Professional Documents
Culture Documents
Maryland Department of Transportation Maryland Transit Administration
Maryland Department of Transportation Maryland Transit Administration
March 2022
To Report Fraud
The Office of Legislative Audits operates a Fraud Hotline to report fraud, waste, or abuse involving State
of Maryland government resources. Reports of fraud, waste, or abuse may be communicated anonymously
by a toll-free call to 1-877-FRAUD-11, by mail to the Fraud Hotline, c/o Office of Legislative Audits, or
through the Office’s website.
Nondiscrimination Statement
The Department of Legislative Services does not discriminate on the basis of age, ancestry, color, creed,
marital status, national origin, race, religion, gender, gender identity, sexual orientation, or disability in the
admission or access to its programs, services, or activities. The Department’s Information Officer has been
designated to coordinate compliance with the nondiscrimination requirements contained in Section 35.107
of the United States Department of Justice Regulations. Requests for assistance should be directed to the
Information Officer at 410-946-5400 or 410-970-5400.
March 11, 2022
Senator Clarence K. Lam, M.D., Senate Chair, Joint Audit and Evaluation Committee
Delegate Carol L. Krimm, House Chair, Joint Audit and Evaluation Committee
Members of Joint Audit and Evaluation Committee
Annapolis, Maryland
Our audit disclosed MTA lacked sufficient controls to ensure that union payroll
and pension payments were proper. Specifically, personnel transactions, such as
changes to pay rates, were not always reviewed by an independent employee. In
addition, MTA lacked procedures to ensure timesheets were approved by
employees’ immediate supervisors or to ensure pension payments were not made
to deceased individuals (either retirees or beneficiaries). Furthermore, MTA did
not periodically review user access to the automated personnel and payroll system
to identify employees with unnecessary or incompatible access and it had not
obtained the most recent report on the results of the independent control review of
the union payroll and pension processing services. MTA also did not take
comprehensive steps to ensure that programming errors in its new cloud-based
union payroll and pension processing system were corrected or that it had
recovered related overpayments.
Our audit also disclosed that MTA did not perform an independent verification of
bus fare collections from the initial record of receipt to amounts deposited in its
bank account to ensure collections were deposited intact and timely.
Based on our current audit assessment of significance and risk to our audit
objectives, our audit included a review to determine the status of 7 of the 11
findings contained in our preceding audit report. We determined that MTA
satisfactorily addressed 6 of these findings. The remaining finding is repeated in
the report.
Respectfully submitted,
2
Table of Contents
Background Information 4
Agency Responsibilities 4
Special Review Report Update 4
Resource Sharing Agreements 5
Status of Findings From Preceding Audit Report 5
Union Payroll
* Finding 1 – MTA had not established adequate controls over 8
certain aspects of its union personnel, payroll, and pension processes.
Finding 2 – MTA did not ensure that programming errors in its new 10
cloud-based system were corrected or recover related overpayments.
3
Background Information
Agency Responsibilities
During our current audit, we reviewed three procurements totaling $3.8 million
that involved the aforementioned related vendor, as well as the contract
monitoring process, and did not identify any reportable conditions.
4
Resource Sharing Agreements (RSAs)
Based on our current assessment of significance and risk relative to our audit
objectives, our audit included a review to determine the status of 7 of the 11
findings contained in our preceding audit report dated November 20, 2018 (prior
audit findings 4, 6, 7, and 10 were not reviewed). As disclosed in Figure 1, we
determined that MTA satisfactorily addressed 6 of those 7 findings. The
remaining finding is repeated in this report.
5
Figure 1
Status of Preceding Findings
Preceding Implementation
Finding Description
Finding Status
MTA used certain contracts as a means to obtain services that were
outside the scope of those contracts, circumventing competitive
Finding 1 procurement requirements, and related task orders lacked details of Not repeated
contract deliverables. Increases in hourly rates charged were excessive
based on MTA guidelines.
MTA did not always adhere to State procurement regulations with
Finding 2 respect to sole source procurements, contract award requirements, and Not repeated
bid documentation, and certain monitoring efforts were not adequate.
Proper internal controls were not established over the processing of
Finding 3 Not repeated
purchasing and disbursement transactions.
MTA used interagency agreements to circumvent State procurement Not repeated
Finding 4
regulations that require competitive bidding. (Not followed up on)
MTA did not follow up on the results of a review conducted by its
Office of Audits regarding payments made to and deliverables required
Finding 5 from a State university under an interagency agreement. The review Not repeated
disclosed, for example, approximately $725,000 in payments that
should be recovered.
Interagency agreements were not adequately monitored. Task orders
were not sufficiently detailed to allow for adequate monitoring and Not repeated
Finding 6
certain payments were not consistent with or were not provided for in (Not followed up on)
the related task orders.
MTA lacked adequate controls to ensure that only eligible individuals Not repeated
Finding 7
received Program services. (Not followed up on)
MTA had not established adequate controls over its union payroll and
Repeated
Finding 8 pension processes. All payroll employees had capabilities granting
(Current Finding 1)
them complete control over payroll transactions.
MTA did not adequately control and account for collections received at
Finding 9 its Consignment Center and Transit Store, and bus fare collections Not repeated
were not always deposited timely.
MTA did not ensure that all equipment purchases were properly Not repeated
Finding 10
recorded in its detailed equipment records. (Not followed up on)
Malware protection for MTA’s computers was not sufficient to provide
Finding 11 the MTA with adequate assurance that its computers were properly Not repeated
protected.
6
Findings and Recommendations
Union Payroll
Background
The Maryland Transit Administration (MTA) maintains labor agreements with
each of its three labor unions, which set forth employment terms for these
employees (including wages and pension benefit calculations). MTA is
responsible for all aspects of its union payroll and pensions, including tracking
employee pay rates and hours worked, maintaining pension and leave records,
posting adjustments to the payroll and pension records, and processing weekly
payroll payments via check or direct deposit. As noted in Figure 2, during
calendar year 2019, union payroll and pension expenditures totaled approximately
$240.6 million.
Figure 2
Union Payroll and Pension Expenditures
Calendar Year 2019
Number of Total
Labor Union Employees Expenditures
(as of 12/31/19) (in Millions)
Local 1300 – Bus and Rail Operators and
2,218 $178.1
Maintenance Employees
Local 1859 – MTA Police 169 14.1
Local 2 – Clerical Support Employees 168 8.7
Total Union Payroll 2,555 $200.9
Pensions (Local 2 and Local 1300)* 1,990 39.7
Total Union Payroll and Pension 4,545 $240.6
Source: MTA Payroll Reports
* Excludes Local 1859, since MTA police participate in the Law Enforcement
Officers’ Pension System administered by the Maryland State Retirement Agency.
The employers’ pension contribution is billed by the Agency to MTA, and not
processed through MTA’s union payroll system.
MTA contracted with a vendor to operate and maintain a cloud-based system used
to process payroll and pension payments for the MTA union employees and
pensioners. MTA transitioned from its legacy payroll system to the service
provider in April 2019. During the period October 2017 through June 2020 MTA
paid the vendor approximately $400,000 for these services.
7
Finding 1
MTA had not established adequate controls over certain aspects of its union
personnel, payroll, and pension processes.
Analysis
MTA had not established adequate controls over certain aspects of its union
personnel, payroll, and pension processes.
8
After we brought this issue to its attention, MTA agreed that these payments were
improper. A similar condition was commented upon in our preceding audit
report.
Recommendation 1
We recommend that MTA
a. ensure that independent supervisory personnel perform a documented
review to verify the propriety of critical personnel and payroll
transactions (repeat);
b. institute a policy requiring immediate or retroactive supervisory
approval of time recorded by its employees, including those initially
approved by the Payroll Department;
c. establish a process that ensures terminated employees are immediately
removed from the payroll system and take appropriate action to recover
any related improper payments, including those noted above (repeat);
and
d. perform periodic independent documented reviews of personnel and
payroll system user access and take appropriate corrective action for any
improper or unnecessary user access.
9
Finding 2
MTA did not ensure that programming errors in its new cloud-based system
were corrected or recover related overpayments.
Analysis
MTA did not take comprehensive steps to ensure that programming errors in its
new cloud-based union payroll and pension processing system were corrected or
recover related overpayments.
MTA advised us of certain programming errors it identified in May and July 2019
that had resulted in overpayments to 188 employees totaling approximately
$76,000. However, as of September 2020, MTA could not provide
documentation showing these overpayments had been recovered. Further, since
172 of the aforementioned errors occurred during one pay-period, MTA could not
document that it investigated the full extent of programming errors beyond the
errors previously identified, resulting in the potential for additional errors from
other pay-periods going undetected. Our limited review of 25 payroll transactions
totaling $126,979 to active employees during the period May 2019 through April
2020, disclosed questionable payments to 7 employees totaling $17,850. For
example, one employee was paid $12,962; however, the documentation provided
by MTA supported payment of $1,178. Initially, in November 2020 MTA
management advised us they were not able to explain the propriety of these
payments, but they believed the primary cause to be programing errors.
Ultimately, in October 2021 (11 months later) MTA management advised us that
their investigation of the 7 payments concluded that they believed the payments
were appropriate; although we did not assess the correctness of that conclusion.
Recommendation 2
We recommend MTA determine the full extent of programming errors and
recover any identified payroll overpayments caused by these errors.
Finding 3
MTA did not have sufficient procedures to ensure pension payments were
not made to deceased individuals. We identified payments to 14 individuals
totaling $81,610 subsequent to their reported date of death.
Analysis
MTA did not have sufficient procedures to ensure pension payments were not
made to deceased individuals (either retirees or beneficiaries). MTA management
advised us that they typically relied on notices from the public, for example the
pensioners’ dependent, to discontinue pension payments due to death, rather than
10
routinely obtaining death information from a reliable comprehensive source, such
as a government agency. During our audit period MTA performed one match in
June 2017 of its pensioner data to information maintained by the federal Social
Security Administration to identify deceased pensioners, which found no
deceased pensioners receiving pension payments.
We obtained MTA records of all pension payments as of April 30, 2020, and
performed a match of MTA pensioner information with Maryland Department of
Health – Vital Statistics Administration’s (VSA) death records as of September 3,
2020, which is limited to the deaths that occurred in Maryland. Our review
disclosed MTA paid $81,610 to 14 pensioners or beneficiaries for whom VSA
records indicated had died between February 2019 and May 2020.
After we brought this issue to MTA’s attention, we were advised that MTA was
unaware of the deaths of 10 of these individuals, with payments totaling
approximately $71,349. For the remaining 4 individuals, MTA advised us that
they had previously been notified of their death. However, of as December 2020,
MTA could not document that any effort had been made to recover payments
totaling $10,261 made subsequent to the 4 individuals’ dates of death.
Recommendation 3
We recommend that MTA
a. perform periodic (such as quarterly) matches to identify deceased
individuals; and
b. investigate the match results in consultation with legal counsel, and
pursue recovery of any improper payments (including those noted above),
documenting the actions taken.
Finding 4
MTA lacked assurance that adequate information technology security and
operational controls existed over its union payroll and pension processing
system that was hosted, operated, and maintained by a service provider.
Analysis
MTA lacked assurance that adequate information technology security and
operational controls existed over its union payroll and pension processing system
that was hosted, operated, and maintained by a service provider. Specifically, as
of May 2020, MTA had not obtained the most recent report on the results of the
independent control review (referred to as a System and Organization Control –
SOC 2 Type 2 review) of MTA’s union payroll and pension processing services
that were contracted with a service provider. At our request, MTA subsequently
11
obtained the most recent SOC 2 Type 2 review report, dated February 28, 2020.
The report covered the period from October 1, 2018 to September 30, 2019. Our
review concluded that the aforementioned SOC report did not disclose any
significant control weaknesses.
The American Institute of Certified Public Accountants has issued guidance for
various reviews of service organizations. Based on this guidance, service
organizations (like the aforementioned service provider) may contract for an
independent review of controls and the resultant independent auditor’s report is
referred to as a SOC report. The aforementioned SOC 2 Type 2 report includes
the results of the auditor’s review of controls placed in operation and tests of
operating effectiveness for the period under review and could include an
evaluation of system security, availability, processing integrity, confidentiality,
and/or privacy.
Recommendation 4
We recommend that MTA, for its union payroll and pension processing
system,
a. timely obtain and review copies of SOC 2 Type 2 reports, and verify that
the related service provider implemented all critical report
recommendations; and
b. document the aforementioned reviews and retain them for future
reference.
Finding 5
MTA did not perform an independent verification that all bus fare
collections were subsequently deposited.
Analysis
MTA did not perform an independent verification of bus fare collections from the
initial record of receipt to amounts deposited in its bank account. Bus fare
collections are placed into locked safes, which are transported daily to MTA’s
secured central money room where they are opened and the funds are counted and
prepared for bank deposit. According to MTA records, during fiscal years 2019
and 2020, cash bus fare collections totaled $25.6 million and $16.81 million,
respectively.
1
MTA halted bus fare collections during March 2020 through the end of the fiscal year due to
COVID-19 concerns.
12
Three MTA employees performed various tasks, which collectively were intended
to serve as a deposit verification. One employee compared the original
recordation of collections to documentation of the money room cash count, a
second employee compared the cash count to the deposit ticket prior to deposit,
and a third employee compared the bank records to the deposit amount recorded
in the State’s Financial Management Information System. However, the second
employee had access to the related cash and the ability to alter the documentation
of the cash count, and therefore was not independent. As a result, there was a
lack of assurance that all collections were deposited intact.
Recommendation 5
We recommend that MTA perform and document an independent
verification of bus fare collections from the initial record of receipt to
amounts deposited in its bank account. We advised MTA how to achieve the
necessary segregation of duties using existing personnel. For example,
Finance Department personnel could perform an independent verification
since its employees do not have access to collections.
13
Audit Scope, Objectives, and Methodology
We have conducted a fiscal compliance audit of the Maryland Department of
Transportation – Maryland Transit Administration (MTA) for the period
beginning December 23, 2016 and ending June 30, 2020. The audit was
conducted in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit
objectives.
Our audit did not include certain payroll support services (such as processing of
personnel transactions and maintenance of employee leave records) provided by
the Maryland Department of Transportation – Secretary’s Office (MDOT) to
MTA for its non-union management payroll. These payroll support services are
included within the scope of our audit of MDOT. Our audit also did not include
an evaluation of internal controls over compliance with federal laws and
regulations for federal assistance programs and an assessment of MTA’s
compliance with those laws and regulations because the State of Maryland
engages an independent accounting firm to annually audit such programs
administered by State agencies, including MTA.
14
Our assessment of internal controls was based on agency procedures and controls
in place at the time of our fieldwork. Our tests of transactions and other auditing
procedures were generally focused on the transactions occurring during our audit
period of December 23, 2016 to June 30, 2020, but may include transactions
before or after this period as we considered necessary to achieve our audit
objectives.
We also performed various data extracts of pertinent information from the State’s
Financial Management Information System, and MDOT’s Financial Management
Information System (such as revenue and expenditure data). The extracts are
performed as part of ongoing internal processes established by the Office of
Legislative Audits and were subject to various tests to determine data reliability.
We determined that the data extracted from these sources were sufficiently
reliable for the purposes the data were used during this audit.
We also extracted data from MTA’s new automated union personnel, payroll, and
pension system, as well as the bus fare system for the purpose of testing payroll,
pension, and cash receipt transactions. We performed various tests of the relevant
data and determined that the data were sufficiently reliable for the purposes the
data were used during the audit. Finally, we performed other auditing procedures
that we considered necessary to achieve our audit objectives. The reliability of
data used in this report for background or informational purposes was not
assessed.
15
provided in Government Auditing Standards, there are five components of
internal control: control environment, risk assessment, control activities,
information and communication, and monitoring. Each of the five components,
when significant to the audit objectives, and as applicable to MTA, were
considered by us during the course of this audit.
Our reports are designed to assist the Maryland General Assembly in exercising
its legislative oversight function and to provide constructive recommendations for
improving State operations. As a result, our reports generally do not address
activities we reviewed that are functioning properly.
16
APPENDIX
Maryland Department of Transportation
Maryland Transit Administration
Union Payroll
Finding 1
MTA had not established adequate controls over certain aspects of its union personnel,
payroll, and pension processes.
Agency Response
Analysis
Please provide None.
additional comments as
deemed necessary.
Page 1 of 7
Maryland Department of Transportation
Maryland Transit Administration
Page 2 of 7
Maryland Department of Transportation
Maryland Transit Administration
Finding 2
MTA did not ensure that programming errors in its new cloud-based system were
corrected or recover related overpayments.
We recommend MTA determine the full extent of programming errors and recover any
identified payroll overpayments caused by these errors.
Agency Response
Analysis
Please provide MTA disagrees that there were programming errors in the payroll system
additional comments as which inappropriately paid employees. MTA reviewed the examples
deemed necessary. provided by OLA and provided OLA with documentation that the
programming and payments for these employees were accurate.
Recommendation 2 Agree Estimated Completion Date: 6/30/2022
Please provide details of MTA agrees that overpayments were made to the 188 employees noted;
corrective action or however, these payments were the result of not following standard
explain disagreement. protocols for updates which include a process of developing a project for
all changes input into the payroll system, testing and formal approval
followed by implementation. This particular payment issue occurred at
the beginning of the payroll system implementation during the
transitional period and the standard procedure may not have been
followed, but that will not occur in the future now that processes have
been standardized. In order to recover the payments, MTA is working
with various State agencies and its legal counsel to develop a process for
recouping these overpayments-
Auditor’s Comment: Although MTA disagrees with our analysis, during our field work
they advised us that the overpayments were the result of programming errors and they
were not able to provide us support for the cause of these errors. Nonetheless, MTA does
agree that errors occurred resulting in employee overpayments, and their response
indicates they have corrected the issues that caused the errors.
Page 3 of 7
Maryland Department of Transportation
Maryland Transit Administration
Finding 3
MTA did not have sufficient procedures to ensure pension payments were not made to
deceased individuals. We identified payments to 14 individuals totaling $81,610 subsequent
to their reported date of death.
Agency Response
Analysis
Please provide None.
additional comments as
deemed necessary.
Page 4 of 7
Maryland Department of Transportation
Maryland Transit Administration
Finding 4
MTA lacked assurance that adequate information technology security and operational
controls existed over its union payroll and pension processing system that was hosted,
operated, and maintained by a service provider.
We recommend that MTA, for its union payroll and pension processing system,
a. timely obtain and review copies of SOC 2 Type 2 reports, and verify that the related
service provider implemented all critical report recommendations; and
b. document the aforementioned reviews and retain them for future reference.
Agency Response
Analysis
Please provide None.
additional comments as
deemed necessary.
Page 5 of 7
Maryland Department of Transportation
Maryland Transit Administration
Finding 5
MTA did not perform an independent verification that all bus fare collections were
subsequently deposited.
We recommend that MTA perform and document an independent verification of bus fare
collections from the initial record of receipt to amounts deposited in its bank account. We
advised MTA how to achieve the necessary segregation of duties using existing personnel.
For example, Finance Department personnel could perform an independent verification
since its employees do not have access to collections.
Agency Response
Analysis
Please provide MTA believes the background and analysis documented in the Finding
additional comments as does not depict the entire deposit verification and reconciliation process.
deemed necessary. There are more than three employees involved in the deposit verification
and reconciliation that include multiple individuals preparing and
confirming deposit values and reporting accuracy. Additionally, this in-
depth process also includes procedures performed by individuals in
separate areas and offices within MTA from receipt of funds to the
reconciliation of funds to the bank account.
Upon further discussions with OLA and MTA’s rebuttal of the finding,
OLA advised that their main concern within the reconciliation process
was what they perceive as a lack of independence due to the second
employee’s access to cash and the spreadsheet documenting the count.
Page 6 of 7
Maryland Department of Transportation
Maryland Transit Administration
MTA will ensure the cash deposit amount represented by the actual
deposit slip, independently obtained from Finance, is used by the
Manager of Fare Services to verify the deposit records which are
reconciled to the system reports. This process will provide further
assurance that no cash shortages in the deposit are covered through
altering counting records. This process was formally implemented on
January 24, 2022, with verifications to be completed daily.
Auditor’s Comment: MTA’s response indicated that there are more than three
employees involved in the deposit verification and reconciliation that include multiple
individuals preparing and confirming deposit values and reporting accuracy. While we
agree that MTA has multiple employees that perform various duties related to cash
receipts, the three employees we noted had the primary duties which collectively were
intended to serve as a deposit verification.
MTA’s response indicates that observation or a physical walkthrough of the bus fare
collections process would have assisted us in obtaining an understanding of the controls.
Our conclusions were based on audit evidence including interviews with pertinent
personnel, and obtaining documentation from MTA regarding the cash receipt processes.
While observation is a form of audit evidence, we believe we obtained a sufficient
understanding of the bus fare collection process, and our conclusions are valid.
Page 7 of 7
AUDIT TEAM
Mark S. Hagenbuch, CPA
Audit Manager
Karen J. Howes
Joshua A. Naylor
Senior Auditors
Peter W. Chong
Information Systems Senior Auditor