HomeMy WebLinkAbout2021-6 Munis Purchasing topics Part II-Vendor master report (Final 3-8-21)County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
County accounting system (MUNIS)
purchasing topics
Part II – Vendor master
To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org
Deschutes County,
Oregon
David Givans, CPA, CIA
Deschutes County Internal Auditor
1300 NW Wall St
Bend, OR 97703
541-330-4674
David.Givans@deschutes.org
Audit committee members:
Daryl Parrish, Chair - Public member
Jodi Burch – Public Member
Tom Linhares - Public member
Scott Reich - Public member
Summer Sears – Public member
Stan Turel - Public member
Patti Adair, County Commissioner
Nancy Blankenship, County Clerk
Nick Lelack, Community Development Director
Take a survey by
clicking HERE
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
TABLE OF
CONTENTS:
HIGHLIGHTS
1. INTRODUCTION
1.1. Background on the Audit …………..…………….………………………………………. 1
1.2. Objectives and Scope ……………….……..…………….…………….……..………… 1-2
1.3. Methodology ………………………………….………….…………………………..……… 2-3
1.4. Background on vendor master (Tyler Munis) …………………….……..…… 3-5
2. FINDINGS and OBSERVATIONS
2.1. Vendor master observations and findings ……………..………………….… 5-13
3. MANAGEMENT RESPONSE
3.1. Finance …………………………………………..……………..……….…………..... 14-17
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
HIGHLIGHTS
Why this audit was
performed:
The County transitioned
to a new integrated
accounting and human
resource system.
What was
recommended:
Recommendations
include:
• documenting
expectations for
documentation with
vendor additions and
changes.
• considering how to
implement electronic
signature.
• considering vendor self-
service.
• periodically reviewing
and resolving incorrect
or duplicated taxpayer
identification numbers.
• periodically inactivating
vendors with no activity.
• Setting up vendors to
search for duplicate
invoices.
Part II - Vendor master
The focus of this audit work is on purchasing topics for the County accounting system (Tyler
Munis). The audit looked at how additions and changes get made to the vendor master file.
The vendor master file is an important internal control that ensures purchasing and
payment of goods and services is appropriate and that only legitimate County vendors are
paid. The County’s vendor master has over six thousand vendor records.
What was found
During the audit, it was observed that vendor change documentation improved but
additional improvements warranted.
• Recent use of forms with digital signatures raises the question on the practices of
accepting electronic signatures.
• Using vendor self-service in Munis could provide vendors with web-based access to
information stored in the Munis accounting system and safe means to update their
information.
• The vendor master had limited duplicates.
Some of the other areas noted for improvement included:
• Thirty-two percent (32%) of vendors in Munis have never been paid. Many of these
are vendors brought over from the old accounting system.
• Two percent of active vendors were setup to allow the use of duplicate invoice
numbers in Munis preventing identification of potential duplicates and raises the
chances of making duplicate payments.
• The County has additional opportunity to improve the use of electronic payments as
20% of payments occur electronically.
• Tax information reporting information was not present on five percent of active
vendors. Some W-9 support was not attached to the vendor record.
Deschutes County Internal Audit
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 1
1.
Introduction
1.1 BACKGROUND ON THE AUDIT
Audit Authority:
The Deschutes County Audit Committee authorized the review of purchasing topics for the County
Accounting system (Tyler Munis) with the FY 21 internal audit workplan. Purchasing topics will
include procurement cards, new procurement workflows, and other adopted technology with the
new accounting system.
The overall topic was divided up due to the complexity of the topic and to release findings in a
timelier manner. The first report issued in this series was on security and approval workflows
(report #19/20-9). This included work on vendor approvals. It would be beneficial to review at least
the background of the report for background on the Munis accounting system.
This report focuses on vendor controls with administration of the vendor master. Additional
anticipated report topics to be released from this work based on the audit objectives below will
include:
1) Procurement cards and
2) Purchasing analyses
1.2 OBJECTIVES and SCOPE
“Audit
objectives” define
the goals of the
audit.
Objectives included: (addressed in prior report or carried over to future report)
1) (Report 19/20-9) Assess and evaluate the security roles and approval workflows established for
processing purchases through Munis.
2) Assess and evaluate risks to the vendor master file. The vendor master file manages who and how
payments are made to vendors.
a) Changes and associated support
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 2
b) (Report 19/02-9) Segregation of duties and access
3) (Future report) Assess and evaluate the use of County issued procurement cards.
4) (Future report) Analyze purchases in a number of areas, including
a) Effectiveness of approvals
b) Duplicates search
c) Use of discounts
d) Whether transactions have been split to avoid proper approvals or purchasing requirements
e) Benford’s analysis – identifies unusual disbursement amounts.
5) Be aware of any issues with compliance with federal and state regulations and requirements, as may
be applicable.
Scope and timing:
The overall audit commenced in March 2020. The work was interrupted by a pressing audit request
from the Board of County Commissioners and Budget committee. Work re-commenced in
September 2020. Work on vendor master was refreshed through December 2020 and January
2021. Amounts paid (for compositional analyses) were taken from check activity from 2017 through
2020. The scope of the audit did not include all aspects of internal controls employed. The
accounting system is only partly represented in Munis as there are numerous other internal control
systems in place at the County including administrative, budgetary, and legal. The work occurred
during the COVID-19 pandemic.
1.3 METHODOLOGY
“Audit procedures
are created to
address the audit
objectives”
Audit procedures relevant to the reported topics in this report include:
• Interviewing staff related to accounting system questions.
• Reviewing associated accounting system documentation
• Analyze background information on purchasing and vendors within Munis
• Analyses of vendors and associated settings.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 3
• Review for changes and additions of vendors.
o Review focused on support and approvals for bank authorizations and remittance
addresses. Bank account changes reviewed from April 2020 through December 2020.
Remittance address changes reviewed for December 2020.
• Review of State rules regarding electronic transactions. Discuss application of rules with
County counsel.
We conducted this performance audit in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
(2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.)
The County Internal Auditor was created by the Deschutes County Code as an independent office
conducting performance audits to provide information and recommendations for improvement.
1.4 BACKGROUND ON VENDOR MASTER IN THE COUNTY ACCOUNTING SYSTEM (Tyler MUNIS)
The County
vendor master has
over six thousand
vendors.
The vendor master file is an important internal control that ensures purchasing and payment of
goods and services is appropriate and that only legitimate County vendors are paid. The vendor
master file is a database that contains a considerable amount of data on vendors doing business
with the County. As such, it is important that best practices are employed when adding, maintaining,
and inactivating vendors.
The vendor master file is s achieved through coordination with County departments and the Finance
department. It is up to everyone to make sure accurate and complete information is provided.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 4
15% of
vendors are
designated for
employee
reimbursement.
Munis allows supporting information and documentation to be attached to the vendor record. To
setup a new vendor in the vendor master file, designated employees within each department collect
the required information from the vendors and enter it in Munis for review by Finance. Finance
staff currently use an add/change form to research, verify, and document the addition or change.
Part of that process is assuring any additions are not duplicating other vendor entries and obtaining
tax reporting information before payments can be processed.
The vendor master file is composed of vital business information for individuals or businesses that
provide goods and services to the County. This important vendor information includes business
name, remittance address, tax identification number, and sometimes includes bank routing and
account information. This information is stored and maintained in Munis including digital images of
supporting documentation. Munis also maintains an audit trail of the changes and approvals.
The vendor master file ensures proper tax information reporting occurs if proper information has
been collected. The Internal Revenue Service (IRS) requires that certain vendors be issued a form
1099 at year-end summarizing the payments made. The County may incur penalties if the 1099s are
not issued properly.
In addition to vendors that provide contracted goods and services, the vendor master file also
contains vendor records related to employee reimbursements, refunds and rebates for utility
customers, refunds, and other one-time payments.
As of January 2021, there were 6,395 vendors in the vendor master file. Table I shows the count
and composition of vendors by status.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 5
TABLE I
Vendor master file
status composition
and count
Status Count
% on
Count Description of status
A (Active) 6,079 95% Vendors actively doing business with the County. Allows payments to be
processed.
I (Inactive) 192 3% Vendors that are not currently doing business with the County and are not able
to be paid. Does allow a requisition or contract to be assigned to them.
S (Stop) 105 2% Vendors that are not currently doing business with the County and are not able
to be paid. They are not allowed to have a requisition or contract assigned to
them.
Other status
types
19 0% Identified as another status type.
Total 6,395
Source: Munis vendors summarized as of 1/11/2021.
Of the active vendors, approximately 15% are designated for employee reimbursement. These do
not amount to much in spending compared to the other types.
2. Findings
and
Observations
The audit included limited procedures to understand the systems of internal control around the
vendor master. No significant deficiencies were found in this audit. A significant deficiency is
defined as an internal control deficiency that could adversely affect the entity’s ability to initiate,
record, process, and report financial data consistent with the assertions of management in the
financial statements. The findings noted were primarily compliance and efficiency matters.
Audit findings result from incidents of non-compliance with stated procedures and/or departures
from prudent operation. The findings are, by nature, subjective. The audit disclosed certain
policies, procedures and practices that could be improved. The audit was neither designed nor
intended to be a detailed study of every relevant system, procedure or transaction. Accordingly, the
opportunities for improvement presented in the report may not be all-inclusive of areas where
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 6
improvement may be needed and does not replace efforts needed to design an effective system of
internal control.
2.1 VENDOR MASTER OBSERVATIONS AND FINDINGS
Advisory notice!
Vendor change documentation has improved but additional improvements
warranted.
A number of improvements were noted that staff implemented during the course of the audit.
These in particular help assure better oversight and control over the changes that occur to the
vendor master file for important areas like setting up electronic payments and changes to
remittance addresses. These included:
• Adding a Finance supervisor’s approval to approval workflow for vendor additions and
changes.
• Implemented a new ACH form for electronic banking authorizations.
• Updated internal Finance form for review of additions and changes to the vendor master.
These were in addition to existing procedures and practices for substantiating vendor additions and
changes.
There are evolving concerns around criminal attempts to modify vendor payment information. The
Government Financial Officers Association (GFOA) has issued an advisory notice indicating
governments should put safeguards and internal controls in place to mitigate the risk of fraudulent
vendor payment activity. They indicate vendor fraud is often associated with submitting fake
documentation to change the bank routing and account numbers for electronic vendor payment
deposits. GFOA recommends that governments use electronic payments to improve efficiency,
security, and tracking.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 7
It was noted that some vendor changes reviewed lacked effective documentation of the change.
Some changes made lacked consistent use of Finance forms and procedures. It wasn’t clear if
certain digitally provided forms represented valid electronically signed forms.
The County’s cyber-security insurance emphasizes the importance of vendor controls. The County
should strive to comply with any expectations from the insurance provider and as committed to by
the County.
In the absence of proper control over vendor information or making changes without the request of
a valid vendor, the County might not be able to recover payments made in error.
It is recommended for Finance to consider and clearly document expectations for documentation
with vendor additions and changes.
• This might include establishing with vendors expectations and contacts for a confirmation process.
• This might also include direct calls to the payment receiving bank.
• This recommendation might be influenced by implementation of a vendor self-service portal as
described below.
{The prior recommendation in report 1920-9 to complete written policies and procedures for
purchasing practices should include the vendor master file and incorporate associated responses to
the recommendations in this report.}
1. Additional discussion of electronically presented signatures.
Finance has recently started accepting forms with electronic signatures. However, it does not
appear those signatures provide any confirmation of the identity of the signer. This poses a
potential risk in making changes to the vendor records with such documents.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 8
Oregon has provided guidance with ORS 84 for Electronic transactions. The County “shall
determine whether, and the extent to which, it will send and accept electronic records and
electronic signatures to and from other persons and otherwise create, generate, communicate,
store, process, use and rely upon electronic records and electronic signatures”.
The Covid pandemic has resulted in a number of processes that have pushed the County
towards accepting digitally signed documents. However, without properly implementing
electronic signatures; understanding the technology; and addressing any inherent integrity or
validity issues, the completed forms may not be legally sufficient.
Potential for changes in remittance and payment without sufficient authority can result in
monies being sent to a fictitious person/entity.
It is recommended for the County to consider how to implement electronic signatures
across County departments and functions based on the associated risks and requirements.
2. Additional discussion of vendor self-service in Munis.
Vendor self-service provides vendors with web-based access to information stored in the
Munis accounting system. The information is drawn from multiple Munis products, including
accounts payable, purchasing, and bid management. Vendors can enter and maintain their
contact and remittance information, discount and payment terms, designated contact
persons, and a list of commodity codes that represent the goods and services the vendor can
provide. It also provides information on the vendor’s current and prior 1099 data, purchase
orders, invoices, contracts, bids, and checks.
The vendor self-service system can provide vendors with timely information and the ability to
update and change their own information. This assumes the representatives of the vendor
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 9
apply appropriate changes. The County would still have the ability to approve any changes
submitted.
The County has not yet adopted vendor self-service. This system has a lot of similarity to
employee self-service which is currently in use for County employee information, benefit and
compensation elections, and wage information. Deschutes uses two self-service portals with
Munis and staff indicate mixed results with the product and the support. Staff have heard
there may be some new software coming that could also be used.
In the absence of vendor self-service, County staff (and Finance staff) will have to continue
making and approving changes for vendors and assuring the validity of those changes. This is
at a higher risk than letting the vendors make the changes directly.
It is recommended for Finance to consider establishing vendor self-service to collect vendor
information directly from vendors.
The self-service modules provided by Munis have varying degrees of success and choosing to
use vendor self-service will require additional research to see if adoption is worthwhile at
this time.
Few duplicates found in analysis of vendor master file.
The audit used data analyses software to identify likely duplicates. Some duplicate vendors were
identified through review of same taxpayer identification numbers, bank accounts, and same or
similar addresses.
• Three (3) duplicate vendors identified by taxpayer identification number;
• Nine (9) vendor records had fictitious taxpayer identification numbers that should be
resolved, if appropriate.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 10
• Identified a number of vendors for employee reimbursement with the same bank account.
On review, these appeared to be between employee spouse/partners and were appropriate.
• Noted no active vendor duplicates on bank account numbers. Currently, there are not many
vendors setup for electronic payment.
Duplicate vendor entries raises the potential for using an improperly updated vendor and can result
in duplicated payments. It isn’t always clear if a vendor is tied to an employee for employee
reimbursement, for which no tax information reporting is required.
It is recommended for Finance to periodically review and resolve incorrect or duplicated taxpayer
identification numbers in the vendor master file.
GRAPH I
Composition of
vendors that have
received
payments.
July 2016 through December
2020
Results from additional vendor master analyses and areas for improvement.
• Thirty-two percent (32%) of vendors in Munis
have never been paid. Many of these are vendors
brought over from the old accounting system.
Inactive vendors use resources and have the
potential of being selected inadvertently for
payment.
Periodically cleaning vendor files of inactive vendors
decreases the opportunity for payment errors and
fraudulent vendor practices and increases system
efficiency.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 11
• A number of vendors were setup to allow the use of duplicate invoice numbers in Munis. 147
vendors (roughly 2% of active vendors) were characterized as being able to have duplicate
invoice numbers.
This prevents the software from effectively flagging invoices that may be duplicates and raises
the chances of making duplicate payments.
• Identified a number of vendors for employee reimbursements that were not properly identified
as an employee type vendor (“EMP”) and without the associated employee number.
• Tax information reporting information was not present on five percent (5%) of active vendors.
Some W-9 support was not attached to the vendor record. Some of the tax information entries
(or lack of entries) were vendors brought over from the old accounting system and it is not clear
why these didn’t get resolved prior to bringing in to the new accounting system.
W-9’s providing relevant tax reporting information should be collected for all vendors.
{These vendors were provided to Finance for additional follow-up}
• It is not clear the County is pursuing all of the discounts available to it with vendors. Only one
vendor was setup with a discount. That vendor had provided a discount which reduced the
payment recorded in the system.
The County has not further encouraged departments to record discounts. Prior to Munis, the
County could not always process payments quickly enough to receive quick payment discounts.
However, since moving to Munis, the County is making weekly payments to vendors.
• Only a limited number of vendors are being paid electronically. Electronic payments are more
efficient than printed checks.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 12
GRAPH II
Composition of
vendors by form of
payment
GRAPH III
Composition of
vendor types
“Other” is
the most
prominent vendor
type.
The County has additional opportunity to improve the use of electronic payments.
• Only a limited number of vendor types are being used in Munis.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 13
Most vendors are indicated as "Other" even though there are a myriad of vendor types available. By
not using appropriate vender types, useful information for future analyses of vendors providing
certain services cannot be made effectively. This might help with RFP's and requests for bids for
future services.
It is recommended the County periodically inactivate vendors with no activity.
It is recommended all vendors be setup to search for duplicate invoices.
{The next audit will perform invoice analyses to identify potential duplicate payments.}
It is recommended for all vendors established for employee reimbursement be associated to the
employee. (Vendor type should be “EMP” and should be associated with employee number}
It is recommended for the Finance Department to periodically review their vendor master lists for
missing W-9 and tax information.
It is recommended all vendors have their completed W-9 attached to their record and their
taxpayer information number entered.
It is recommended that Finance and County departments investigate if they are receiving all of the
discounts they can get by paying in a timely manner.
It is recommended for Finance to work with departments to utilize the discounts field when
discounts are available.
It is suggested that vendors be evaluated as to whether a better type could be assigned that
better reflects the service or product they provide.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 14
3. Management response
Finance
Department
Greg Munn,
Chief Financial
Officer and
Treasurer
DATE: March 2, 2021
TO: David Givans, County Internal Auditor
FROM: Greg Munn, Treasurer and Chief Financial Officer
CC: Tom Anderson, County Administrator
SUBJECT: Response to Munis System Audit, Part II – Vendor Master Report #2021-6
_____________________________________________________________________________________________________________________________
1. It is recommended for Finance to consider and clearly document expectations for documentation
with vendor additions and changes.
Agreed.
• This might include establishing with vendors expectations and contacts for a confirmation process.
Vendor expectations and contact requirements are listed on the Current Vendor Application Form (updated Jan.
2021).
• This might also include direct calls to the payment receiving bank.
We don’t believe this is consistent with bank policies but will confirm.
• This might be influenced by vendor self-service portal as described below.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 15
Finance
Department
(continued)
2. It is recommended for the County to consider how to implement electronic signatures across
County departments and functions based on the associated risks and requirements.
Agreed. This would be a worthwhile discussion at the county-wide level. Until then the Finance department will
continue to authenticate vendor applications and W-9 submissions, regardless of the signature method.
3. It is recommended for Finance to consider establishing vendor self-service to collect vendor
information directly from vendors.
The self-service modules provided by Munis have varying degrees of success and choosing to use vendor
self-service will require additional research to see if adoption is worthwhile at this time.
Agreed. This is a worthwhile discussion for a future improvement. We have several concerns including the
amount of staff time required (does it save time or cost time?); additional training requirements; change
management timing; and, liability for changes made that are inconsistent with IRS 1099 requirements, for
example.
4. It is recommended for Finance to periodically review and resolve incorrect or duplicated taxpayer
identification numbers in the vendor master file.
Agreed. Finance has added this as a semi-annual review to our processes; once at the beginning of the fiscal
year and once during the preparation of 1099s.
5. It is recommend the County periodically inactivate vendors with no activity.
Agreed. A vendor clean up initiative will be started this spring and will be added to our annual procedures.
6. It is recommended all vendors be setup to search for duplicate invoices. {The next audit will perform
invoice analyses to identify potential duplicate payments.}
Agree. We will implement a naming/numbering convention for non-invoice payments (mostly employee expense
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 16
Finance
Department
(continued)
and mileage reimbursements) similar to how we identify utility payments which are traditionally paid based on
a monthly statement (invoices aren’t used).
7. It is recommended for all vendors established for employee reimbursement be associated to the
employee. (Vendor type should be “EMP” and record should be associated with employee number}
Agree. This will be part of the vendor clean up initiative mentioned above in #5.
8. It is recommended all vendors have their completed W-9 attached to their record and their
taxpayer information number entered.
Agree. This will be part of the vendor clean up initiative mentioned above in #5.
9. It is recommended that all vendors have their completed W-9 attached to their record and their
taxpayer information number completed.
Agree. This will be part of the vendor clean up initiative mentioned above in #5.
10. It is recommended that Finance and County departments investigate if they are receiving all of
the discounts they can get by paying in a timely manner.
Agree. We will explore this further. These discounts are often taken at the invoice level. We intend to add this to
our Vendor Application, so we can be alerted to these discounts. Also, we will seek guidance/training about how
to set these up at the vendor level.
11. It is recommended for Finance to work with departments to utilize the discounts field when
discounts are available.
Agree. See response to #10. This will be a good training opportunity for the new business systems
administrator.
County accounting system (MUNIS) purchasing topics: Part II – Vendor master file report #2021-6 March 2021
Page 17
Finance
Department
(continued)
12. It is suggested that vendors be evaluated as to whether a better type could be assigned that
better reflects the service or product they provide.
Agree. This will require further evaluation to determine whether this would provide a value add and will be
reviewed by our new business systems administrator.
{End of Report}
Please take a survey on this report by clicking on the attached link:
https://www.surveymonkey.com/r/Vendor_Master_2021-6
If you would like to receive future reports and information from Internal Audit or
know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.