INTERNAL AUDIT REPORT OPERATIONAL AUDIT CASH CONTROLS - SEA-TAC PARKING GARAGE JANUARY 2018 - AUGUST 2018 ISSUE DATE: SEPTEMBER 14, 2018 REPORT NO. 2018-10 INTERNAL AUDIT Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 TABLE OF CONTENTS EXECUTIVE SUMMARY ................................................................................................................................................. 3 BACKGROUND .............................................................................................................................................................. 4 AUDIT SCOPE AND METHODOLOGY ........................................................................................................................... 5 SCHEDULE OF FINDINGS AND RECOMMENDATIONS............................................................................................... 6 APPENDIX A: RISK RATINGS ........................................................................................................................................ 7 2 Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 EXECUTIVE SUMMARY Internal Audit performed an audit of Cash Handling controls at the Sea-Tac Parking Garage for the period January 1, 2018 to August 15, 2018. The audit was performed to evaluate the efficiency and effectiveness of the internal controls and related policies and procedures. We concluded; that in general, the Landside Operations staff is handling and accounting for parking cash receipts appropriately. For the period January 1, 2018 through August 15, 2018, cash transactions totaled approximately $2 million, which represent approximately four percent of total parking receipts of $54 million. Cash is the most liquid of assets and is susceptible to loss if not properly controlled. Therefore, it is extremely important to assure that strong internal controls are built around the cash process and that these controls are functioning as intended. We identified opportunities, to further strengthen controls. The opportunities reflected below, are also discussed in more detail on page six of this audit report: Opportunities exist to enhance access controls to the cash counting room and to reduce the amount of the $20,000 change fund. We extend our appreciation to Port management and the staff of Airport Operations for their assistance and cooperation during this audit. Glenn Fernandes, CPA Director, Internal Audit RESPONSIBLE MANAGEMENT TEAM Lance Lyttle, Managing Director Aviation Mike Ehl, Director Airport Operations Jeff Hoevett, Sr. Manager Airport Operations 3 Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 BACKGROUND The Seattle-Tacoma International Airport (STIA) Parking Garage is owned and operated by the Port of Seattle, a municipal corporation, organized under statutory authority of the State of Washington. The garage is the largest parking facility in the region with more than 13,000 stalls. The garage offers General parking and Terminal Direct parking. General parking is available on floors one through three and five through eight. Terminal Direct parking is available on the fourth floor and provides direct access to the main terminal via sky bridges at a slightly higher cost. The toll booths are operated by 19 cashiers and 14 supervisors. Annually, the staff processes 2.1 million public parking transactions, for which credit cards are most often used. As of August 15, 2018, the Port collected parking cash receipts of $2 million. This represented about four percent of the total parking receipts which were $54 million. The table below reflects the cash and credit card receipts for the current and prior year: PARKING RECEIPTS - SEA-TAC PARKING GARAGE PERIOD * CASH RECEIPTS CREDIT CARD RECEIPTS TOTAL PARKING RECEIPTS 2018 (January 1 - August 15) $2,036,311 $51,944,002 $53,980,313 2017 (January 1 - December 31) 3,311,769 77,862,735 81,174,504 TOTAL $5,348,080 $129,806,737 $135,154,817 Data Source: PeopleSoft Financials The focus of this audit was on the cash handling procedures at the STIA Garage. Cash handling encompasses the controls and processes to account for and safeguard monies received in cash or check. It also includes the change funds that the cashiers use to make change for customers who pay with cash as well as petty cash funds, which are used for disbursing cash for small incidental expenses/refunds. To minimize the risk of theft and fraud, it is essential that controls are in place. According to RCW 43.09.240; every public employee, whose duty is to collect or receive payments due or for the use of the public, shall deposit such moneys collected or received once every 24 hours. 4 Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 AUDIT SCOPE AND METHODOLOGY We conducted this audit in accordance with Generally Accepted Government Auditing Standards and the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The period audited was January 1, 2018 through August 15, 2018. We utilized a risk-based approach from the planning phase to the testing phase of our audit. We gathered information through document requests, research, interviews, observations, and analytical procedures. We assessed significant risks and identified controls to mitigate those risks. Our audit included the following procedures: Cash Handling: • • • • • • • Performed walk throughs to gain an understanding of cash handling procedures. Verified that access to cash drawers in the cash room was restricted. Obtained an understanding of how unreadable and lost tickets are processed. Gained an understanding of the parking validation process. Evaluated segregation of duties. Judgmentally selected 12 daily cash reconciliations to understand how variances were identified and resolved. Evaluated the design and operating effectiveness of internal controls. Policies and Procedures: • • Reviewed the policies and procedures and verified they were being followed by cashiers and supervisors. Verified policies and procedures agreed with industry best practices. Safeguarding Cash: • • Evaluated physical access to the safe. Observed the Loomis cash pick up process. 5 Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 SCHEDULE OF FINDINGS AND RECOMMENDATIONS 1) RATING: MEDIUM Opportunities exist to enhance access controls to the cash counting room and to reduce the amount of the $20,000 change fund. An access code is required to enter the cash counting room. The code has not been changed in over six months nor is it changed on a recurring schedule. This poses a risk of unauthorized access entry. To establish a $300 daily fund balance for each of the approximately 20 cashiers for their cash registers, a minimum of $6,000 is required. However, currently $20,000 is maintained as a change fund, which appears excessive. Additionally, maintaining a high cash balance on hand also increases other risks. Recommendation: The code should be changed as soon as an employee no longer needs access. At a minimum, the code should be changed at least once every three months to help prevent the code from being used by unauthorized employees. Although more costly, consideration should be given to implementing a card reader for the cash room. The benefits include the ability to track an individual's access in and out of the facility and to be able to immediately remove access when an employee transfers between functions or ends his or her employment with the Port. Airport Operations should reduce the cash working fund to a more reasonable amount. Management Response/Action Plan: Counting Room Door: A work order was submitted and the door code was changed as of September 10, 2018. We have placed a reminder on our calendars to have the code changed every three months. A work order has been submitted to have a card reader installed on the counting room door. Reducing the change fund: We will reduce the change fund by $4,000 and evaluate how this amount works with the operation. The fund is used not only for daily cashier working funds but also used to exchange large bills, that cashier have received throughout the day, into $1 & $5 bills. Those large bills are then exchanged by the bank back into $1 & $5 bills. We'll continue to evaluate the appropriate change fund based on business activity. 6 Cash Controls - Sea-Tac Parking Garage January 2018 - August 2018 APPENDIX A: RISK RATINGS Findings identified during the course of the audit are assigned a risk rating, as outlined in the table below. The risk rating is based on the financial, operational, compliance or reputational impact the issue identified has on the Port. Items deemed "Low Risk" will be considered "Exit Items" and will not be brought to the final report. Rating Financial Internal Controls Compliance Missing, or inadequate key internal controls Noncompliance with applicable Federal, State, and Local Laws, or Port Policies Large financial impact HIGH Remiss in responsibilities of being a custodian of public trust Partial controls MEDIUM LOW/ Exit Items Efficiency Opportunity Moderate financial impact Not adequate to identify noncompliance or misappropriation timely Inconsistent compliance with Federal, State, and Local Laws, or Port Policies Public High probability for external audit issues and/or negative public perception Potential for external audit issues and/or negative public perception Port Commission/ Management Important Requires immediate attention Relatively important May or may not require immediate attention Generally Low probability complies with for external audit Federal, State and Lower significance Low financial issues and/or Local Laws or Port impact negative public Policies, but some May not require perception Implementing/enhancing minor immediate attention controls could prevent discrepancies future problems exist An efficiency opportunity is where controls are functioning as intended; however, a modification would make the process more efficient Internal controls in place but not consistently efficient or effective 7