Matters Arising from Our Information System Audits Overview Introduction As part of our audit of the Province, we document and test controls in significant information systems. Each year, we test controls and make recommendations if we believe controls should be improved. This chapter reports our findings on those systems where we recommended changes to departments. In this chapter This chapter contains the results of the following audits: Audit See section Department of Finance – Property Tax A Department of Family and Community Services – Social Assistance Payments B Section A Department of Finance Property Tax Overview Introduction The purpose of this section is to discuss our findings from the property tax audit and to make recommendations. We did this work in the Fall and Winter of 2006/2007. In this section This section contains the following parts: Part Topic Page A Background, Objective and Scope 101 B Department Risks 106 C General Computer Controls 111 D Internal Controls 116 E Accounting Concerns 123 Part A Background, Objective and Scope Overview Introduction The purpose of this part is to provide background information for property tax and to explain the objective and scope of our work. Contents This part contains the following topics: Topic See Page Background 102 Objective and Scope 105 Background Property Tax Revenue Property tax is a significant revenue source for the Province of New Brunswick. It accounts for approximately 8.7% of the total revenue from provincial sources. Trends in Property Tax Revenue and Account Receivable The following table shows, for the last five years, property tax revenue, property tax receivable at year end and the receivable at year end less the current year revenue. The last column would be approximately equal to the amount of receivables in arrears. Year Provincial Property Tax Revenue Property Tax Receivable 31 March Receivable Excluding Current Year Revenue 2002 $ 278.3 $ 358.6 $ 80.3 2003 283.2 372.9 89.7 2004 289.8 382.6 92.8 2005 320.9 393.8 72.9 2006 331.7 386.2 54.5 * Figures, in millions of dollars, are from the financial information system. * Revenue figures do not include municipal property tax, interest or discounts. Property Tax Billing Information The following points contain information about property tax billing. * Provincial property tax is billed yearly on March 1 and is based on a calendar year, with the exception of utility property taxes billed in April. * As of March 31, the value of property tax accounts receivable is high as the majority of tax bills for the current billing year have not been paid. * The residential provincial tax rate is $1.50 per $100 of assessed valuation. * The non-residential provincial tax rate is $2.25 per $100 of assessed valuation. * The provincial rate of $1.50 per $100 of assessed valuation does not apply to that portion of residential property identified as owner-occupied. Continued on next page Background, Continued Responsibility for Property Tax The Revenue and Taxation Division in the Department of Finance is responsible for administering property tax revenue and the related accounts receivable. Account Management is a section in the Revenue and Taxation Division. This section, at the time of our audit, was made up of two units: * Tax Accounting and Refunds; and * Accounts Receivable. Responsibilities of the Account Management Section Based on our reading of the Department’s annual report for 2006, we determined that some of the key property taxation responsibilities of the Account Management section are: * issuing annual property assessments and tax notices and supplementary notices, * processing property tax payments and reports, * monitoring and collecting outstanding receivables for property taxes, * providing accounting functions related to revenue and receivables, * carrying out enforced collection procedures, where required, and * processing property tax refunds. Responsibilities of Service New Brunswick From our reading of the Service New Brunswick (SNB) annual report, we determined that SNB is responsible for identifying and assessing all land, buildings and associated improvements for property taxation purposes. SNB is also responsible for the assessment referrals and appeals process and it operates service centers where taxpayers can pay their property tax bills. We carried out an extensive review of SNB assessments in our Auditor General Report – Volume 1, 2005, Chapter 3. Continued on next page Background, Continued Property Tax System The Property Assessment and Tax System (PATS) is the computer application used by Finance and SNB to house property assessment and financial information, and process property taxes. Finance and SNB are joint owners of the system. Some of the main functions of PATS are to determine assessments, produce bills, apply payments and track accounts receivable. The system was implemented in December 1983 and runs on the government’s mainframe computer which is housed in the Marysville Data Center and run by Aliant. The system is divided into three parts – programs that are owned by Finance, programs that are owned by SNB and programs that are co-owned by both entities. Changes to the application are made by programmers in the Department of Supply and Services (Supply and Services). Approval for program changes is given by Finance, SNB or both depending on the programs that require changes. Municipal Property Taxes The annual property tax bill is called an “Assessment and Tax Notice”. The notice includes municipal, as well as provincial property taxes. Municipal property tax is based on: * SNB assessments, and * municipal rates which are determined by municipalities, approved by the Department of Local Government and provided to Finance by the last week of January. Finance is responsible for collecting municipal taxes. It assumes all risk associated with the collection of these taxes, excluding federally owned properties. Provincial revenue does not include municipal property tax revenue. Finance is only acting as a collection agent for the municipalities. Provincial receivables do not include the current year’s municipal tax receivable. However, provincial receivables do include the amount of municipal receivables owing from previous years. Objective and Scope Objective The objective of our audit was to document and test internal controls for property tax. Why Property Tax We selected property tax for audit because of the following reasons: * Property tax revenue is a significant revenue source for the Province. * The property tax system is a major computer system for the government and was next in our rotational IT system audit plan. * The Canadian Institute of Chartered Accountants released new standards that require us to document internal controls for major systems. We had not updated our control documentation for the Property Assessment and Tax system for a number of years. What We Audited We interviewed staff in the Account Management section in the Department of Finance. We also spoke with staff at SNB, Supply and Services and Aliant. Our work included a review of the following areas: * cash collection process at Finance, * annual billing process, * accounts receivable collection procedures, * revenue and receivable reconciliations to Provincial general ledger, and * general computer controls. What We Did NOT Audit We did not audit: * municipal property taxes * cash collection procedures at SNB, or * property assessments, referrals or appeals process at SNB. We reported on SNB assessments in our Auditor General Report – Volume 1, 2005, Chapter 3. Part B Department Risks Overview Introduction The purpose of this part is to discuss our findings that relate to departmental risks that we identified during our audit. Contents This part contains the following topics: Topic See Page Replacing the PAT System 107 Succession planning 109 Replacing the PAT System Issue The PAT system is very old and is a business risk for the Department if it is not replaced. Findings We make the following observations from our discussions with staff at Finance, SNB and Supply and Services. * A number of staff were concerned that the PAT system was 24 years old, and written in an out-dated programming language. * The lead programmer, contracted by the Department of Supply and Services, is nearing retirement age. Another younger programmer does work on the system and is familiar with the programs. * Over the years, extensive changes were made to the system. Because of this, when a change is made it affects many programs and requires extensive testing to ensure all affected areas are working properly. * The staff at Finance with the most knowledge of the system are at, or nearing, retirement age. If these individuals retire, Finance may not be able to effectively and efficiently manage changes. * In 2002/2003, Finance identified the need for a new system and issued requests for information. The “project” never reached the request for proposal stage and no work has been done on this initiative in the last three years. We were not given a reason for the project’s delay. * SNB is proceeding on its own and developing a new system. It could be more costly if both Finance and SNB developed their own systems than if they developed a system together. * With the current system, a large number of manual calculations are required when changes to an account are made. These manual calculations can be complex, time consuming and subject to error. Continued on next page Replacing the PAT System, Continued Implication The implications of not replacing the PAT system are listed below. * Because of the age of the system and the out-dated programming language, the risk increases that the Department may not be able to make all of the necessary system changes. * If key staff retire, the loss of knowledge could impact the Department’s ability to make error-free changes to the system. * We were told that it could take a minimum of two years to implement a new system. With the potential retirement of staff, key knowledge necessary in creating a new system may not be available. * As other departments’ applications are removed from the mainframe, the cost of operating the PAT system could increase. We Recommended We recommended Finance develop and implement an action plan to deal with the risks associated with the age of the PAT system. Departmental Response Although the PATS (Property Assessment and Taxation System) was implemented in 1983, it has proven to be extremely stable and reliable and continues to meet the needs of the department. Since it was implemented, numerous enhancements have been made to the system in order to stay current with business requirements and critical deadlines for implementing business changes have always been met. The department, along with Service New Brunswick, Assessment Services, with whom the system is shared, has from time to time explored the acquisition of a new assessment and taxation system as a means of achieving greater functionality and improved service to the public. While the department will continue to assess business opportunities to replace PATS, there are no immediate plans to do so; however, steps will be taken to ensure that sufficient documentation on PATS is maintained. The department is aware that SNB is contemplating the movement of the assessment component of PATS to newer technology, but is assured that any changes would ensure a continuous and seamless integration with the taxation function. Succession Planning Issue Finance faces a major loss of corporate memory over the next few years. Findings From our discussions with staff at the Department, we make the following observations. * Key staff in the Account Management section are at, or nearing, retirement age. * Up-to-date documented procedures need to be developed relating to accounts receivable collection, year-end accounting procedures, manual property tax adjustments, etc in order for new staff to be able to function if key staff retire. * Staff indicated that there would be a big learning curve for those left behind if these staff members retired. * The director of the Account Management section has a lot of knowledge relating to the PAT system. This person is the key person responsible for testing PATS programming changes, testing and monitoring the annual billing process. A plan should be in place as to how this knowledge will be passed on to other staff. Implication Finance faces loss of corporate memory when key staff retire. The Department is at risk of not being able to efficiently and effectively continue its operations unless it deals appropriately with this issue. Department Comments The following points were noted in our discussions with management. * They are aware of this risk to corporate memory. * They have started looking into succession planning. * They hope to have a new system in place before the Director of the Account Management section retires. However, as mentioned above, progress has stalled in the system development process. * They recognize the need for documentation and have started looking at what processes need to be documented. We Recommended We recommended the Department continue to develop and document a succession plan to address human resource needs for the Account Management section. Continued on next page Succession Planning, Continued Departmental Response The department agrees with the recommendation and will continue its efforts along this path with a goal of having a succession plan for this work unit finalized in 2008. Part C General Computer Controls Overview Introduction The purpose of this part is to discuss our findings and recommendations for the property tax system general computer controls. Contents This part contains the following topics: Topic See Page Implementing System Program Changes 112 Termination of User Accounts 113 Business Continuity and Recovery Plans 114 Implementing System Program Changes Issue Unauthorized program changes could be made to the PAT system. Findings The following findings result from our work on program changes. * Property tax programmers at Supply and Services authorize program changes into production. The programmers contact staff at the Data Centre instructing them to release programs to the production environment. * Because programmers can release changes to production, we have no way to ensure that the list of changes made to the PAT system during the year is complete. * We selected a sample of program changes from the provided list and ensured that Finance approved and tested the changes. We saw evidence that Finance staff authorized the programmer to release the changes to production. Implications Allowing programmers to authorize program changes to production increases the risk of unauthorized changes to the PAT system. Errors in processing could occur if unauthorized and untested system changes are made. Department Comments The Department agreed that it would not know if a programmer implemented an unauthorized change as departmental staff do not contact the Data Centre to authorize them to put program changes into production. We Recommended We recommended Department of Finance staff authorize the release of program changes to production by instructing the Data Centre staff to only make changes that are approved by the Department of Finance. Departmental Response All changes to the PATS must be signed-off by the system owner prior to the changes being moved to production. The sign-off is sent to the programmer responsible for the change and maintained on file as evidence that authority was given. Although the Data Center staff would not be able to determine whether the change requested was the actual change being implemented, the department will direct that a copy of the system owner’s sign-off accompany the request to move the changes into production. Termination of User Accounts Issue Inactive user accounts are not being disabled. Findings The following findings result from our work on user accounts. * We found 20 users who had not logged into the system within 90 days and who were no longer employees with the Revenue and Taxation Division in Finance. * Five of these accounts were locked which means their passwords would need to be reset before they could access the system. * The remaining 15 users could access the system, if they remembered their password and if they had the software needed to access the system. Implication The risk of unauthorized system access increases if user accounts are not disabled or terminated when employees leave their job function. GNB Password Standard In March 2003, the Government of New Brunswick released “Password Standard for User Accounts” which outlines baseline security for all user accounts. These standards require user accounts be automatically disabled after 90 days of inactivity and that user accounts be immediately disabled when an employee changes job function. Because of a grandfather exemption, the Property Tax system does not have to comply with these standards. However, we believe the recommendations proposed by the standards represent good access controls for all systems. We Recommended We recommended the Department disable user accounts immediately if employees change job functions and after 90 days of inactivity. Departmental Response The department agrees that user privileges should be terminated immediately for employees leaving the department or changing job functions where access will no longer be required. Appropriate measures will be taken to ensure that this happens. The department will develop rules around the appropriate time span after which a password will be disabled for non-use of the system. There are some users within the department that would not require access to the PATS on a regular basis, but do require access. The suggested 90 days may or may not be the appropriate duration. Business Continuity and Recovery Plans Issue A completed business continuity plan and a recovery plan does not exist for the property tax system. Background Business Continuity Plan (BCP) A BCP is important as it identifies critical business processes and establishes the information and resources that are needed to ensure that these processes continue to operate in the event of a disruption in service. A BCP should incorporate components such as: * a business impact analysis, * human resource needs, * a backup and offsite storage program, and * emergency response procedures. Recovery Plan A subset of a BCP is a recovery plan. This plan focuses on the recovery of the computer environment needed to support the critical business processes if a disruption should occur. A recovery plan should include components such as: * information technology processing resources; and * procedures, manuals and other hard copy documents that are required for the resumption of business applications. Findings The following findings result from our work on business continuity and recovery plans. * The Department is working on a BCP for a pandemic influenza. It is a draft plan and the information technology section has not been completed. * A BCP did exist for Y2K, but it has not been updated since 1999. * Various backup procedures are in place to protect the information stored on the mainframe. * Discussion with staff at Finance and at Supply and Services indicates that there is no disaster recovery plan for applications that operate on the mainframe. * The Government has not contracted disaster recovery services as part of the contract with Aliant. The contract contains only a best efforts provision in the event of a disaster. Continued on next page Business Continuity and Recovery Plans, Continued Implication Not having documented business continuity and disaster recovery plans increases the risk that critical systems may not continue to operate if a disaster was to occur. Department Comments The Department is working on completing the plan for the pandemic influenza. It believes Supply and Services is responsible for completing the IT section of the plan. The Department plans to update the Y2K plan as resources become available. We Recommended We recommended the Department update and complete its business continuity plans which will help ensure the needs of the government are met in the event of a disaster or disruption of service. This would include completing the IT section of the plan. We recommended the business continuity plan incorporate, if feasible, a tested information technology recovery plan for the PAT system. We recommended the business continuity plan be reviewed and updated periodically to ensure it reflects changes in infrastructure and the organization. Departmental Response The department agrees with the [first] recommendation and steps will be taken to complete the business continuity plan over the course of the coming year. The department agrees with the [second] recommendation and will ensure that the Information Management and Technology Branch of the department works with Corporate Information Management Services to finalize the business continuity plan for PATS within the next year. The department agrees with this [third] recommendation. Part D Internal Controls Overview Introduction The purpose of this part is to document our findings and recommendations relating to the internal controls associated with property tax. Contents This part contains the following topics: Topic See Page Completeness of Property Tax Bills 117 Documenting Year-End Accounting Procedures 118 Accounts Receivable Collection Policy 119 Data Entry of Tax Rates 120 Reconciliation of Suspense Accounts 121 Completeness of Property Tax Bills Issue Finance does not calculate the expected number of “Assessment and Tax Notices” to compare to the actual number of “Assessment and Tax Notices” produced. Findings We noted the following information during our audit. * Finance has some controls in place to ensure the completeness of the “Assessment and Tax Notices”. However, we believe these controls should be improved. * For example: - Finance staff ensure that all “Assessment and Tax Notices” produced are mailed to the taxpayers. We believe this is a good control. - Finance staff ensure that the number of “Assessment and Tax Notices” produced is reasonable. We believe this control should be improved. * Rather than ensuring the number of “Assessment and Tax Notices” are reasonable, we believe staff should ensure the number of “Assessment and Tax Notices” are correct. * This could be done if, before they run the tax roll, staff determined the number of “Assessment and Tax Notices” that should be produced based on the number of assessed properties recorded in the system. * After the tax roll is run, staff should reconcile the expected number of notices to the actual number of notices produced. This would ensure an “Assessment and Tax Notice” is produced for all assessed properties. Implications The risk of not collecting all taxes increases, if the Department does not ensure an “Assessment and Tax Notice” is produced for all assessed properties. We Recommended We recommended the Department ensure the completeness of the “Assessment of Tax Notices” by predetermining the number of notices that should be produced and agreeing this number to the actual number produced. Departmental Response The department matches the number of notices that the PATS indicates is to be produced with the number actually issued. As this report is produced from the PATS at the time the notices are to be prepared, the department believes this to be an adequate verification procedure. Documenting Year-End Accounting Procedures Issue Year-end procedures are not completely documented. Findings We noted the following information during our audit. * The Director of the Account Management section asked her staff to document year-end accounting procedures. * The manager of the Tax Accounting and Refunds unit began work on this initiative but has yet to complete this task. * The manager of the Tax Accounting and Refunds unit is responsible for preparing all year-end accounting entries with the assistance of a financial analyst. We found that the financial analyst requires more cross-training in the preparation the property tax entries. Documented procedures would be helpful in the event that this individual was required to prepare the year-end entries for property tax and to increase the analyst’s knowledge in the area. * Some staff were not clear on the use of the Property Tax Reserve account and the Property Tax Provision account as the purpose of the accounts has changed over the years. Implications The lack of documented year end procedures results in: * increased risk of error in the financial records, * increased risk of corporate memory loss should key staff not be available, * a lack of understanding of the “why” of accounting adjustments, * increased difficulty for staff to efficiently and effectively complete accounting adjustments, * increased audit time for both external and internal auditors, and * decreased consistency in carrying out year-end procedures thereby weakening control. We Recommended We recommended the Department complete its documentation of year-end accounting procedures. The Department should ensure that the rationale for the adjustments is included in the documentation. Departmental Response The department recognizes the need for documented year-end accounting procedures. Work had commenced on this requirement prior to the recommendation being made with a goal to have the necessary documentation completed in time for the 2007-2008 year-end closing process. Accounts Receivable Collection Policy Issue The accounts receivable collection policy is out-of-date and needs to be updated. Findings We noted the following observations from our work on accounts receivable collections. * The accounts receivable collection policy has not been updated since November 1994. * We recommended in 2002 that the Department review its policies in regards to the timing of client contacts. * The Department responded that it is in the process of updating its collection procedures with a stronger focus on aging, dollar value and ratio of balance due to assessed value. * From our discussions with staff, we believe they are working on a new process for collecting receivables. However, the documentation on the process is not yet complete. Implications Because the Department does not have an up-to-date documented collection policy: * collection officers may not be consistent in their collection procedures, and * a loss of corporate memory could result because key staff of the Accounts Receivable unit are at retirement age. We Recommended We recommended the Department update its collection policy to help ensure consistency in the collection process and that corporate memory is appropriately documented before key staff retire. Departmental response The department recognizes the need for maintaining up to date documentation of its collection policies and procedures. This work was in process prior to the audit and will continue to completion, which is planned to be by June 30, 2008. Data Entry of Tax Rates Issue Tax rates are not verified by two employees who are independent of the data entry process. Findings The following findings result from our work on data entry of tax rates. * The manager of the Accounts Receivable unit enters municipal tax rates, which he receives from the Department of Local Government, into the PAT system. * A tax rate report is printed. The manager and one of his staff members reconcile the tax rates on the report to the rates provided by Local Government to ensure they were entered accurately. * In the past, this reconciliation was performed by two individuals independent from the data entry process. However, over time this process changed, so that only the manager and one other person reconciles the rates. * Given the importance of having the correct rates entered into the system when the “Assessment and Tax Notices” are run, we believe an independent review of the tax rates should be performed. Implication By not having two independent individuals verifying tax rates, the risk of a data input error increases – the individual who enters the rates could make the same mistake twice. We Recommended We recommended the Department have two individuals independent from the data entry of tax rates verify the accuracy of the tax rates input into the system. Departmental Response The department agrees with this recommendation and will take steps to ensure that independent verification is made of the tax rates input into the system during the 2008 billing process. Reconciliation of Suspense Accounts Issue Cash suspense accounts are not being reconciled on a monthly basis. Background Cash suspense accounts are used by the Department as an intermediary step in the recording of cash receipts. When cash is received, the suspense account is credited. When payments are posted to the accounts receivable balances, the suspense account is debited. In theory, the balance in the account should be zero. However, because of timing differences in the above process, this is never the case. At year end, the balance in the account is applied against the accounts receivable balance. Findings The following findings result from our work on cash suspense accounts. * We found that the cash suspense accounts were not being reconciled each month. * A new staff member was assigned this responsibility but was unsure how to reconcile the ledger accounts, although staff was reconciling the daily cash receipts to the payment files received. * Also, no one was reviewing the reconciliations to ensure they were completed on time. Implication Not reconciling the cash suspense accounts increases the risk of undetected errors in the cash receipts process. Undetected errors would be carried forward from year-to-year. We Recommended We made the following recommendations relating to cash suspense accounts. * We recommended the Department reconcile all cash suspense accounts on a monthly basis. * We recommended the Department document the procedures that staff should follow to reconcile the cash suspense accounts. * We recommended someone review the reconciliations to ensure they are completed properly and in a timely manner. Continued on next page Reconciliation of Suspense Accounts, Continued Departmental Response Although cash receipts are normally balanced on a daily basis, which makes the timeliness of the monthly reconciliations less critical, the department accepts that the reconciliations should be completed on a monthly basis and will take steps to ensure this is done. The department agrees with this [second] recommendation and will complete the documentation of these procedures within the next six months. The department agrees with this [third] recommendation and a process covering this review will be included in the documentation of the reconciliation procedures noted above. Part E Accounting Concerns Overview Introduction The purpose of this part is to document our findings and make recommendations relating to accounting concerns that we found during audit of property tax. Contents This part contains the following topics: Topic See Page Accounts Receivable Balance is Understated 124 Write-off of Uncollectible Accounts Receivable 125 Accounts Receivable from Provincial Departments 127 Accounts Receivable Balance is Understated Issue The amount of accounts receivable associated with the current year municipal taxes are not shown on the Province’s financial statements. Findings We make the following observations relating to municipal accounts receivable. * As mentioned in the background, Finance is responsible for collecting municipal taxes. It assumes all the collection risk associated with these taxes. * Provincial receivables disclosed on the financial statements do not include the current year’s municipal tax receivable. However, provincial receivables do include the amount of municipal receivables owing from previous years. * If the Province assumes the collection risk, it should disclose the receivable balance associated with the accounts it will be collecting. * The amount of municipal receivables is approximately $386 million. On the financial statements, this amount is netted against a corresponding payable to the municipalities. Neither the receivable nor the payable are disclosed in the financial statements. Implication The accounts receivable balance reported in Public Accounts is understated by the amount of the municipal receivable by approximately $386 million. Even if this amount is substantially “netted” by the offsetting payable, it could impact debt covenants or other indicators used by the readers of the financial statements. We Recommended The Province should ensure the balance of the current year municipal receivable is reflected in the year-end receivable balance. Departmental Response The department views this recommendation as relating to Financial Statement disclosure and, as such, will refer this recommendation to the Office of the Comptroller for appropriate response. Write-off of Uncollectible Accounts Receivable Issue Uncollectible accounts receivable are not written off in a timely manner. Findings We make the following observations relating to the write-off of receivables. * In our 2002 Auditor General’s Report, we noted a problem with write-offs of uncollectible accounts. The Department indicated that it would submit future requests for write-off approval in a timely manner. * As of May 2007, 589 property tax accounts totaling $1.2 million had been marked for write-off by the Department. * Based on our sample, many of these accounts have been flagged for write-off five or more years ago. * Discussion with staff at Finance indicated that the process for writing off accounts is very time consuming. See a description of the process below. * We agree with this statement but believe that Finance should try to write off these old accounts. This would help to ensure that the receivables shown on the Province's books are only those amounts which are collectible. Process to Write off Receivables To write off accounts receivable in excess of one hundred dollars, the Financial Administration Act requires departments to follow the procedures listed below. * If the department determines an account to be uncollectible, the department shall send to the Office of the Comptroller a Memorandum to the Board of Management. * The Memorandum to the Board of Management shall contain the following information: - a recommendation approved by the Minister or Deputy Minister that the asset be wholly or partially deleted; - a statement saying what steps had been taken to collect the account; and - a statement saying what financial effect this deletion will have on the Province's accounts. * The Office of the Comptroller will forward the Memorandum to the Board along with the Comptroller’s recommendation. * Where the Board is satisfied that the deletion is appropriate, the Board may direct that the asset be deleted either in whole or in part from the accounts of the Province. For accounts receivable of one hundred dollars or less, a similar process is followed. The main difference is that the Secretary of the Board may direct that the asset be deleted – full Board approval is not required. Continued on next page Write-off of Uncollectible Accounts Receivable, Continued Implication Retaining uncollectible accounts on the active listing can interfere with the active management of the accounts that can still be collected. We Recommended We recommended the Department promptly write off old receivables when it is deemed that they will not be collected. Departmental Response The department agrees with the recommendation and attempts will be made to have all accounts designated for write-off presented to Board of Management for approval within the next six months. Accounts Receivable from Provincial Departments Issue The aged accounts receivable listing for property tax contains accounts for Provincial departments. Findings From our review of the aged accounts receivable listing, we determined that 230 accounts totaling $1.9 million relate to Provincial departments. The table below lists the departments owing property tax, the number of accounts and the total amount owing. Department Number of Accounts Amount Owing Natural Resources 146 $1,198,527 Transportation 33 92,921 Agriculture, Fisheries and Aquaculture 30 7,011 Supply and Services 8 129,410 Finance 7 27,795 Tourism and Parks 2 256,777 Business New Brunswick 2 218,786 Environment and Local Government 1 76 Education 1 4 Total 230 $1,931,307 Approximately $1.8 million is five or more years in arrears. Implications We noted the following implications by recording accounts receivable from provincial departments on the balance sheet. * The Province is essentially setting up receivables from itself, which overstates the balance of the receivable, as the Province cannot “owe” itself money. * Accounts receivable are overstated by $1.9 million. * As we noted in the previous section, uncollectible accounts on the active accounts listing can interfere with the active management of the accounts that can still be collected. We Recommended The Department should remove accounts receivable owed by other departments from its year-end receivable balance. Departmental Response The department agrees with the recommendation and will endeavor to obtain approval to remove these balances prior to year-end 2007-2008. Section B Department of Family and Community Services Social Assistance Payments Overview Introduction The purpose of this section is to discuss our findings relating to our audit of social assistance payments. Social assistance payments are processed by the NBCase system which is operated by the Department of Family and Community Services. Background The topics discussed in this section relate to past recommendations that we made to the Department. We are following up to see if the Department has made progress in implementing these recommendations. In this section This section contains the following topics: Topic See Page Follow up of Regional Investigators’ Work 129 Timely Completion of Case Reviews 133 Improvements Made in Access Controls 136 Progress on Threat Risk Assessment 137 Follow up of Regional Investigators’ Work Introduction The purpose of this part is to document our findings on the control procedure performed by the Regional Investigators’ supervisors. Investigation Process The following diagram shows the regional investigation process. (Regional Investigators receive tips from various sources. Based on these tips, they investigate social assistance clients.) Nature of Our Audit Work Our work focused on the control “Verifies that Case Manager took action”. We gathered data to determine if this control was operating effectively throughout the audit period. Please note, a failure to perform this control procedure does NOT mean that Case Managers have failed to take action on the Regional Investigators’ recommendations. It means that the Regional Investigators’ Supervisors have not VERIFIED that the Case Managers have taken action on the recommendations. Continued on next page Follow up of Regional Investigators’ Work, Continued Audit Findings Last year, we reported Regional Investigators recommended changes to social assistance payments in 32% of their investigations. However, only 48% of these changes were followed up by their supervisors. This year, we found for the period April 2006 – February 2007, Regional Investigators recommended changes to social assistance payments in 34% of their investigations. Regional Investigator Supervisors followed up on 47% of these changes. (Note this follow-up percentage does not include the Moncton region.) We were unable to determine the follow-up percentage for the Moncton region. Because our numbers for Moncton were very low, the Department contacted a Moncton supervisor. The supervisor was not aware of the purpose of the NBCase follow-up task and had developed her own manual method for tracking/monitoring the Regional Investigators she supervised. We did not review the other tracking method. To avoid distorting the follow-up percentages, we have removed the Moncton data from the population. Department’s Comments On March 15, 2007, the Department emailed the Regional Investigators’ Supervisors instructing them on how to complete the follow-up process. Departmental staff informed us that training was given in April and May of 2007 instructing supervisors on how to complete the follow-up process. Continued on next page Follow up of Regional Investigators’ Work, Continued Additional Audit Procedures The Department provided us with additional data from the NBCase system for the Moncton region. From this information, we were able to see evidence of the action taken by the Case Managers on the Regional Investigators’ work. In cases where investigators recommended a client be terminated, we were able to see that the client was indeed terminated. However, in cases where investigators recommended changes in client payments, we were unable to verify that the Case Managers made the recommended changes. For the Moncton region, we determined that Case Managers made at least 77 % of the changes recommended by the Regional Investigators. Observations From our work, we believe the Department needs to improve the training and monitoring of the Regional Investigators’ Supervisors. The Department should monitor the Regional Investigators’ Supervisors, at least initially, so that the Department knows that the Regional Investigators’ work is being followed up and recorded in NBCase. Implications As we mentioned last year, a client could continue to receive ineligible payments if the Regional Investigator’s Supervisor does not verify that the Case Manager has reviewed and implemented (when justified) the recommendations of the Regional Investigators. Recommendations The Department should ensure Regional Investigators’ Supervisors are properly trained so that they know how to follow up on the Regional Investigators’ work and how to record that information in NBCase. The Department should monitor the Regional Investigators’ Supervisors to ensure they are completing the follow-up process properly and in a timely manner. Continued on next page Follow up of Regional Investigators’ Work, Continued Departmental Response Investigation Supervisors will meet face to face with staff of Corporate Reporting and NB Case Business Support (CRNBS) to clarify the procedure for the Investigation task and required 6 week Task follow up. Monthly monitoring of the process will be coordinated by CRNBS staff through the Executive Information System (EIS). A conference call will be organized if there are provincial issues. Otherwise follow up will occur with specific supervisors by region as required. Follow up Requested by the Department The Department asked us to report on the action taken by the Case Managers on the Regional Investigators’ recommendations for all regions. We present the following information based on data as of July 2007. Investigators’ Recommended Action Case Manager Action Number of Cases Comments Terminate Terminate 722 Terminate Open 94 FCS reviewed 17 items and determined that Case Managers took appropriate action on each case. Sub-total 816 Reduce Terminate 113 Reduce Open 107 Sub-total 220 Total 1036 Note: This data does not include cases where the Regional Investigators recommended increases in client payments. Timely Completion of Case Reviews Introduction The purpose of this part is to document our findings relating to the completion of case reviews. We divided this part into two – case reviews for alert clients and case reviews for non-alert clients. Definitions Case review: A case review is a process where a departmental employee visits a social assistance client to verify client information and determine that the client is still eligible to receive social assistance benefits. Case reviews are often performed during the summer months by summer students. Alert client: Clients are given an “alert” status if they are considered to be violent. Case Managers are required to perform case reviews for these clients. Alert Clients Issue 1: Case reviews are not always completed on time for alert clients We reported last year that timely case reviews are not always completed for alert clients. This year, we found that the Department has made progress in completing the case reviews for alert clients. However, more work is needed to ensure these reviews are completed in a timely manner. The following table shows that the Department improved from last year in completing case reviews for alert clients. This year 7% of alert clients have not received a case review, as compared with 10.7% in 2006. It also shows that more work is needed to ensure that the reviews are completed in a timely manner. Year Case Review Required Current Year Number of Overdue Reviews - Alert Clients Prior Year Number of Overdue Reviews - Alert Clients 2000 0 3 2001 0 2 2002 5 18 2003 2 11 2004 5 14 2005 4 12 2006 25 N/A Total Overdue 41 60 Total Number of Alert Clients 586 563 Percentage of Alert Clients with Overdue Case Reviews 7% 10.7% Continued on next page Timely Completion of Case Reviews, Continued Non-alert Clients Issue 2: Case reviews are not always completed on time for non-alert clients Last year, we reported that 708* clients had overdue case reviews. We noted that some of these case reviews appeared to be completed, but were not updated in the NBCase system. This year, we found that the number of overdue case reviews has increased to 742 (3.1%) but the Department has made significant progress in completing the older case reviews. We also found the Department is falling behind in completing the more recent case reviews. The following table shows the number of overdue case reviews for both the current and prior year, as well as the percentage of overdue reviews. Year Case Review Required Current Year Number of Overdue Reviews Prior Year Number of Overdue Reviews 2000 0 0 2001 0 1 2002 1 3 2003 0 19 2004 13 101 2005 84 584 2006 644 NA Total Overdue 742 708 Total Number of Non-Alert Clients 23,638 24,527 Percentage of Non-Alert Clients with Overdue Case Reviews 3.1% 2.9% * The prior year number is different from the figure we reported in last year’s Report. We removed the number of the alert clients, as well as clients with an on hold status. Continued on next page Timely Completion of Case Reviews, Continued Implications for All Clients As we noted last year, by not completing regular case reviews: * the risk of error in clients payments increases, * the risk that the client is no longer eligible to receive social assistance payments increases, and * the department is not complying with its internal policy. Departmental Policy Department policy requires case reviews to be completed for all clients on a regular basis (which is determined based on the type of client). No exceptions are noted for alert clients. Recommendations The Department should complete the overdue case reviews for all clients. The Department should complete case reviews in a timely manner as required by departmental policy. Departmental Response A) Alert clients We have made progress in the completion of case reviews for alert clients. We will continue to communicate the importance of completing these reviews in accordance with our policies, however we must be cognizant of safety and security of staff for those few alert clients who could pose a challenge. B) Non alert clients It is important to recognize that staff completed 97% of the case reviews in both 2007-08 and during the previous year 2006-07. Some of the case reviews were completed but were not updated in NB Case. To address this, we have established an improved monitoring mechanism for the student case reviews which are conducted each summer so we can track the progress more closely than before and identify whether cases have been keyed in NB Case. We have also provided all regions with reports of reviews to be completed in the current year on an ongoing basis. Regions are making progress, however two regions have not been as successful because of staff turnover issues. Improvements Made in Access Controls Weaknesses Noted Last Year Last year, we reported weaknesses with NBCase access controls. Access Controls Improved This year, we found the Department improved NBCase access controls as noted below. * New users are now required to change their initial default password that is assigned by NBCase support staff. * Users are not allowed to use their username as their password. * Information Technology Services (ITS) is no longer able to look-up users’ passwords. Now when users forget their password, ITS can reset the password and users are required to immediately change their password. Future Plans The Department has implemented the above temporary security measures to comply with our prior year recommendations. The Department plans to further improve access controls in October 2007. Progress on Threat Risk Assessment Prior Year Recommendation In our 2004 Report, we recommended that the Department perform a threat/risk assessment for the NBCase application. This assessment would identify all potential security risks and help the Department to manage these risks. Progress Made This year, we found that the Department has begun work on a Threat Risk Assessment for the NBCase system. We saw this draft document which is in the process of being reviewed by the Department. We congratulate the Department in undertaking this initiative and we will review the content of the Threat Risk Assessment in a future audit. WP .50/8 WP 518 Matters Arising from Our Information System Audits Chapter 4 Chapter 4 Matters Arising from Our Information System Audits 136 Report of the Auditor General – 2007 Report of the Auditor General – 2007 99