Loading...
HomeMy WebLinkAboutAudit Reports - Public - Citywide Mobile Devices - Audit Follow-up - 12/11/2018 Date: December 11, 2018 To: Kevin R. Phelps, City Manager From: Candace MacLeod, City Auditor Subject: Audit Follow-up: Citywide Mobile Devices A citywide mobile device audit was conducted by the City Auditor’s Office in November 2016. Twenty-six recommendations were made to enhance the efficiency and effectiveness of the City’s mobile device program. A follow-up audit was conducted in December 2017, indicating that actions had not been taken by management to address 18 (69%) of the recommendations. An additional follow-up was performed in November 2018. Out of the 18 outstanding recommendations, 15 remain open, with an estimated completion date of June 30, 2019. The open items include: • Implementing a citywide policy that addresses the management of mobile devices • Developing controls to safeguard, minimize, or eliminate the storage of City data on mobile devices • Monitoring mobile device usage to identify those on the wrong plans or with zero usage • Consolidating mobile service providers and instituting citywide standards for voice and data plans, equipment, and accessories • Reviewing and updating mobile device allowance criteria and amounts • Clarifying in policy that receipt of both a device allowance and City-owned device is prohibited Please contact me if you have any questions. Attachment cc: Chris Anaradian, Assistant City Manager Michael D. Bailey, City Attorney Lisette Camacho, Assistant Director of Budget and Finance Tom Duensing, Assistant City Manager Chuck Murphy, Director of Innovation and Technology Vicki Rios, Director of Budget and Finance _____________________________________________________________________________________ City Auditor’s Office 1 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status 1.1 The City Manager’s Office (CMO) implement a citywide mobile device policy which addresses the management of mobile devices. The City currently utilizes the City-Paid Mobile Electronic Devices or Reimbursement Finance Administrative Policy (FAP) No. 4, revised June 10, 2014, and Innovation & Technology Mobile Device Policy, revised November 2017. For network access being controlled by the City, IT is currently evaluating a virtual mobile workspace solution. A product recommendation will be made by March 30, 2018. IT has been delayed in the evaluation of Virtual Mobile Workspace technology due to competing priorities. The revised recommendation date will be June 30, 2019. Open 1.2 Innovation and Technology (IT) implement controls to ensure only authorized mobile devices access the City’s network. IT has been delayed in the evaluation of Virtual Mobile Workspace technology due to competing priorities. The revised recommendation date will be March 30, 2018. This is accomplished through the use of our ActiveSync implementation. The implementation of ActiveSync has to be approved by the users’ management. Closed 2.1 IT implement controls to safeguard, minimize or eliminate the storage of City data on mobile devices during the employment lifecycle of City personnel. IT has been delayed in the evaluation of Virtual Mobile Workspace technology due to competing priorities. The revised recommendation date will be March 30, 2018. IT has been delayed in the evaluation of Virtual Mobile Workspace technology due to competing priorities. The revised recommendation date will be June 30, 2019. Open 3.1 The CMO ensure City Council approval is obtained prior to exceeding authorized expenditure authority. The CMO has reviewed the procedures for controlling mobile device spending with Budget and Finance and currently expenditures paid against a purchase The city implemented the Financial modules of Tyler Munis on July 1, 2018. The contracts module of Munis tracks expiration and renewal dates and all expenditures against a Closed _____________________________________________________________________________________ City Auditor’s Office 2 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status order and procurement cards are being analyzed to ensure expenditures are authorized. Additionally, the planned Enterprise Resource Planning software application has the ability to apply accounts payable expenditures and procurement card expenditures against the same purchase order. Staff is currently evaluating this functionality. The CMO will work with Budget and Finance to evaluate whether cell phone service should be exempt from the PO process by March 30, 2018. contract including purchase orders and procurement card transactions. The system has the ability to send notifications within a specified number of days prior to contract renewal or expiration. Additionally, expenditures cannot exceed the contract ‘not exceed amount” that is entered in the system. 3.2 The CMO ensure contracts are monitored and renewed, as appropriate, prior to their termination date. The CMO has reviewed the procedures for controlling mobile device spending with Budget and Finance and currently expenditures paid against a purchase order and procurement cards are being analyzed to ensure expenditures are authorized. Additionally, the planned Enterprise Resource Planning software application has the ability to apply accounts payable expenditures and procurement card expenditures against The city implemented the Financial modules of Tyler Munis on July 1, 2018. The contracts module of Munis tracks expiration and renewal dates and all expenditures against a contract including purchase orders and procurement card transactions. The system has the ability to send notifications within a specified number of days prior to contract renewal or expiration. Additionally, expenditures cannot exceed the contract ‘not exceed amount” Closed _____________________________________________________________________________________ City Auditor’s Office 3 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status the same purchase order. Staff is currently evaluating this functionality. The CMO will work with Budget and Finance to evaluate whether cell phone service should be exempt from the PO process by March 30, 2018. that is entered in the system. 4.1 Budget and Finance review and update FAP No. 4, including clarifying minimal personal use of City- owned devices, and train staff. The Budget and Finance Department will work with the City Manager’s Office to update the City’s mobile device policy by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 4.2 City Manager’s Office assign responsibility for review of mobile device usage to ensure devices are used appropriately for business purposes. Consistent with IRS Technical Guidelines, “the IRS will treat the value of any personal use of a cell phone provided by the employer primarily for noncompensatory business purposes as excludable from the employee’s income as a de minimis fringe benefit.” The CMO will work with Budget and Finance to revise FAP No. 4 consistent with the IRS Technical Guidelines by March 30, 2018. Departments are responsible for issuance of devices required by job duties. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 4.3 CMO assign responsibility for the cancelation or suspension of services for mobile The CMO will work with Budget and Finance to revise FAP No. 4 to assign the responsibility for management of The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open _____________________________________________________________________________________ City Auditor’s Office 4 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status devices not being used. devices, including cancelation or suspension of services for mobile devices not being used, to Department Directors by March 30, 2018. 4.4 CMO work with City departments to clarify their mobile device roles and responsibilities. The CMO will work with Budget and Finance to revise FAP No. 4 to assign the responsibility for management of devices to Department Directors by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 5.1 Budget and Finance review existing WSCA contracts or issue an RFP to ensure cost- effective mobile device services are provided. The Budget and Finance Department will review the existing WSCA contracts or issue an RFP for wireless service by March 30, 2018. The City Council approved an amendment to the Verizon contract extending the term of the agreement to June 30, 2019 on June 26, 2018. Additionally, Budget and Finance contracted with Cost Control Associates in August 2018 to review and audit utility and telecom bills for errors and identify opportunities for cost savings. The first report from the vendor is expected by January 31, 2019. Open 5.2 Budget and Finance consider consolidating providers and institute citywide standards for voice and data plans, equipment and accessories. The Budget and Finance Department will work with the CMO to review mobile device standards for equipment and plans as part of the update of FAP No. 4 by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open _____________________________________________________________________________________ City Auditor’s Office 5 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status 5.3 Budget and Finance review and update FAP No. 4 regarding responsibility for managing mobile device contracts, as appropriate. The Budget and Finance Department will work with the CMO to update the City’s mobile device policy by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 5.4 CMO assign responsibility for requesting and reviewing mobile device vendor optimization reports. The CMO will work with Budget and Finance to revise FAP No. 4 to assign the responsibility for management of devices to Department Directors by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 5.5 CMO develop controls to ensure only authorized employees are granted access to mobile device vendor account information. The CMO will work with Budget and Finance to revise FAP No. 4 to assign employees authorized to have access to mobile device vendor account information. Additionally, Materials Management will contact the mobile device vendors to ensure only authorized employees have access to online accounts. These items will be completed by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 6.1 Budget and Finance analyze and update allowance criteria and amounts, as applicable. The Budget and Finance Department will work with the CMO to update the City’s mobile device policy including updating allowance policies and procedures by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 6.2 Budget and Finance review and update mobile device The Budget and Finance Department will work with the CMO The Budget and Finance Department will update the City’s mobile device Open _____________________________________________________________________________________ City Auditor’s Office 6 Citywide Mobile Devices Follow-up Recommendation Management Response December 2017 Management Response November 2018 Status allowance policies and procedures. to update the City’s mobile device policy including updating allowance policies and procedures by March 30, 2018. policy by December 31, 2018. 6.3 City Management consider provision of device allowances in lieu of City-owned devices, as applicable, to enhance efficiencies and cost- effectiveness. The CMO will work with the Budget and Finance Department to update the City’s mobile device policy and consider revising device allowance guidelines by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open 7.1 Budget and Finance review and update FAP No. 4, including clarification that receipt of both a device allowance and City-owned device is prohibited. The Budget and Finance Department will update FAP No. 4 to clarify that receiving both a device and an allowance is prohibited by March 30, 2018. The Budget and Finance Department will update the City’s mobile device policy by December 31, 2018. Open