans include voice, text, and data service. Per the policy, a Blackberry device is required if text messaging is needed for County business, in order to effectively capture the messages for public records. Plans range from a basic flat rate to various tiers which include buy up options to increase minutes or data usage allowances to best meet business needs. Current Plan Options are A, B, and C, as described below. Buy up options are available for Page 1 of 9

4 AUDIT OF COMPLIANCE WITH plans A and C, which allow Division Management to customize each employee s plan to provide the level and services needed in the most cost efficient manner. Employees selecting Option A are issued a County owned phone for County business calls only. There is no personal use allowed for employees on this option. A variety of plan choices and buy-up options are available to customize the plan for each employee s County business needs. Employees selecting Option B provide their personal cell or smart phone and receive a reimbursement/allowance for County business usage. Option B is a 4-tier option that provides an allowance based on anticipated business usage. Tier options 1 through 3 currently range from $30 to $50 for calling service and $30 additional for fixed data usage per month. Currently data usage may not be selected alone. The 4 th tier option is a discount bundled plan designed for specific employees, subject to their Director s approval. Allowances are subject to applicable Federal taxes. Employees electing option C are issued a County owned phone for business with limited personal use allowed, which is defined as the lesser of 25% of total minutes or 250 minutes. The employee agrees to a payroll deduction each month, currently $7.50 per pay period, with a separate amount for personal text messages. The text option may not be selected alone; an additional $2.50 per pay period allows 250 text messages. If an employee exceeds personal limits, the employee may be subject to disciplinary action or required to select another option. As of January 25, 2012, there were 612 active County owned phones (Options A & C) and 140 active cell phones on the reimbursement/allowance plan (Option B). County cell phone carriers include Verizon, Sprint, AT&T, and Nextel. Polk County has negotiated service plan rates and currently, Verizon is the carrier of choice for most of the County. Sprint is the carrier of choice for Public Safety. Page 2 of 9

5 AUDIT OF COMPLIANCE WITH TABLE OF CELL PHONES BY DEPARTMENT & PLAN TYPE OPTIONS DEPARTMENT A B C TOTAL BUILDING TOURISM COUNTY ADMIN FACILITIES FLEET MANAGEMENT INFORMATION TECH NATURAL RESOURCES PARKS & REC PUBLIC SAFETY SOCIAL SERVICES TRANSPORTATION UTILITIES WASTE RESOURCES MISCELLANEOUS TOTAL CELL PHONES Utilities Waste Resources Miscellaneous Building CFDC County Admin Facilities Fleet Management Information Tech Transportation Natural Resources Social Services Parks & Rec Public Safety Page 3 of 9

6 AUDIT OF COMPLIANCE WITH SCOPE AND METHODOLOGY We chose the billing period ending January 25, 2013 for our testing. We began by reviewing the County cell phone policy. As the County has two methods of providing cell phones for employees, we selected a sample from each category. We selected 120 phone numbers from County owned phones (options A or C) and 30 for employees providing their own phone (option B). We performed reviews of individual bills in an effort to determine the appropriateness of each employee s service plan and compliance with the policy. The following procedures were performed: A walk-through was performed with key personnel in Information Technology and Accounts Payable to review current practices and procedures. Randomly selected cell phone accounts were tested for compliance with allowed usage during the billing period ending January 25, We analyzed 3 months of billings for County owned phones to determine if employees were enrolled in the most economical plan for their level of usage. We performed an examination and evaluation of the security of cell phone inventory. We interviewed management for employees who were noted to be texting on a non- Blackberry device to determine if texts were for County business purposes. We performed other audit testing and evaluations as considered necessary. The audit was conducted in accordance with Generally Accepted Government Auditing Standards. OVERALL EVALUATION In general, we found very few instances of employees violating the cell phone policy in regards to acknowledgement of responsibilities, allowable personal use and adherence to texting limits. Based on overall results of the audit, it is our opinion that opportunities to strength controls and procedures over cell phone issuance exist in following areas: Text messages and pictures are being transmitted on non-blackberry devices, which fails to meet public records requirements, and is in violation of the cell phone policy. Employees are not always on the most economical plan based on usage. Unnecessary costs have been incurred when unused cell phones are retained by a Division and not placed on standby or deactivated. Some employees are not in compliance with restrictions on personal use. Page 4 of 9

7 AUDIT OF COMPLIANCE WITH Opportunity for Improvement #1 Text messages and pictures are being transmitted on non-blackberry devices, which fails to meet public records requirements, and is in violation of the cell phone policy. We tested 90 employees for compliance with texting policy, noting the following exceptions: text messaging on non-blackberry device 7 users sending pictures via text on non-blackberry device 6 users both texting and pictures on non-blackberry device 5 users Per the policy, employees utilizing text messaging for County business must be approved by the County Manager s office and be issued a Blackberry device, in order to capture the text messages for the public record. We interviewed managers or supervisors for these 18 employees for whom we noted this condition, to determine if text messages were used for County business purposes. Reasons for texting or pictures per management: Business use of photos: facilities, utilities, fire rescue 5 Noisy environment 4 Immediate communication 3 Avoid causing noise/distraction to recipient employee 2 Utilities communication with equipment (alarms) 1 Incoming texts; employee does not respond 2 No longer employed 1 In 12 of 18 tested, text messaging appears be for a reasonable County purpose, such as maintenance of facilities or infrastructure, concerns of noise or distraction, noisy environment, documentation for public safety, and data transfer from equipment. The business rationale for 3 of 12 for immediate communication is unclear based on management s explanations but may be appropriate. Volume of texts: Less than More than As long as text or picture messages are for a County business purpose, then the main concern with employees texting without using a Blackberry device is failure to capture the message for public records. Page 5 of 9

8 AUDIT OF COMPLIANCE WITH Recommendation To comply with public records requirements, we recommend that the IT Division determine if there is a cost-efficient technology solution to capture text messages for non-blackberry devices. Division management must be conscious of the purpose of the public records requirement and assure that text messaging is truly serving a County business purpose. Management Response See management response attached at end of report. Page 6 of 9

9 AUDIT OF COMPLIANCE WITH Opportunity for Improvement #2 Employees are not always on the most economical plan based on usage. Each Division is responsible for reviewing the actual communications needs for employees in their areas and for annual auditing employees monthly calls to assure the proper allowance plan is in effect according to business call usage. Overall, 41% of the employees we tested were not on the most cost efficient plan for their usage. We noted the following opportunities to reduce costs: (1) For employees with voice-only plans (Options A or C, County owned phones), there were 2 choices that were commonly selected: 1,000 In-Network Mobile to Mobile (M2M) minutes at $10 base cost and 6 cents per minute for overages, with calls to land lines not included in the base cost, or 6 cents plan ($0 base plan and flat rate of 6 cents per minute of calling time, whether M2M or to land line). We tested 60 employees and 3 months of bills to determine cost efficiency. 79% of employees on the 1,000 M2M plan had numerous calls to land lines and would have saved $5 to $26 monthly on the 6 cents plan. 27% of employees on the 6 cents plan had high M2M minutes and would have saved $3 to $27 monthly on the 1,000 M2M plan. Generally, employees with less than 185 M2M minutes monthly would save on the 6 cents plan and those with more than 185 M2M minutes monthly would save on the 1,000 M2M plan. (2) For employees on option B (reimbursement plan), $30 for data plus $30 for voice is the lowest tier available. However, many employees stated they use their phone primarily for data ( ) with minimal calling minutes. 20% of employees tested had minimal voice usage for non M2M calls (30 minutes or less per month), and were reimbursed by the County at an average cost of $1.32 per minute, versus 13 per minute average cost for all employees in our sample. 10 of 30 employees tested had less than 100 business minutes but were reimbursed at $30 per month. 2 of 30 employees tested were being reimbursed at the $40 tier for voice calls, but had less than 500 business minutes and should have been on the $30 tier. (3) For employees with a data plan, 23 of 60 tested were not on the most economical plan. Of these, 10 did not have usage that would justify their current tier, and 13 could have saved money with a Buy-up option. Page 7 of 9

10 Recommendation Division management should annually audit usage by employees in their area and review available options to determine the most cost efficient plan for each staff member, based on County business needs. We recommend documenting this annual audit on a spreadsheet, including analyzing personal versus business use, average minutes (M2M vs. land lines), cost of plan and buy-ups, need for data, text and voice, and any other pertinent information. We recommend a lower voice reimbursement amount be offered for employees on option B with minimal voice/cell usage or who use phones primarily for data or . Due to an every-changing business environment, the County Manager should review the tiers for the stipend plan (Option B) at least annually to determine if change is needed. Management Response See management response attached at end of report. Opportunity for Improvement #3 Unnecessary costs have been incurred when unused cell phones are retained by a Department and not deactivated or placed on standby. We noted a number of phones with no data or voice usage during the audit period, but with a monthly service charge billed. Some phones were for on-call use, so there were few options to reduce costs for these phones. Other phones incurred unnecessary costs when an employee terminated but the phone was left active. When an employee leaves County employment, or a County owned phone is no longer needed for business purposes, the County owned phone can be returned to IT for deactivation. We determined that IT has good controls in place to assure that unused phones are not misappropriated. However, some Divisions have retained phones within the Division for later use by another employee, and failed to notify IT so the phone could be deactivated or placed on standby. Verizon can place unused cell phones with voice service on standby for 3 consecutive months for 17 cents per month. There is no such plan for data service; but these phones can be deactivated to avoid the monthly service charge. Recommendation If a Division wishes to retain a County phone within their area for later use, they should consult with IT to assure accountability for the phone and to evaluate options to minimize costs. Management Response AUDIT OF COMPLIANCE WITH See management response attached at end of report. Page 8 of 9

11 Opportunity for Improvement #4 Some employees are not in compliance with restrictions on personal use. While we noted few instances of employees not complying with restrictions on personal use, some exceptions were found. We tested one monthly invoice for a random sample of 120 employees: 60 with a County phone on a combination data/voice plan 30 with a County phone on a voice-only plan 30 receiving reimbursement for a person phone (23 data plan, 7 voice-only) Exceptions were as follows: 1 of 54 employees tested on Option A (County owned phone with no personal use) had 176 minutes of Mobile-to-mobile calls identified to us as personal calls. Due to the nature of his plan, there was no cost to the County for these minutes, but nevertheless this use is in violation of the policy. This employee originally was issued a cell phone prior to the revised policy and may not be aware that this use is in violation of the current policy. 2 of 6 employees tested on Option C (County owned phone with limited personal use) exceeded personal use limits, which in both cases was 25% of total minutes. One of the two reimbursed the County for the overage. The policy states that an employee who exceeds limits may be subject to disciplinary action and/or may be required to choose another option and/or no longer have a County cell phone. There is no option to reimburse in the policy. Employees are required to acknowledge that they have read the cell phone policy and will adhere to it before being issued a County owned cell phone. There is little justification for failing to comply with restrictions on personal use. Recommendation We believe these types of issues should be avoided by manager s review of monthly cell phone bills, as per the policy. We recommend each Division document their annual audit of employee cell phone, using spreadsheets to aid in analysis and recognition of significant trends or errors. We recommend all employees with phones, particularly those issued a phone prior to the current policy, annually sign a written acknowledgement that they have reviewed and will adhere to the policy. Management Response AUDIT OF COMPLIANCE WITH See management response attached at end of report. Page 9 of 9

12

13 Department of Inspector General Cell Phone IT Audit Response Inspector General Recommendation I To comply with public records requirements, we recommend that the IT Division determine if there is a cost-efficient technology solution to capture text messages for non-blackberry devices. Department/division management must be conscious of the purpose of the public records requirement and assure that text messaging is truly serving a county business purpose. BoCC Management Response I IT is meeting with cellular communication vendors and researching possible solutions to resolve the challenge of capturing text messaging. We currently have 2 options under consideration, have obtained preliminary pricing where applicable, and are working on timelines and implementation plans for each option to capture text on all County-owned smartphones. It must be noted that no single option we are researching is the perfect solution. The final solution may be a combination of both options. Option I (Short Term) Employee Manually Forwards a Text Message to Their BoCC . IT has developed a manual procedure for various model cell phones that if an employee receives a business text message, the employee can forward that specific text message to their BoCC Inbox. Once the text is sent to the employee s BoCC , it will be captured on our Public Record. IT will publish this process (and associated instructions) to all BoCC cell phone users (Options A, B, or C) upon direction of county management. Option II (Long Term) Acquire and Use a Third Party Software. Text Messages can be captured using a third party software through a company called TextGuard. Orange County, Florida is currently using this software. TextGuard software captures texts, picture messages, call logs and GPS location in real-time for Android and BlackBerry smartphones. However, TextGuard does not capture texts from iphones or nonsmartphones. This still represents a texting challenge for these cell phone users. Advantages of this solution include: Once the application is loaded on the smartphone, it is invisible to the end user.

14 The system integrates with any archive solution, so searching for texts is the same process as searching for an . One disadvantage of this solution is: If installed on personal cell phone of those staff who receive a stipend, their personal text will also be captured. If selected, TextGuard can be implemented in one of two different ways: A cloud based solution for a one-time cost of $4,750 and a recurring cost of $1,800 per month ($24,550 for the first year, $21,600 annually for all future years). TextGuard maintains all hardware and software off-site in this scenario. An on-premise solution for a one-time cost of approximately $25,000, and a recurring cost of $7,550 per year thereafter for software support. Polk County IT maintains all hardware in this scenario and must perform periodic updates to the software. (A complete TextGuard summary is available, if needed for review) BoCC Management Recommendation I BoCC Management will install Option I above for Plan B (stipend) cell phone users, and acquire and install TextGuard software for Plan A and C county owned cell phone users. Inspector General Recommendation II II.A. - Division management should annually audit usage by employees in their area and review available options to determine the most cost efficient plan for each staff member, based on county business needs. We recommend documenting this annual audit on a spreadsheet, including analyzing personal versus business use, average minutes, cost of plan and buy-ups, need for data, text and voice, and any other pertinent information. BoCC Management Response II.A. Management agrees with the recommendation to annually audit cell phone minute usage, especially buy-up options. This audit should include both staff and division directors signing off on their plan selection and approval. Verizon sends our monthly bills to the BoCC in an electronic PDF document that bundles all the lines/numbers together. Currently, this PDF document does not open up directly in Excel, so we

15 must implement some sort of automated software solution to import selected call data into a spreadsheet and then break them out by individual user s within each division. BoCC Management Recommendation II.A. BoCC Management will use internal IT staff to develop this spreadsheet application and train each division on its usage. We anticipate it will take us 30-days to develop this spreadsheet application. Upon completion, we will route the spreadsheet to all division directors and train them accordingly. Inspector General Recommendations II.B. II.B. - We recommend a lower voice reimbursement amount be offered for employees on Option B (stipend) with minimal voice/cell usage or who use phones primarily for . BoCC Management Response II.B. This shift from using a cell phone for voice use to data/ use is well documented within the industry and as a result cellular carriers are transitioning away from charging per-minute voice cell usage and are moving towards bundling in unlimited talk/text with their data service. This is similar to the practice of including unlimited long distance as a standard feature. Verizon, Sprint, and T Mobile now only offer smartphones with unlimited talk and text plans. Employees who currently receive a stipend will be forced to switch to unlimited voice plans when they renew their contracts. Currently the lowest monthly charges for a smartphone from each of the major carriers are as follows: Carrier Lowest New Voice Data Plan Available Monthly Charge Verizon Wireless Share Everything - Unlimited Voice, $100 + taxes and fees Restricted Data Sprint Unlimited My Way Unlimited Voice, $70 + taxes and fees Restricted Data AT&T Nation 450 w/rollover Minutes Voice $70 + taxes and fees Minutes, Restricted Data T Mobile Simple Choice Plan - Unlimited Voice, Restricted Data $72 + taxes and fees

16 If the County lowers their voice reimbursement tier rates, employees will not have a similar choice to lower their voice service from their carrier, so the employee will end up paying more of the bill. With this in mind, management must review current industry vendor offerings and determine an accurate stipend formula that currently fits with the industry offerings and employee business usage of voice and data. BoCC Management Recommendation II.B BoCC Management will meet with the Clerk s Department of Inspector General s Office to review the current vendor pricing modules and have them recommend a new percentage of payment (stipend) in line with IRS regulations. Inspector General Recommendation III If a Division wishes to retain a county phone within their area for later use, they should consult with IT to assure accountability for the phone and to evaluate options to minimize costs. BoCC Management Response III BoCC Management agrees with the Inspector General Recommendation III. Verizon Wireless does not charge the County to turn off, suspend service, or to activate new lines, so all unused phones should immediately have service disconnected until needed in the future. It is the responsibility of each division to notify IT to suspend or terminate cell phone service. BoCC Management Recommendation III BoCC Management will notify all BoCC Division Directors of this finding and required action. Inspector General Recommendation IV IV. A. - We recommend each department document their annual audit of employee cell phone, using spreadsheets to aid in analysis and recognition of significant trends or errors.

17 BoCC Management Response IV.A. Per policy, each cell phone bill is to be reviewed by both the employee and their supervisor. It is up to the supervisor to monitor if the employee is using the phone for extended personal use, and to take appropriate action with the employee when necessary. BoCC Management Recommendation IV.A. BoCC Management will use the spreadsheet application in Recommendation II A above, and have each division director review and have their employees sign off on their cell phone use on a reoccurring / annual basis. Inspector General Recommendation IV.B. IV. B. - We recommend all employees with phones, particularly those issued a phone prior to the current policy, annually sign a written acknowledgement that they have reviewed and will adhere to the policy. BoCC Management Response IV.B. We agree with the audit recommendation. When the County transitioned to the current cell phone plan, IT met with each division to educate staff and have them sign off acknowledgment of the details of each plan. BoCC Management Recommendation IV.B BoCC Management will implement an SOP to have employees sign off/acknowledge the cell phone policy during an annual review. (See Spreadsheet Recommendation in Items II A and IV B above).