State Technology Audit (Draft)

Audit Report Summary

Audit of the State Technology Office within the Department of Management Services 

For the Period July 1, 2000 Through September 30, 2001 and Selected Actions Prior to July 1, 2000 

This audit report summary is intended to present the findings for our report in a condensed fashion. The entire report should be read for a comprehensive understanding of our audit findings.


SCOPE 

The scope of our audit focused primarily on State Technology Office (STO) operational functions that incurred large disbursements. The scope of the audit also focused on evaluating various other systems of internal control for the STO and other state entities with information technology expenditures. (see paragraph 2)

OBJECTIVES 

The overall objective of the audit was to evaluate the STO's accountability and financial integrity with respect to the disbursement of state funds. This included: 1) Evaluating the STO's performance in administering assigned responsibilities in accordance with applicable laws, rules and other guidelines. 2) Determining the extent to which the system of internal control promotes and encourages the achievement of management's objectives in the categories of compliance with applicable laws, administrative rules and other guidelines; the economic and efficient operations; the reliability of financial records and reports; and the safeguarding of assets. 3) Providing management with information and findings to assist in evaluating their systems of internal control relevant to the STO. (see paragraph 3)

METHODOLOGY 

Pursuant to Section 17.04, Florida Statutes, we utilized generally accepted auditing procedures to provide a reasonable basis that state funds were appropriately spent. We examined, on a test basis, evidence supporting transactions which occurred and actions taken by various members of management, performed analytical procedures, reviewed appropriate laws, rules, and other guidelines, and evaluated the pertinent systems of internal control. (see paragraphs 4 through 5)

REPORT FORMAT 

Because the STO was involved in the IT decisions of several state agencies, the audit report is divided into three major sections. Audit findings 1 through 5 discus major statewide issues involving information technology contracts and procurement. Audit findings 6 through 25 discuses STO specific issues, including budgeting, contracting and activities not authorized by law. Finally, audit findings 26 through 28 discuses specific STO IT related issues in other state agencies. 

FINDINGS IT 

1. Section 17.04, Florida Statutes, authorizes the Comptroller of the state to examine, audit, adjust and settle the accounts of all the officers of this state and any other person in anywise entrusted with, or who may have received any property, funds or moneys of this state. In accordance with this authority, we have performed an operational compliance audit of the State Technology Office (STO) within the Department of Management Services (DMS), and also certain technology contracts in other agencies.
2.  
3. The nature and diversity of the STO precluded an examination of all aspects of the STO on a timely basis. The scope of our audit focused primarily on STO operational functions that incurred large disbursements. The scope of the audit also focused on evaluating various systems of internal control for the STO and other state entities with information technology expenditures. The audit period was primarily July 1, 2000, through September 30, 2001, and also included selected actions taken prior to July 1, 2000. Our audit sample included $59 million out of $763 million information technology disbursements for eight state agencies, as follows:
4.  

1.  
2. The overall objective of the audit was to evaluate the STO’s accountability and financial integrity with respect to the disbursement of state funds. Additionally, due to the STO being involved in procurement and contracting decisions of several state agencies, a secondary objective of the audit was to evaluate, on a statewide basis, information technology procurement and contract management. This included:

1. Pursuant to Section 17.04, Florida Statutes, we utilized generally accepted auditing procedures to provide a reasonable basis that state funds were appropriately spent.
2.  
3. As a part of our audit, we examined, on a test basis, evidence supporting transactions which occurred and actions taken by various members of management, performed analytical procedures, reviewed appropriate laws, rules, and other guidelines, and evaluated the pertinent systems of internal control.

 

BACKGROUND

4. Effective July 1, 2000, Chapter 2000-164, Laws of Florida, provided for the creation of the State Technology Office, administratively placed within the Department of Management Services, which is headed by a Chief Information Officer (CIO) appointed by the Governor. Additionally, effective July 1, 2001, Chapter 2001-261, Laws of Florida, provided for the STO to become a state agency.
5.  
6. The powers, duties and functions of the STO are enumerated under Section 282.102, Florida Statutes. Some of these duties and functions are described below:
7.  

1. Section 216.272, Florida Statutes, provides for the creation of working capital trust funds for the purpose of providing sufficient funds for the operation of data processing centers. Section 216.272(2), Florida Statutes, provides that the funds allocated shall be in an amount sufficient to finance each center’s operations. However, each agency served by a center shall contribute an amount equal to its proportionate share of cost of operating such data processing center. Each agency utilizing the services of the data processing center shall pay such moneys into the appropriate working capital trust fund on a quarterly basis or such other basis as may be determined by the Executive Office of the Governor.
2.  
3. The STO uses the Electronic Data Processing (EDP) and Communications Working Capital Trust Funds to account for data processing and SUNCOM services respectively. These funds are described below:
4.  

1.  
2. Additionally, the STO receives general revenue and other trust fund revenues that are described below:

STATEWIDE ISSUES

1. Contract Amount

2.  
3. FINDING NO. 1
4. There was not always adequate documentation to support how state agencies arrived at a total contracted amount when using state term contracts for Information Technology (IT) consulting services.
5.  
6. State agencies generally contract with IT consultants to provide 1) routine day-to-day IT related operations, 2) information related reports, and 3) project specific services. Contracting agencies are responsible for preparing a statement of work/requirements for submission to the contractor and negotiating a contract which should include at a minimum: specific deliverables, personnel assigned, time period commitments and costs. This information should agree to the state term contract.
7.  
8. A memorandum issued by the DMS, Division of State Purchasing on July 25, 2000, provided that state agency purchasing officers should seek competition between IT consulting vendors. The memo further stated that the consulting vendor rates published in the contracts were ceiling rates and to the extent practicable, state agencies should negotiate lower rates depending on the complexity and duration of a project.
9.  
10. Our audit test indicated that 9 of 60 (15%) contracts for IT consulting services did not provide adequate detail as to how the contracted amount was determined. We noted instances where there was neither a cost breakdown of services performed by job positions with the applicable rates nor documentation to support the determination of the hours used in computing the contracted amount.

RECOMMENDATION NO. 1

11. We recommend that the DMS, Division of State Purchasing, in consultation with the STO promulgate standards which should include in detail the determination of hours required and the hourly rates utilized in computing the total contracted amount.

Contract Deliverable Provision

FINDING NO. 2

12. IT consultant contracts did not always have units of deliverables, milestones or a clear definition as to what was to be produced.
13.  
14. The DMS, Division of State Purchasing awarded state term contracts for IT consulting services on a nonexclusive basis to qualified vendors. This is similar to having a pool of pre-qualified vendors where state agencies may select a vendor by issuing a purchase order for services. This methodology allows for very general deliverables in the state term contract and flexibility for all state agencies to procure with more specific requirements on purchase orders.
15.  
16. Our audit test indicated that 19 of 62 (31%) contracts for IT consulting services did not have deliverables that were measurable, quantifiable or statements as to what was supposed to be produced. This problem was further compounded when vendor invoices were submitted to the state for payment without sufficient detail to discern the services provided. In many instances, we noted vendor invoices with a statement "Please remit for professional services rendered."
17.  
18. As a result, the propriety of services rendered becomes questionable. It also becomes difficult to determine the vendor’s responsibility, resulting in difficulty in holding the vendor accountable for performance.

RECOMMENDATION NO. 2

19. We recommend that the DMS, Division of State Purchasing and the STO promulgate standards for state agencies to use in writing contracts that include units of deliverables, milestones or a clear definition as to what is supposed to be produced.

STATEWIDE CONTRACT MANAGEMENT

20. Contract management involves the administering and monitoring of contract requirements to ensure accountability and compliance with program requirements. Every organization that enters into contracts with vendors has the responsibility to establish a methodology to achieve these objectives. This is most often accomplished through the establishment of written policies and procedures.
21. An effective contract management policy should include maintaining files and records to adequately support the performance of the contractors and provide accountability for the funds disbursed. It should also provide assurance that all activities are performed in accordance with contract terms and that the state is obtaining best value.
22.  
23. The monitoring of contracts should be performed according to a set of criteria and guidelines that should include, but not be limited to:

1. Our audit noted that the IT contract files did not always contain adequate documentation to support monitoring activities.
2. Our review of 18 IT contract files totaling $19.6 million indicated the following:
3.  

1. We recommend that the DMS, Division of State Purchasing and the STO promulgate standards for state agencies to follow in the IT contract management process. We also recommend that the procedures include documentation to support all monitoring activities performed by the contract manager.

FINDING NO. 4

2. IT consulting services payments did not always have documentation sufficient in detail to support the disbursement of funds.
3. Our review of 102 IT consulting services payments totaling $21.25 million indicated the following:

RECOMMENDATION NO. 4

1. We recommend that the STO promulgate standards for maintaining documentation in sufficient detail to determine that the disbursement of funds is made in accordance with contract terms. In addition, documentation should ensure goods or services are satisfactorily provided and payments are properly authorized by the contract manager.

Contract Authorization and Renewal

FINDING NO. 5

2. Procurement files maintained by the DMS, Division of State Purchasing did not always contain adequate documentation to support the required contract authorizations and actions taken for contract renewals as provided by Florida law.
3.  
4. Prior to the execution of a contract, the agency’s management should review and sign the contract indicating their acceptance of the terms of the contract. Section 287.057 (18), Florida Statutes, requires that each agency establish a review and approval process for contractual services contracts costing more than $50,000 that includes program, financial and legal review and approval. In addition, Section 287.058(2), Florida Statutes, requires that written agreements be signed by the agency head and the contractor prior to the rendering of any contractual service.
5.  
6. For contract renewals, Section 287.057 (13), Florida Statutes, requires that contractual service contracts may be renewed in writing on a yearly basis for no more than two years or for a period no longer than the original contract, whichever period is longer. It requires that renewals be contingent upon satisfactory performance evaluations by the agency.
7.  
8. Our review of 17 DMS, Division of State Purchasing procurement files indicated the following:
9.  

RECOMMENDATION NO. 5

1. We recommend that the DMS, Division of State Purchasing obtain authorizations for contracts and renew contracts in accordance with Florida law.
2.  

STATE TECHNOLOGY OFFICE

Organizational Structure

FINDING NO. 6

3. The STO did not establish an organizational structure with clear lines of authority and responsibilities within organizational units. As a result, the internal control system was significantly compromised.
4.  
5. As part of the internal control environment, it is important for every organization to establish an organizational structure to provide clear lines of authority and responsibilities within organizational units. Although some lines of authority carried over from DMS, the STO was a conglomeration of DMS employees, independent contractors, other state agency employees and contracted employees from the State University and Community College Systems. Our audit noted that there was no clear line of authority and responsibility.
6.  
7. Evidence obtained from the audit indicated miscommunication among individual employees and organizational units. In addition, operating processes and workflow were not always consistent. This contributed to the ineffectiveness and nonexistence of certain key internal controls that were essential for maintaining accountability.

RECOMMENDATION NO. 6

8. We recommend that the STO implement an official organizational structure that establishes clear lines of authority and responsibility within a system of internal control. Additionally, the clear lines of authority and responsibility should be communicated to all employees.
9.  

Delegation of Authority

FINDING NO. 7

10. The STO did not provide a written delegation of authority to individuals who entered into contracts on behalf of the STO. As a result, some of the STO contracts were not properly executed.
11.  
12. Section 282.102(10), Florida Statutes, authorizes the STO to enter into agreements for the support and use of information technology services of state agencies and political subdivisions of the state. We noted 5 contracts totaling $2.11 million where individuals within the STO entered into written agreements without a written delegation of authority from the state CIO. In 1 of the 5 instances noted, a contract employee entered into a written agreement for $1.2 million on behalf of the STO.

RECOMMENDATION NO. 7

13. We recommend that the state CIO establish a written delegation of authority clearly identifying the individuals authorized to enter into written agreements on behalf of the state CIO.

No Written Agreement

 

FINDING NO. 8

14. The STO authorized the disbursement of funds to some vendors without a valid written agreement.
15.  
16. Section 287.058(1), Florida Statutes, requires contracts in excess of $25,000 to be evidenced by a written agreement. This also represents effective internal control.
17.  
18. Our review of 25 contracts totaling $12 million indicated the following:

RECOMMENDATION NO. 8

1. We recommend that the STO take actions to ensure compliance with Florida law and that all contracts in excess of $25,000 and contract extensions and amendments be in writing.

Contract Provisions

2. FINDING NO. 9
3.  
4. Our audit noted STO contracts did not always have a defined deliverable.
5.  
6. Section 287.058(1)(d), Florida Statutes, provides that each procurement of contractual services in excess of $25,000 shall contain a provision for dividing the contract into units of deliverables.
7.  
8. Our review of 14 contracts totaling approximately $5.44 million indicated that 5 (36%) did not expressly state deliverables that were quantifiable, measurable or had an end result. As a result, there is limited assurance that the state is obtaining substantial performance for money spent.

RECOMMENDATION NO. 9

9. We recommend that the STO write contracts which adequately detail the required deliverables.

FINDING NO. 10

10. STO employee leasing contracts with the Tallahassee Community College (TCC) had vague and missing contract terms. As a result of a contract dispute with TCC, the STO may have paid an amount greater than what was originally intended.
11.  
12. The STO entered into contracts with the TCC to lease two employees. Neither of these contracts contained an adequate description of the conditions and resources provided by the TCC. For one of the contracts, the STO paid $27,257 more than it had anticipated in the written cover letter. We noted the following for this contract:

1.  
2. Without clearly stated contract terms, it is difficult to determine the requirements of the contracting parties. Disputes could arise that would be difficult to resolve. Good business practices dictate that contract terms be stated clearly and in sufficient detail.

RECOMMENDATION NO. 10

3. We recommend that all contracts entered into by the STO contain clear and concise language to adequately describe, in detail, the terms and conditions of the contract.

Receipt of Goods and Services

FINDING NO. 11

4. The STO vendor invoices did not always have a documented approval for payment or an acknowledgement from the person with direct physical knowledge that goods or services were satisfactorily received.
5.  
6. The STO documents the receipt of goods or services either on a receiving report copy of the purchase order or with a signature and date on the vendor invoice. Our audit noted 22 of 45 invoices (49%) did not indicate approval for payment by a person who had direct physical knowledge that the contract deliverables were satisfactorily received. We also found 2 (4%) payments did not contain authorized signatures approving the vendor payment. Examples include:

1. By not following this procedure, the STO greatly increases the likelihood of improper payments or payment for goods and services not satisfactorily received.

RECOMMENDATION NO. 11

2. We recommend that the STO establish written procedures requiring the approval of all goods or services for payment by individuals having direct physical knowledge that the goods or services were satisfactorily received. Additionally, these documented acknowledgements should be signed and dated.

STO CONTRACT MANAGEMENT

3. As previously stated, contract management involves the administering and monitoring of contract requirements to ensure accountability and compliance with program requirements. An effective contract management policy includes maintaining files and records that adequately document monitoring activities. This would include corroborating submitted reports and documents and the procedural actions taken to verify and conclude contract deliverables.
4.  
5. In addition, a contract management policy should describe the types of source documentation that is required to support the disbursement of funds. The documentation should be sufficient in detail to determine whether the payment was made in accordance with contract terms, whether the goods or services were satisfactorily provided and whether the payments were properly authorized.

STO Contract Monitoring

FINDING NO. 12

6. The STO’s documentation to support payment was not always sufficient in detail to support the disbursement of funds. As a result, the propriety and level of services provided is unclear.
7.  
8. Our review of 45 STO payments totaling $4.81 million indicated the following:

RECOMMENDATION NO. 12

RECOMMENDATION NO. 19

1. We recommend that the STO enter into a contract that can work within the constraints of the EDP Working Capital Trust Fund.
2.  

Unauthorized Activities of "ITFlorida.com"

FINDING NO. 20

3. From at least January 2000 through March 8, 2001 agents of the IT Task Force conducted business as "ITFlorida.com" without a corporate charter or statutory authorization.
4.  
5. Chapter 99-354, Section 11(1), Laws of Florida, created a 34 member Information Technology Development Task Force (IT Task Force) charged with issuing reports on technology issues relevant to the state. The IT Task Force was in existence from July 1, 1999 through June 30, 2001 and Florida law provided specific general revenue appropriations, totaling $450,000, to fund four positions. During the life of the Task Force, lawyers occupied three of these four positions.
6.  
7. Employees of the IT Task Force also functioned as agents of ITFlorida.com. This entity, neither created by statute nor chartered as a corporation, operated out of the Carlton Building, occupied office space provided by the STO and utilized state resources for support. It appears that ITFlorida.com functioned as an unauthorized state supported direct support organization.
8.  
9. During the period January 2000, and possibly earlier, through June 30, 2001, IT Task Force employees, acting on behalf of ITFlorida.com, participated in business-like activities. These activities included, soliciting funds, sponsoring events, booking hotel rooms, receiving correspondence and incurring liabilities on behalf of the state without legal authorization. The latter issue is discussed more comprehensively in Finding No 21.
10.  
11. The STO apparently provided state resources for the operating costs of ITFlorida.com. Because there was no clear audit trail, however, the full extent of state resources that went into ITFlorida.com is not readily determinable. Individual general ledger and purchasing card transactions for the STO and possibly other state entities would have to be examined to quantify the costs. We do know that the IT Task Force leased its four employees from FSU and paid for equipment, office rent, and travel.
12.  
13. On March 9, 2001, ITFlorida.com registered with the Department of State as a private non-profit corporation. This registration listed six officers which included three individuals from the private sector and three individuals from state government. The three individuals from state government included the former state CIO, The IT Task Force Chairperson and the Director of Office of Tourism, Trade and Economic Development.
14.  
15. ITFlorida.com continued to operate within the STO until September 2001. According to the 2001 Annual Report of the IT Task Force, the IT Task Force and ITFlorida.com coexisted until the IT Task Force came to an end on June 30, 2001. Additionally, the annual report acknowledges that the STO provided state resources to capitalize ITFlorida.com.

RECOMMENDATION NO. 20

16. We recommend that all state officials operate within the constraints of Florida law. Additionally, ITFlorida.com was not authorized as a direct support organization by Florida law. State officials also conducted ITFlorida.com business which included soliciting funds from vendors. We will refer this finding to the Florida Commission on Ethics and the Office of Financial Investigations, Office of the Comptroller.

Governor’s State of Technology Address

FINDING NO. 21

17. The executive director of ITFlorida.com incurred unauthorized liabilities on behalf of the state. Substantial conflicts of interest were created, when state officials solicited funds from companies doing business with the state to provide sponsorship for an ITFlorida.com event.
18.  
19. Section 112.313(7)(a), Florida Statutes, provides that no public officer or employee of an agency shall have or hold any employment or contractual relationship with any business entity or any agency which is doing business with the state. It appears that agents of ITFlorida.com violated this law when they solicited and processed payments from vendors during an ITFlorida.com sponsored event.
20.  
21. On October 11, 2000, the executive director of ITFlorida.com issued a general letter of intent to Ronald L. Polito to employ him as executive producer of the Governor’s State of Technology Address, held in the Leon County Civic Center on November 15, 2000. For the period October 4th through November 16th, 2000, Ronald L. Polito billed ITFlorida.com $191,764 for his services.
22.  
23. Documents indicate that at least $249,381 was spent on the event. We noted the following:

1. We recommend that state officials comply with Florida law and obligate the state only for disbursements authorized by Florida law and the General Appropriations Act. Additionally, we will also refer this finding to the Florida Commission on Ethics and the Office of Financial Investigations, Office of the Comptroller.

KPMG Consulting

FINDING NO. 22

2. The STO did not maintain adequate separation of duties for an individual authorizing accounting transactions in the Florida Accounting Information Resource (FLAIR) system and obtaining custody of state disbursement warrants.
3.  
4. In order to maintain effective internal control, it is important for every organization to maintain separation of duties for certain functions either through manual internal controls or through information access controls.
5.  
6. The STO permitted an on-site employee of KPMG Consulting to authorize and direct accounting transactions in FLAIR via e-mail messages to the DMS Bureau of Financial Management. Additionally, the KPMG Consulting on-site employee was signing for the custody of state disbursement warrants on behalf of the KPMG Consulting.
7.  
8. The internal control weakness was further augmented when KPMG Consulting invoices were submitted via e-mail to the KPMG Consulting on-site employee. The KPMG Consulting on-site employee then sent the invoices to the STO chief financial officer to obtain approval for payment.

RECOMMENDATION NO. 22

9. We recommend the STO management establish proper segregation of duties for authorizing transactions in FLAIR and obtaining custody of payment warrants.

FINDING NO. 23

10. During the period September 2000 through December 2001, the STO made payments to KPMG Consulting totaling $2.2 million. The STO contract manager did not maintain adequate documents and records to support contract deliverables. Additionally, the KPMG Consulting contracts did not have clear deliverables and invoices were not sufficient in detail to support payment.
11.  
12. KPMG Consulting’s statement of work provided that they would augment STO staff on a task order basis to review and develop policies and procedures related to budget, personnel and procurement. Additional tasks were determined by the STO. However, these contracts were not written with clear deliverables including outcomes that could be quantified or measured.
13.  
14. On January 4, 2002, we sent a letter to the STO requesting documentary evidence to support KPMG Consulting deliverables. In the STO’s response, we received a series of KPMG Consulting prepared status reports, e-mails, correspondence, some draft policies and procedures and a draft strategic plan.
15.  
16. Additionally, the STO did not evaluate the cost effectiveness of KPMG Consulting for augmenting or providing an extension of STO Staff. We noted that a KPMG Consulting staff person was performing functions that are typically performed by lower to medium level accounting personnel.
17.  
18. As a result, it cannot be determined how much benefit was received from the $2.2 million spent. In addition, besides guiding and directing accounting transactions in FLAIR, preparing draft operating procedures and a draft strategic plan, we are unsure as to exactly what was produced in relation to the money spent.

RECOMMENDATION NO. 23

19. We recommend that STO contracts with consultants provide deliverables which can be objectively measured or evaluated. Additionally, the STO should implement written policies and procedures for contract management. This finding is being referred to the Office of Financial Investigations, Office of the Comptroller.

 

Legal Servic