Recommendation Status Evaluation: The county implemented three of the pandemic funds audit recommendations, but found the other two recommendations not practical to implement

Report Highlights

What we found

The Auditor’s Office follows up on audit recommendations to support county government’s accountability.

We found that the county implemented three of the five recommendations from the 2021 audit titled Pandemic Funds: Management has policies and procedures in place to manage pandemic funds. While the county did not implement the other two recommendations, there are other processes and controls that are in place, planned to be implemented, or that management has enhanced since the audit to help mitigate the issues identified.

What the Statuses Mean

• Implemented – Auditee has fully implemented, or auditee has resolved the issue to
  meet the recommendation’s intent.
• In Process – Auditee has started implementation.
• Not Implemented – Auditee has not implemented, or does not intend to implement.

Status of Recommendations

Recommendations Implemented

Recommendation #1: Provide enhanced procurement card (p‐card) training to all county staff that use and/or manage p‐card transactions. We recommend this enhanced training highlight that services cannot be paid for by p‐card, p‐cards are not to be used to circumvent accounts payable controls, the responsibility of the review and approval roles, and emphasize the consequences of not following county policies, which include but are not limited to p‐card privileges being revoked.

Auditor’s Note: Based on review of p-card training materials we were able to verify that management made enhancements to the required p-card user training modules. These now include specific information related to responsibilities and services that cannot be paid for with p-cards and information on the consequences for improper use of a p-card. The county now requires cardholders and their supervisors to take the training annually.

Additionally, management updated the p-card user manual with an accompanying user guide that contains the same information as the training modules. The enhanced training was also communicated to department finance managers.

Recommendation #3: From the issuance of the initial audit report [November 2021] through at least the end of 2022, the County Chair and Government Relations should continue to communicate frequently with Oregon’s state legislature and federal delegation about rent assistance requirements that were barriers to helping people in need, particularly Black, Indigenous, and People of Color community members, receive assistance during the COVID‐19 pandemic.

Auditor’s Note: While no longer applicable, we consider this recommendation resolved and therefore, implemented. The Office of Government Relations’ work was demonstrated through their updates to the Board of County Commissioners throughout 2022 and beyond. Those updates included some of the following:

Recommendation #4: We recommended that the Health Department evaluate the employees assigned to approval roles to ensure their workload capacity is appropriate to effectively and adequately review transactions before completing an approval step in Workday.

Auditor’s Note: The county’s Central Accounts Payable team sends a list annually to the Health Department for their review of the approver roles in Workday, the county’s enterprise resource planning system. The most recent review by the Health Department occurred in March 2024. Also, there have been a couple changes to countywide practices, including enhanced manager training that emphasizes what the approval process should include. Additionally, language has been added in the workflow process in Workday when an approver approves an invoice asking the approver to confirm they have reviewed the invoice. 

Recommendations Not Implemented with No Intention to Implement

Recommendation #2: We recommended the Chief Financial Officer’s office develop a centralized detective control for identifying improper use of p‐card transactions. A detective control is a procedure to identify errors or problems after they have occurred. This process should be in addition to Central Accounts Payable periodic audits and include a comparison of p‐card vendors to the federal Systems for Award Management (SAM.gov) list. We recommend this process be performed at least quarterly.

Auditor’s Note: The county uses Bank of America (BofA) and its web‐based application, WORKS, as the banking institution to help facilitate the p‐card program process. Due to the vendor naming conventions in the BofA data, it would be very difficult to do a search on the thousands of transactions that would be of any real value. For example, names are commonly abbreviated or use a doing-business-as (DBA) name. Therefore, comparing the list of vendor names from the BofA data to an exclusion list such as SAM.gov would produce results that would be challenging to interpret with any great accuracy. Additionally, BofA is unable to implement an automated control on the front end of a transaction, such as comparing a vendor name to an exclusion list.

There are other processes and controls that are in place or have been enhanced since the audit. These include the following:

• Central Accounts Payable restarted their routine audits of department p-card transactions; the latest review was completed in January 2025. 
• As noted in Recommendation #1, Central Accounts Payable’s enhanced training and information sharing is designed to help reduce improper use of p-cards. 
• BofA uses merchant category codes (MCC) that help mitigate what is purchased (e.g. alcohol at a liquor store) but it doesn’t address who is paid. Merchants are assigned an MCC based on the type of products or services they primarily sell. The MCCs are designed to help accurately reflect the merchant’s primary business and facilitate risk management. The county can identify specific MCC codes as prohibited (e.g. alcohol) and thereby prevent the use of county cards at certain establishments that appear to be inappropriate for conducting county business.
• When merchants sign up for a merchant account with BofA, they go through a screening process to validate they are a supplier that can accept cards and are not on a do not do business with Federal list.

Recommendation #5: We recommended that the Health Department enhance detective controls to ensure that routine reconciliations of vendor payments are performed, to help identify any miss-payments, such as monthly contract reconciliations of vendor invoices for what has been paid compared to what has been invoiced, to date.

Auditor’s Note: The Health Department chose not to implement this recommendation, because of the significant burden it would have on finance department resources.  Based on conversations with the Health Department, the primary reason why they consider it a significant burden is because it would be very labor intensive to perform such a review on the thousands of invoices per year that the Health Department processes.  In our review of invoices for fiscal year 2024 (July 1, 2023 through June 30, 2024), we noted that the Health Department processed about 16,200 invoices, which is a high volume. With 260 working days, the department averages over 62 invoices processed per day (16,200 invoices / 260 days). This calculation excludes consideration of holidays, vacation, or sick days that would make the average invoices processed per day even higher. Therefore, management is relying on other efforts to monitor invoices.

The Health Department is working to implement other efforts that they hope will help make a more robust review process to better evaluate spending. Sometime during fiscal years 2022-2023, the department developed a contract spend dashboard that shows contract spend availability compared to amounts already spent. However, it has not been rolled out yet. The Health Department hopes to roll out the contract spending dashboard by the end of June 2025. 

Objectives, Scope, & Methodology

The objectives of this evaluation were to determine the status of recommendations from the 2021 Pandemic Funds Audit: Management has policies and procedures in place to manage pandemic funds. All recommendations had a due date of December 31, 2021.

Audit staff evaluated the status of recommendations based on interviews, documentation, and other available evidence. 

Updating the Status of a Recommendation

During each audit our office conducts, we develop recommendations intended to improve government operations, particularly with regard to effectiveness, transparency, accountability, and equity. Our goal for evaluating the status of recommendations is to help ensure management implements these recommendations for improvement. 

We recognize that after we publish an evaluation on the status of recommendations, management may fully implement a recommendation that we reported was in process or not implemented. Management can then provide evidence to the Auditor demonstrating why the recommendation’s status should be changed in the Auditor’s future reporting. The final decision on whether to change any recommendation’s status rests with the Auditor.

Staff

Annamarie McNiel, CPA, Operations & Audit Director

Related document