Executive Summary: Internal Audit Report # Revenue Collections & Controls January 12, 2011

Transcription

1 Executive Summary: Internal Audit Report # Revenue Collections & Controls January 12, 2011 Organization Impact Audit Objective & Scope The primary objective of this audit was to evaluate the adequacy of controls over the collection, processing, and depositing of bus and rail fare and media sales revenues. The audit scope included a review of procedures and controls in departments and functions that can impact this objective, namely the Finance Department, Transit Store and Vehicle Maintenance functions at StarTran as well as Authority contractors, Veolia, First Transit and Capital Area Rural Transportation System (CARTS). Since physical and logical controls over revenue functions were also evaluated, related Security and Information Technology Department processes were also included. Overall Conclusions Treasury Operations Capital Metro s Treasury, located at the 2910 headquarters, is responsible for counting and processing cash from bus fareboxes and rail TVM s, which, together, totaled nearly $5.2 million in FY2010. The Treasury also maintains the fare media inventory and fulfills online ticket and pass orders. Overall, the Treasury s fare revenue procedures and controls are adequate; 1 however opportunities exist to strengthen compliance with established policy and procedures. 1 At Capital Metro, these controls include an electronic badge system which restricts access to the money room. Treasury clerks also wear pocket-less uniforms when processing cash and their activities are remotely monitored by both Security and the Revenue & Fares Manager. Once the cash is counted and processed for deposit, armored car contract

2 One of the most important revenue controls, reconciling fare collections, serves as both a preventive and detective control. An effective reconciliation process can deter and identify a potential misappropriation of farebox receipts. The Revenue & Fares Manager performs a daily revenue reconciliation of the currency counted by the Treasury clerks to the revenues reported by the GFI Cashbox Audit Report. In FY2010, the overall reconciliation variance was only 0.01 percent, well below the established variance threshold of 1.0 percent, although daily reconciliation variances were often much higher. While daily variances were identified and investigated, a documented monthly review of the reconciliation and the supporting explanation for the identified variances does not take place, as per existing Treasury procedures. Fare media has an intrinsic cash value and should also be closely controlled like currency. The Treasury performs quarterly fare media inventory counts. However, these counts and resulting adjustments are not documented and retained. Furthermore, an independent review and approval of the fare media inventory reconciliation and adjustments have not been performed. To address this, the Controller and Revenue & Fares Manager will develop and implement a formal fare media inventory procedure by February 28, Other opportunities to strengthen Treasury operations include requiring at least two employees to be present in the Treasury count room when processing currency and ensuring compliance with Human Resource policy HRC-440 which requires security sensitive employees take at least five consecutive days of leave each year. Transit Store Operations The Transit Store, a part of the Business & Community Development (BCD) Department, sells tickets and passes from its downtown location on Congress Avenue. FY2010 ticket revenue totaled $400,100 of which approximately 46 percent was cash sales. Because the revenue functions of the Transit store are similar to that of the Treasury, equivalent procedures should be in place. However, adequate controls have not been implemented to account for Transit Store ticket and pass sales and to prevent or detect the misappropriation of cash receipts and fare media. Most significantly, an effective reconciliation of ticket sales to cash collections does not exist. Additionally, the Transit Store does not have a process in place to manage fare media inventory. Therefore, Internal Audit could not determine if all cash and fare media were properly accounted for. In order to mediate these conditions, the Revenue & Fares Manager will develop cash and fare media controls and provide training to the Transit Store Supervisor and Customer Service Representatives (CSR s) by February 28, Unnecessary access to the Transit Store safes as well as untimely revenue deposits was also noted during the review. Most of the safes in the Transit Store are drop-safes, which do not require access by Transit Store CSR s. Only managers and supervisors need access to perform daily reconciliations of the cash that the Transit Store CSR s drop into the safe. Furthermore, during a six-month sample period, Transit Store cash receipts were often held more than a week before making a bank deposit, thus unnecessarily increasing the amount of revenues at risk. personnel transport it from the Treasury to the banking institution. Annual background/credit checks have also been performed on all Treasury personnel CAPITAL METRO REVENUE COLLECTIIONS & CONTROLS AUDIT #10-08 PAGE 2 OF 6

3 A review of the Transit Store s security surveillance revealed the existing cameras do not have the features necessary for effective remote monitoring. Since the Transit Store Supervisor is not physically located at the store, this capability is even more important. To address this, new cameras will be installed in January 2011 which can be monitored by the both the Transit Store Supervisor and the Revenue & Fares Manager. Lastly, like the Treasury clerks, the Transit Store CSR s are security sensitive employees and are required to have background/credit checks and take five consecutive days of leave each year. FY2010 background checks were successfully performed. However, annual leave requirements have not been consistently enforced. BCD management will add Human Resource policy compliance as part of the mid-year and annual Performance Management Plans. General Revenue Management & Administration The recently approved Capital Metro Fare policy and draft Budget and Financial Planning Policy lay the groundwork for future revenue administration. The fare policy recognizes that fare revenue is a critical component of Capital Metro s operating budget and lists Maintain/ Increase fare revenue stream as one of the primary policy objectives. While managing fare evasion is one means to help achieve this objective, a defined strategy or consistent controls for controlling fare evasion does not exist. A 1997 TCRP report Synthesis of Transit Practice 26: Bus Transit Fare Collection Practices found that very few survey respondents gave information regarding the estimated revenue loss from fare evasion. Shown as a percentage of total revenue, the range was from one to five percent lost through fare evasion. Of the agencies that responded, these percentages were merely educated guesses. The report also noted that very few survey respondents indicated that they perform trend analysis or other planning exercises to identify and deal with fare collection policy problems. Fare evasion is the transit industry s shoplifting. To effectively manage revenues, management must consider this reality. At Capital Metro, a one to five percent fare evasion rate equates to $122,254-$611,271 of lost revenue each year. 2 To address this, the Revenue & Fares Manager in consultation with Operations staff, will define a preliminary threshold for acceptable fare evasion. The Finance Department will then use data from the commuter rail enforcement program as well as the results of fixed route mystery riders to project, and ultimately manage, the estimated cost of fare evasion at the Authority. Lastly, Capital Area Rural Transit Services (CARTS) provides contracted rural bus services on three routes. 3 In late FY2008, the CARTS shuttle buses were retired and, without consulting the Finance Department, a decision was made to not install fareboxes in the replacement vehicles. Hence, since FY2009, CARTS has not been collecting passenger fares. 2 The approved FY2011 operating budget includes $12,225,410 in passenger fare revenue. In addition to the TCRP study, a more recent (2008) Price Waterhouse Coopers audit of fare evasion at TransLink, British Columbia, described the rate of trips involving evasion 2.5 per cent as moderate although the report noted that there is no comparable benchmark. At Capital Metro, a 2.5 percent moderate level of fare evasion rate would be approximately $306,000. Source: 3 Current routes include 214:Lago Vista Feeder, 271: Del Valle Flex, and 990: Northeast Express. If approved by the City in the future, CARTS would also provide limited bus services to Cedar Park residents. CAPITAL METRO REVENUE COLLECTIIONS & CONTROLS AUDIT #10-08 PAGE 3 OF 6

4 Assuming a $1 single ride base fare, forgone FY2009 and FY2010 revenues are (at most) $74,614 for CARTS operated routes. To address this, a resume to begin revenue collections will be developed by May 1, Fare Revenue Collections Fare revenue collection controls include physical and logical security as well as the maintenance of the supporting revenue systems and components. These fundamental elements all impact the ability to securely collect and accurately account for passenger fare revenues and are addressed below. Security lighting & cameras at probing stations The process to collect bus revenue and capture ridership data is typically referred to as probing. During this process, cash is inaccessible to the Service Island personnel. At Capital Metro headquarters there is adequate security. Surveillance cameras are installed at the probing station and the camera images are monitored by security personnel located at the 624 Pleasant Valley location. Veolia, a Fixed Route Services (FRS) contractor, collected over $1 million in farebox revenues in FY2010. Unlike headquarters, the Veolia probing stations do not have surveillance monitoring. The Finance Department is currently researching whether federal dollars are available and can be used to fund security capital improvements. If so, a security camera implementation plan and timeline will be prepared by the Security Department. First Transit, the UT shuttle route contractor operating out of the North Operations facility, collected almost $52,000 in FY2010, substantially less than either Veolia or StarTran. At present, the North Operations probing station does not have direct lighting or surveillance cameras. However, because First Transit will be the Bus Rapid Transit (BRT) operator and is anticipated to collect significantly more revenue, the BRT project plan includes funding for future security improvements. Control of sensitive parts & keys Keys and other sensitive parts associated with both the GFI Data System 7 and Indra Fare Collection Server System (FCSS) should be more closely controlled. At present, there is an incomplete accounting for the various keys and devices through which individuals can access the GFI fareboxes, vaults, and other security-sensitive components. According to Genfare, Inc., the equipment manufacturer, a very important part of GFI equipment security is a closely monitored key control program. No matter how secure the locks and keys may be, if unauthorized personnel have access to keys, they will have access to the collected revenues. At least one prior farebox theft at Capital Metro was enabled, in part, due to poor inventory controls over sensitive GFI parts. To resolve this, the Vehicle Maintenance Electronics Coordinator will perform monthly key inventories and, twice per year, the Interim Security Manager will conduct and document a full inventory of all existing security-sensitive keys and components. Fixed Route contractors Veolia and First Transit will also implement comparable procedures. To further limit the risk of theft, the Vehicle Maintenance Department will restrict use of the devices which clear the memory on farebox equipment CAPITAL METRO REVENUE COLLECTIIONS & CONTROLS AUDIT #10-08 PAGE 4 OF 6

5 and will require that all vehicles be probed and vaulted prior to performing any electronics maintenance. The audit also identified several electronic key cards which allowed excessive or unnecessary logical access to the MetroRail TVM s including the internal revenue vaults. Because the Indra TVM implementation project has not been formally closed, the Information Technology (IT) Department s periodic access confirmation has not been performed for this system, and these electronic cards have remained active. The Revenue & Fares Manager will identify needed access changes by February 28, Beginning in Spring 2011, Indra FCSS accounts will be included as part of the IT Department s regular account confirmation process. Review of GFI Farebox Security Report: Closely related to key control is the need to monitor and follow-up on conditions and alarms which can signal a potential security breach. The GFI Farebox Security Report lists all detectable security violations. However, this report has not been regularly reviewed. Beginning in December, the VM Electronics Coordinator started daily monitoring of GFI security alert notifications to ensure that all are connected to an approved maintenance activity in the Spear work management system. Comparable procedures for reviewing and investigating reported GFI security notifications will also be implemented by both Veolia and First Transit. Preventative Maintenance of Revenue Collection Equipment: Properly maintaining all revenue equipment increases the security of fare collection operations and protects the integrity of the data coming from the fare collection system. The prior farebox theft at Capital Metro was also partially enabled because of inaccurate data generated by poorly maintained GFI equipment. In FY2010, 38.4 percent of all quarterly electronics preventative maintenance (PM) inspections on GFI fareboxes were not performed timely including some PM s that were skipped entirely. 4 Preventative maintenance on the GFI vaults and receivers was discontinued three years ago following the last one which was completed on November 18, Reports from the Indra system showed maintenance of the TVM's has been performed in a timely manner. Untimely or skipped electronics inspections may result in farebox malfunctions and increase the number of road calls for repairs. Some data errors, reconciliation differences, and alert notifications may stem from defective GFI equipment which should be addressed by routine preventative maintenance. To rectify these conditions, the VM Electronics Coordinator will perform monthly reviews of electronics inspection work orders to monitor timeliness and quality. For additional oversight, the Revenue & Fares Manager will also receive a monthly report on the maintenance status of GFI farebox, vault, and receiver equipment. First Transit, one of the Authority s fixed-route service providers, assumed farebox preventative maintenance responsibilities in December Veolia, another contractor, currently uses its own system to manage and document transit bus fleet farebox maintenance activities. However, no one at Capital Metro has been assigned responsibility for monitoring compliance with required farebox maintenance. Beginning in January 2011, both contractors 4 Data is from the audit sample period October 1, 2009 through September 30, CAPITAL METRO REVENUE COLLECTIIONS & CONTROLS AUDIT #10-08 PAGE 5 OF 6

6 will report on the compliance and timeliness of farebox PM inspections and StarTran Quality Assurance personnel will spot-check maintenance records to confirm. Acceptance Signature on File Frank Fernandez Chair, Finance & Audit Committee Signature on File Linda S. Watson President / CEO cc: Capital Metro Board of Directors Capital Metro Leadership Team CAPITAL METRO REVENUE COLLECTIIONS & CONTROLS AUDIT #10-08 PAGE 6 OF 6