Recommendations

December 2015 Judicial Branch Procurement Although the Judicial Council Needs to Strengthen Controls Over Its Information Systems, Its Procurement Practices Generally Comply With Applicable Requirements Report 2015-302 COMMITMENT INTEGRITY LEADERSHIP The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the California State Auditor’s Office at the following address: California State Auditor 621 Capitol Mall, Suite 1200 Sacramento, California 95814 916.445.0255 or TTY 916.445.0033 OR This report is also available on our website at www.auditor.ca.gov. The California State Auditor is pleased to announce the availability of an online subscription service. For information on how to subscribe, visit our website at www.auditor.ca.gov. Alternate format reports available upon request. Permission is granted to reproduce reports. For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. For complaints of state employee misconduct, contact the California State Auditor’s Whistleblower Hotline: 1.800.952.5665. Elaine M. Howle State Auditor Doug Cordiner Chief Deputy December 10, 2015 2015‑302 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As required by California Public Contract Code, Section 19210, the California State Auditor (state auditor) presents this audit report concerning the procurement policies and practices of the Judicial Council of California (Judicial Council). The California Public Contract Code generally governs how state entities should enter into contracts and acquire goods and services. Enacted in 2011, the California Judicial Branch Contract Law (judicial contract law) requires judicial branch entities to follow procurement and contracting policies that are consistent with the California Public Contract Code and substantially similar to the provisions contained in the State Administrative Manual and the State Contracting Manual. In addition, judicial contract law requires the Judicial Council to adopt and adhere to the Judicial Branch Contracting Manual (judicial contracting manual), and to submit semiannual reports to the Legislature and state auditor itemizing most of its contracting activities. This report concludes that the Judicial Council is generally complying with the judicial contract law and has corrected nearly all of the problems with its procurement and payment practices that we identified in our audit report published in December 2013. In our previous report we found that the Judicial Council did not always competitively bid contracts as required, correctly score vendor bids, or document its reasons for using a non‑competitive procurement process. For this audit we reviewed 60 procurements and found that in each instance the Judicial Council followed relevant procurement requirements. We also found that accounting staff correctly followed the Judicial Council’s payment process for the 60 payments we reviewed. Judicial Council staff are in the process of correcting one deficiency we found: the judicial contracting manual does not include required standards related to the minimum fuel economy of purchased vehicles. In contrast to the progress it has made in its procurement policies and practices, the Judicial Council has not fully implemented the controls required to address the pervasive weaknesses we identified in the general controls over its information systems. The two information systems whose general controls we reviewed contain data that the Judicial Council uses for its day‑to‑day operations, and for creating the semiannual reports. The weaknesses we identified continue to compromise the security and availability of these information systems. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor 621 Capitol Mall, Suite 1200 Sacramento, CA 95814 916.445.0255 916.327.0019 fax www.auditor.ca.gov Blank page inserted for reproduction purposes only. California State Auditor Report 2015-302 v December 2015 Contents Summary 1 Introduction 5 Audit Results The Judicial Council of California Has Improved Its Procurement and Vendor Payment Practices 13 The Judicial Branch Contracting Manual Is Largely Consistent With the State’s Policies, but It Could Benefit From One Important Update 16 The Judicial Council’s Local Contracting Manual Contains All Required Information 18 Although Its Procurement Information Is Now Available in a Useful Electronic Format, the Judicial Council Still Needs to Strengthen Controls Over Its Information Systems 19 Recommendations 23 Response to the Audit Judicial Council of California 25 California State Auditor’s Comment on the Response From the Judicial Council of California 29 vi California State Auditor Report 2015-302 December 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2015-302 1 December 2015 Summary Audit Highlights . . . Results in Brief Our audit of the procurement practices by the Judicial Council of California Our review of procurement practices by the Judicial Council of (Judicial Council) highlighted the following: California (Judicial Council) found that it is generally complying » The Judicial Council has corrected nearly with the requirements of the 2011 California Judicial Branch all the problems with its procurement and Contract Law (judicial contract law) and with the provisions of payment practices that we identified in the Judicial Branch Contracting Manual (judicial contracting December 2013. manual).1 As required by the judicial contract law, the Judicial Council maintains the judicial contracting manual, which outlines • All 23 competitively bid procedures for Judicial Council personnel and the personnel of procurements that we reviewed all other entities within the State’s judicial branch to follow when were appropriately evaluated. procuring goods and services. The results of our audit indicate that the Judicial Council has corrected nearly all of the problems • All 37 noncompetitive procurements were with its procurement and payment practices that we identified in properly approved and documented. our December 2013 report.2 These problems included instances » The judicial contracting manual was in which the Judicial Council incorrectly scored vendors’ bids generally consistent with state law, and instances in which it did not document its justification for the State Administrative Manual, using a noncompetitive, sole‑source procurement process. To and the State Contracting Manual. evaluate the Judicial Council’s compliance with procurement requirements, we reviewed 60 of its procurements that occurred » The Judicial Council has not resolved between July 2013 and June 2015. We found no additional instances prevalent weaknesses in the general of the procurement and payment problems that we had previously controls over its information systems and identified. For example, for the 23 competitively bid procurements as a result it continues to compromise that we reviewed, the Judicial Council correctly evaluated each the security and availability of its vendor‑submitted bid according to the appropriate evaluation sensitive information. methodology outlined in the judicial contracting manual. In addition, we reviewed 37 noncompetitive procurements and found » In response to our previous that the Judicial Council obtained approvals and documented recommendation, the Judicial Council is their process for ensuring prices were fair and reasonable for each now making its semiannual procurement one as required. reports available in a sortable electronic format. State law requires that the policies and procedures in the judicial contracting manual be consistent with the California Public Contract Code and substantially similar to the provisions contained in the State Administrative Manual and the State Contracting Manual. We found that the judicial contracting manual’s policies generally met these requirements with one exception: the judicial contracting manual does not include a reference to fuel economy standards applicable to the judicial branch’s vehicle purchases that were recently added to the State Administrative Manual. 1 We use the name Judicial Council in this report to refer collectively to the Judicial Council’s policymaking body and to its support staff. The policymaking body approves procurement‑related policies, and the support staff conducts the procurement and payment activities. 2 Judicial Branch Procurement: Semiannual Reports to the Legislature Are of Limited Usefulness, Information Systems Have Weak Controls, and Certain Improvements in Procurement Practices Are Needed, Report 2013‑302 and 2013‑303, December 2013. 2 California State Auditor Report 2015-302 December 2015 Judicial Council staff indicated that they would take steps to resolve this deficiency. Further, we confirmed that the Judicial Council’s local contracting manual (local manual) includes information that the judicial contracting manual requires local manuals to address. In contrast to the progress it has made in its procurement policies and practices, the Judicial Council has still not resolved prevalent weaknesses in the general controls over its information systems. In our December 2013 audit report we identified pervasive deficiencies in our review of selected information system controls over the two systems that provide procurement data contained in the semiannual reports. The weaknesses we identified continue to compromise the security and availability of the judicial branch’s information systems, which contain sensitive information such as court case management records and human resources data. In addition, we determined that an unacceptably high risk exists that data the Judicial Council uses for creating the semiannual reports and for its day‑to‑day operations could lead to an incorrect or inappropriate conclusion. In the nearly two years since the December 2013 report’s publication, the Judicial Council has not fully implemented the controls required to address the pervasive weaknesses we identified over its information systems and could not provide a projected date for full implementation. Finally, the Judicial Council implemented our previous recommendation that it make available its semiannual reports containing information on its procurement activities in an electronic format that allows users to readily sort and filter the data. Beginning in February 2014 the Judicial Council modified its semiannual reports so that users can more easily isolate specific procurement activities of interest to them. Recommendations The Judicial Council should update the judicial contracting manual to include the required minimum fuel economy standards for vehicle purchases. The Judicial Council should develop a corrective action plan by February 29, 2016, to address the recommendation from our December 2013 audit report related to the controls over its information systems. The corrective action plan should include prioritizing the tasks, resources, primary and alternative funding sources, and milestones for all of the actions required to fully implement its framework of information system controls by June 2016. Further, the Judicial Council should continue to provide California State Auditor Report 2015-302 3 December 2015 guidance and routinely follow up with the superior courts to assist in their efforts to make the necessary improvements to their information system controls. Agency Comments Although the Judicial Council agreed to implement both of our recommendations, it stated that it will not implement improvements to controls over its information systems by the June 2016 date that we recommend. 4 California State Auditor Report 2015-302 December 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2015-302 5 December 2015 Introduction The Role of the Judicial Council Within California’s Judicial Branch California’s judicial branch is a separate, independent branch of state government consisting of the Supreme Court; courts of appeal; superior—or trial—courts; and administrative and policy entities, including the Judicial Council of California (Judicial Council). The California Constitution requires the Judicial Council to survey judicial business practices and make recommendations to the courts, the governor, and the Legislature regarding improvements to judicial administration. For example, the Judicial Council cosponsored the Trial Court Facilities Act of 2002, which shifted governance of California’s courthouse facilities from the counties to the State. According to the Judicial Council, this act was an important part of broader structural reforms to the judicial branch in California that transformed the trial courts into an integrated, state‑operated court system. The Judicial Council consists of a policymaking body and support staff to that policymaking body. Members of the policymaking body include the chief justice of California and one other Supreme Court justice; three justices of the courts of appeal; 10 superior court judges; four members of the State Bar of California; several nonvoting members, including court executive officers; and a representative from each house of the Legislature. In addition, this policymaking body may appoint an administrative director to perform functions delegated by the policymaking body of the Judicial Council. The administrative director serves as the secretary for the policymaking body and performs administrative and policymaking functions as the law and the Judicial Council policymaking body direct. The Judicial Council policymaking body performs its constitutional and other functions with the support of its staff. In addition to performing various administrative functions, Judicial Council support staff can assist judicial branch entities, such as the state’s 58 superior courts, when they procure goods and services. The California Judicial Branch Contract Law The California Public Contract Code generally governs how state entities enter into contracts; how state entities acquire goods and services; and how those entities should solicit, evaluate, and award such contracts. In 2011 the State enacted the California Judicial Branch Contract Law (judicial contract law), which is a body of laws that requires judicial branch entities to follow procurement and contracting policies that are consistent with the California Public Contract Code and substantially similar to those found in 6 California State Auditor Report 2015-302 December 2015 the State Administrative Manual (SAM) and State Contracting Manual (SCM). In addition, the judicial contract law requires, with limited exceptions, that judicial branch entities notify the California State Auditor (state auditor) of all contracts they enter into that exceed $1 million in estimated value. The law further specifies that all administrative and information technology projects exceeding $5 million are subject to the review and recommendations by the California Department of Technology. The judicial contract law also imposes other reporting requirements. Beginning in 2012 the judicial contract law requires the Judicial Council to submit semiannual reports to the Legislature and state auditor itemizing most of the judicial branch’s contracting activities. In addition, the judicial contract law requires the state auditor to commence a biennial assessment of the Judicial Council’s implementation of and compliance with the judicial contract law. We present the results of our most recent biennial assessment in this report. The Judicial Branch Contracting Manual and State Procurement Requirements The judicial contract law requires the Judicial Council to adopt and publish a contracting manual for the judicial branch. This law also requires that this manual—the Judicial Branch Contracting Manual (judicial contracting manual)—be consistent with the California Public Contract Code and substantially similar to the provisions contained in the SAM and the SCM. The SAM provides general fiscal and business policy guidance to state agencies, while the SCM provides more specific procedures in the areas of procurement and contract management. For example, the SCM and the California Public Contract Code include competitive bidding requirements and certain conflict‑of‑interest considerations. In addition to requiring adherence to the judicial contracting manual, the judicial contract law requires that the Judicial Council and each judicial branch entity adopt a local contracting manual (local manual). The judicial contracting manual requires these local manuals to identify individual persons with responsibility and authority for specific procurement and contracting activities. Further, the judicial contracting manual identifies certain items that local manuals should include, such as processes and levels of approval authority that are consistent with applicable law. California State Auditor Report 2015-302 7 December 2015 In enacting the California Public Contract Code, the Legislature intended to achieve certain objectives, such as ensuring that state agencies comply with competitive bidding statutes; providing all qualified bidders with a fair opportunity to enter the bidding process; and eliminating favoritism, fraud, and corruption in the awarding of public contracts. The California Public Contract Code generally requires state agencies to secure at least three competitive bids or proposals for each contract, and it also describes certain conditions under which a contract may be awarded without obtaining at least three competitive bids or proposals. The SCM provides guidelines for these circumstances. For example, the SCM allows solicitation of bids from a single source for transactions of less than $5,000 when the state agency determines that the pricing is fair and reasonable. The judicial contracting manual similarly exempts procurements of less than $5,000 from competitive bidding requirements. Other circumstances in which the State’s procurement rules do not require three competitive bids include situations in which a contract is for legal services, cases in which a contract is for services with a state agency or local governmental entity, and other instances as defined by the California Department of General Services. In addition, the judicial contracting manual outlines how a judicial entity can procure goods and services using purchase orders, contracts, and contract amendments. According to the judicial contracting manual, purchase orders are agreements that may be used for the purchase of goods, and these agreements are typically for “off the shelf” goods and software or for routine, low‑cost, or low‑risk services. Figure 1 on the following page outlines the process that the Judicial Council and the judicial branch entities use when they employ competitive bidding to enter into agreements— including purchase orders and contracts—to purchase goods or services from vendors. 8 California State Auditor Report 2015-302 December 2015 1 erugiF sredrO esahcruP dna stcartnoC rof ssecorP tnemerucorP evititepmoC s’hcnarB laiciduJ ehT STCARTNOC tcejorP noitaulavE gnivorppA tcejorP reganaM reyuB maeT reyuB reganaM reganaM htiW laudividnI sweiveR spoleveD sekaM tnemucod noitaticilos sezilaniF tfard eht sevorppA ,tnemucod noitaticilos stfarD ytirohtuA erutangiS sngiS tcartnoc tcartnoc noitceles noitaticilos stcudnoc dna tnemucod noitaticilos slasoporp rof tseuqer a sa hcus tcartnoc gnitnuoccA ffatS eciovni sweiveR tpiecer sefiitreC tcejorP setaitini dna ro sdoog fo reganaM tnemyap secivres *SREDRO ESAHCRUP htiW laudividnI gnitseuqeR gnivorppA gnitseuqeR ytirohtuA erutangiS rebmeM ffatS reyuB rebmeM ffatS rebmeM ffatS redro secalP dib sefiireV sngiS stcudnoC sevorppA tuo slliF rodnev htiw htiw ytimrofnoc redro esahcrup noitaticilos noitisiuqer noitisiuqer reyuB sdeen noitaticilos .ainrofilaC fo licnuoC laiciduJ eht fo ffats htiw sweivretni sti dna ,snoitavresbo s’rotiduA etatS ainrofilaC eht ,)launam gnitcartnoc laiciduj( launaM gnitcartnoC hcnarB laiciduJ ehT :secruoS eht ot yrallicna era taht secivres rof dna sdoog fo esahcrup eht rof sredro esahcrup esu netfo seititne hcnarb laiciduj ,launam gnitcartnoc laiciduj eht ot gnidroccA .tnemeerga fo epyt a era sredro esahcruP * .secivres ksir‑wol ro ,tsoc‑wol ,enituor rof ro erawtfos dna sdoog“ flehs eht ffo“ rof sredro esahcrup esu yllacipyt osla seititne hcnarb laiciduj ehT .sdoog eht fo esahcrup California State Auditor Report 2015-302 9 December 2015 Scope and Methodology We conducted this audit according to the audit requirements contained in the California Public Contract Code, Section 19210, which is part of the judicial contract law. The judicial contract law requires the state auditor to perform biennial audits of the Judicial Council. Table 1 lists the audit objectives we developed and the methods we used to fulfill those objectives. Table 1 Audit Objectives and the Methods Used to Address Them AUDIT OBJECTIVE METHOD 1 Determine whether the Judicial Branch We evaluated the July 2015 revision of the judicial contracting manual—the latest revision at Contracting Manual (judicial contracting the time of our review—to determine whether it is consistent with state standards. We focused manual) is consistent with the requirements on significant changes to the California Public Contract Code, the State Administrative Manual, set forth in the California Judicial Branch and the State Contracting Manual that occurred between January 2013 and June 2015 and that Contract Law (judicial contract law). apply to the judicial branch. 2 Determine to what extent the Judicial We reviewed recommendations directed to the Judicial Council in prior audits by the Council of California (Judicial Council) has California State Auditor (state auditor) about judicial branch procurements, and we followed implemented recommendations from our up on recommendations that the Judicial Council had not yet fully implemented. prior procurement audits. 3 Assess the reliability of the Judicial We followed up on the Judicial Council’s progress in addressing issues identified in our Council data used in the Semiannual December 2013 audit report* related to our review of selected system controls over the Report on Contracts for the Judicial Branch Judicial Council’s Oracle Financial System and Phoenix Financial System. The Judicial Council for the Reporting Period July 1 Through uses information from these two systems in compiling the semiannual reports it submits to the December 31, 2014, submitted by the Judicial Legislature and state auditor. The Oracle Financial System contains procurement and payment Council to the Joint Legislative Budget data specific to the Judicial Council and other judicial branch entities; whereas the Phoenix Committee and the state auditor. Financial System contains procurement and payment information related to the superior courts. 4 Determine whether the Judicial Council’s local We compared the provisions of the Judicial Council’s most recent local manual to relevant contracting manual (local manual) conforms provisions in the July 2015 judicial contracting manual. to the judicial contracting manual. 5 Assess the Judicial Council’s internal controls We interviewed staff and reviewed relevant documentation to identify key internal controls. over contracting and procurement practices We determined whether the Judicial Council followed these key controls by reviewing and determine whether the entity complied 60 procurements the Judicial Council made between July 2013 and June 2015. We examined with those controls and with key contracting whether the Judicial Council followed a competitive process for the selected procurements. If it and procurement requirements, including did not, we identified whether it had an approved justification for not doing so. those related to competitive bidding and sole‑source contracting. 6 Assess the Judicial Council’s internal controls We interviewed staff and reviewed relevant documentation to identify key internal controls. We over payment practices and determine assessed whether the Judicial Council followed these key controls by reviewing 60 payments whether it complied with those controls. the Judicial Council made between July 2013 and June 2015. During our review, we determined whether the Judicial Council documented that staff had received the goods or services and whether the appropriate staff person approved payments to vendors. 7 Evaluate the Judicial Council’s contracts We identified the thresholds beyond which the Judicial Council must follow a competitive to determine whether the Judicial Council procurement process and obtain approval from certain levels of management. We then inappropriately split any contracts to reviewed contract and purchase order data to identify potential split transactions and avoid necessary approvals or competitive analyzed those transactions in detail. We did not identify any contracts that had been bidding requirements. inappropriately split. continued on next page . . . 10 California State Auditor Report 2015-302 December 2015 AUDIT OBJECTIVE METHOD 8 Review the appropriateness of transactions According to our review of payments made from July 2013 through June 2015, the Judicial made with the state credit card or other Council did not have credit card payments totaling more than $100,000 or representing court‑issued cards when those transactions more than 10 percent of all payments. We also reviewed purchases the Judicial Council made exceeded a total of $100,000 or 10 percent through American Express business travel and meeting planner accounts but found that these of all reported payments during the period transactions were for general procurements, which we tested in Audit Objective 5. we audited. Sources: California Judicial Branch Contract Law, the state auditor’s planning documents, and the state auditor’s analysis of information and documentation identified in the column titled Method. * Judicial Branch Procurement: Semiannual Reports to the Legislature Are of Limited Usefulness, Information Systems Have Weak Controls, and Certain Improvements in Procurement Practices Are Needed, Report 2013‑302 & 2013‑303, December 2013. Assessment of Data Reliability The U.S. Government Accountability Office, whose standards we are statutorily required to follow, requires us to assess the sufficiency and appropriateness of computer‑processed information that we use to support our findings, conclusions, or recommendations. In performing this audit we assessed the reliability of the Oracle Financial System and Phoenix Financial System data that the Judicial Council used to compile the Semiannual Report on Contracts for the Judicial Branch for the Reporting Period of July 1 through December 31, 2014. Further, we obtained electronic data files extracted from the Judicial Council’s Oracle Financial System related to procurement and payment data. To assess the reliability of the Oracle and Phoenix financial systems, we evaluated the Judicial Council’s progress in addressing issues identified in our December 2013 audit report related to our review of select information system controls that the Judicial Council and superior courts implemented over their information systems. General controls are the policies and procedures that apply to all or a large segment of the Judicial Council’s information systems and help ensure their proper operation. In response to our identification of significant deficiencies in the controls over its information systems, in 2014 the Judicial Council adopted a framework of information system controls structured to align with the National Institute of Standards and Technology’s Special Publication 800‑53. Although the Judicial Council has made some progress in implementing the framework it adopted, pervasive weaknesses remain in the general controls over the Judicial Council’s information systems. Further, we reviewed a selection of audit reports the Judicial Council previously published concerning the weaknesses it identified in the information system controls at nine superior courts. We present the details of our review in the Audit Results. California State Auditor Report 2015-302 11 December 2015 Business process application controls relate directly to specific computerized applications—in this case, the Oracle Financial System and the Phoenix Financial System—and help to ensure that transactions are complete, accurate, valid, confidential, and available. The strength of general controls is a significant factor in determining the effectiveness of business process application controls. Because pervasive weaknesses remain in the general controls that the Judicial Council and superior courts have implemented over their information systems, we did not perform any testing of the Oracle Financial System’s or the Phoenix Financial System’s business process application controls. The results of our review indicate that there is an unacceptably high risk that data from the applications the Judicial Council and superior courts currently use to perform their day‑to‑day operations could lead to an incorrect or improper conclusion. Therefore, we determined that the Oracle Financial System and the Phoenix Financial System data were not sufficiently reliable for the purposes of evaluating procurement activity or reporting procurement activities to the Legislature or to the state auditor. Although our determination may affect the precision of the numbers we present, there is sufficient evidence in total to support our audit findings, conclusions, and recommendations in this report. 12 California State Auditor Report 2015-302 December 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2015-302 13 December 2015 Audit Results The Judicial Council of California Has Improved Its Procurement and Vendor Payment Practices The Judicial Council of California (Judicial Council), which conducts policymaking and administrative functions for the State’s judicial branch, appears to have improved its procurement and vendor payment practices since our last audit, which we published in December 2013.3 Unlike our previous audit, this audit found no instances in which the Judicial Council failed to use a competitive procurement process as required, incorrectly evaluated bids it received from vendors, or failed to document its justification for sole‑source procurements. In addition, we found that the Judicial Council consistently followed internal controls when processing vendor payments. As Table 2 shows, we recommended in December 2013 that the Judicial Council implement procedures to ensure that it procures goods and services in an appropriate manner. The Judicial Council has implemented or otherwise resolved three of our four recommendations and will soon implement the remaining recommendation. Specifically, Judicial Council staff demonstrated that they have been developing procurement training and indicated that they will begin providing the training before the end of 2015. Table 2 Status of Recommendations on the Judicial Council of California’s Procurement and Payment Activities RECOMMENDATION CURRENT STATUS The Judicial Council of California (Judicial Council) should implement procedures to ensure that it Resolved follows a competitive process for its procurements when required. The Judicial Council should implement procedures to ensure it properly documents its noncompetitive procurement process and ensure that it prepares the appropriate documentation when it amends a Fully implemented contract that it has competitively bid. The Judicial Council should provide additional training to its staff and the judicial branch entities on Pending how to conduct procurements in compliance with the Judicial Branch Contracting Manual. The Judicial Council should implement procedures to ensure that its internal controls over payments Resolved are followed and that procurements are approved before ordering and receiving goods and services. Source: California State Auditor’s recommendations in report 2013‑302 & 2013‑303: Judicial Branch Procurement: Semiannual Reports to the Legislature Are of Limited Usefulness, Information Systems Have Weak Controls, and Certain Improvements in Procurement Practices Are Needed, and our analysis of the Judicial Council’s corrective actions. 3 Judicial Branch Procurement: Semiannual Reports to the Legislature are of Limited Usefulness, Information Systems Have Weak Controls, and Certain Improvements in Procurement Practices Are Needed, Report 2013‑302 and 2013‑303, December 2013. 14 California State Auditor Report 2015-302 December 2015 The Judicial Council Uses a Competitive Procurement Process When Required In contrast to our December 2013 audit report, our recent audit gives us assurance that the Judicial Council consistently follows a competitive process for procuring goods and services when it is required to do so. As the Introduction discusses, the Judicial Branch Contracting Manual (judicial contracting manual) generally requires the Judicial Council and other judicial branch entities to purchase goods and services through a competitive process, with some exceptions. For example, the judicial contracting manual allows for a noncompetitive procurement process when only one vendor exists that can provide the good or service. Of the 16 procurements we reviewed for our December 2013 audit that required the Judicial Council to use a competitive process, we found one procurement in which the Judicial Council purchased $93,000 in software using a noncompetitive, sole‑source process instead of soliciting the contract competitively, as required. For our current audit, we evaluated 60 procurements executed between July 2013 and June 2015, including 23 that required competitive bidding, and we found no further instances in which the Judicial Council did not use the competitive procurement process when it was called for. As a result, we consider this issue to be resolved. In addition, the Judicial Council corrected the deficiencies in its bid evaluation process that we identified in the 2013 audit. The judicial contracting manual prescribes processes for evaluating and awarding bids for competitive procurements, which vary depending on the types of goods or services procured and the estimated dollar amounts of the purchases. In 2013 we found that Judicial Council procurement staff improperly evaluated some bids by using the wrong evaluation criteria or by incorrectly scoring the The Judicial Council correctly bids. To determine whether Judicial Council staff has since followed evaluated the bids for all appropriate evaluation processes, we reviewed 23 competitively bid 23 competitively bid contracts contracts awarded from July 2013 through June 2015 and found that we reviewed. the Judicial Council correctly evaluated each vendor‑submitted bid according to the evaluation methodology outlined in the judicial contracting manual. For example, we reviewed a contract for third‑party administrator services for the Judicial Branch Workers’ Compensation Program, a complex set of services worth more than $2 million. Our analysis showed that the Judicial Council appropriately evaluated and scored the contract against criteria— including demonstrated experience, capabilities to perform, and cost reasonableness—named in the request for proposals and that the Judicial Council awarded the contract to the vendor that had the bid with the highest score. California State Auditor Report 2015-302 15 December 2015 Moreover, our current review found that the Judicial Council improved its execution of the noncompetitive procurement process, as compared to the process used during our previous audit. Although the judicial contracting manual generally encourages competitive procurements, it allows a noncompetitive process for certain categories of purchases, such as a sole‑source purchase from a proprietary vendor or an amendment to a competitively bid procurement. Judicial Council staff use a noncompetitive bid form to document the type of allowed noncompetitive purchase, the justification for the purchase, and, in cases where it is required, the sole‑source approver’s signature, which provides an important level of internal review to ensure that staff has used the noncompetitive procurement process only when appropriate. In our December 2013 audit report, we found that the Judicial Council did not document its justifications for sole‑source and other noncompetitive procurements for two of nine such procurements we reviewed. For example, the Judicial Council did not document the justification for its decision to procure database licenses directly from Oracle America Inc. without first conducting a competitive bidding process. We thus recommended that the Judicial Council implement a procedure that ensures that it properly documents the justifications required for noncompetitive procurement processes. In response, the Judicial Council modified its noncompetitive bid form to ensure that procurement staff documents the section of the judicial contracting manual that permits the use of the noncompetitive process. Since implementing our recommendation to improve its process Since implementing our when making noncompetitive procurements, the Judicial Council recommendation to improve has consistently and appropriately used this improved process. its process when making For our current audit, we reviewed the files for 37 noncompetitive noncompetitive procurements, the procurements and found that the Judicial Council generally followed Judicial Council has consistently the improved process in each of these cases by documenting the and appropriately used this steps it took to ensure that prices were fair and reasonable and, where improved process. necessary, by obtaining required approvals. We also found that the Judicial Council handled contract amendments appropriately by following the new guidance regarding amendments that it developed in response to our recommendation. As a result of implementing our recommendations and otherwise improving its procurement practices, the Judicial Council has corrected the deficiencies in its practices that we found in 2013. Using these improved procurement practices will allow the Judicial Council to ensure that the prices it pays for goods and services are fair and reasonable. 16 California State Auditor Report 2015-302 December 2015 The Judicial Council Follows Its Payment Process Accounting staff are correctly following the Judicial Council’s payment process, and any error related to vendor payments that we observed in our previous audit did not resurface during our current audit. For this reason, we consider the prior recommendation related to this issue to be resolved. In 2013 we found that a member of the Judicial Council’s executive staff made a $500 purchase before completing a purchase order and obtaining approval, contrary to the requirement in the judicial contracting manual. However, after reviewing 60 payments made between July 2013 and June 2015, we found no further instances in which the invoice date preceded the date that appropriate staff approved the associated purchase order. As Figure 2 indicates, the Judicial Council’s payment process requires accounting staff to review procurement documentation, including the approved purchase order, before initiating the payment process. When followed correctly, this process prevents unapproved purchases from occurring. For all 60 goods and services purchases that we evaluated in 2015, the Judicial Council consistently followed its process, and appropriate accounting staff approved each purchase order. Finally, we analyzed the Judicial Council’s additional controls over the payment process, such as ensuring that the staff person who authorizes payment is different from the staff person who enters the invoice information into the financial accounting system, and we found no exceptions: in each instance, the Judicial Council complied with the control. Consequently, we consider this issue to be resolved. Figure 2 The Judicial Council of California’s Payment Process Vendor or Contractor Project Manager Accounting Staff Accounting Supervisor Accounting Staff Accounting Officer Submits invoice Certifies on Reviews documentation Reviews and Generates claim Reviews and for goods invoice that goods and enters invoice into approves schedule for the approves claim delivered or were received or accounting system invoice and California State schedule services provided services were accounting entry Controller’s Office performed Sources: The Judicial Branch Contracting Manual and written descriptions provided by a supervising accountant in the Judicial Council of California’s accounting services unit. The Judicial Branch Contracting Manual Is Largely Consistent With the State’s Policies, but It Could Benefit From One Important Update The Judicial Council’s judicial contracting manual is generally consistent with state contracting requirements with one exception: it does not include standards related to the minimum fuel economy of purchased vehicles. Specifically, we found that the Judicial Council should update its contracting manual to reflect a California State Auditor Report 2015-302 17 December 2015 May 2015 revision in the State Administrative Manual (SAM) that requires specific fuel economy standards for vehicles purchased by all state entities, including the judicial branch. As discussed in the Introduction, state law requires the Judicial Council to follow contracting requirements that are consistent with the California Public Contract Code and substantially similar to the SAM and the State Contracting Manual (SCM). The judicial contracting manual contains many important procurement standards found in the California Public Contract Code, the SAM, and the SCM. For example, the judicial contracting manual generally requires that judicial branch entities conduct competitive procurements in a manner that promotes open, fair, and equal competition among prospective bidders. It also requires the judicial entity employees responsible for procurement activities to be different from the employees responsible for payment approvals, and it requires judicial branch entities to advertise certain types of bid solicitations. Each of these elements helps to promote a fair, transparent procurement process that provides some assurance that the Judicial Council is spending its funds prudently when obtaining needed goods and services. To be certain that the judicial contracting manual reflects the most current contracting requirements, we identified every revision to the California Public Contract Code, the SAM, and the SCM that occurred between January 2013 and June 2015. Of the 69 total revisions, most did not apply to the judicial branch. In these cases the changes applied specifically to entities other than those in the judicial branch, or they concerned construction projects, which state law allows the judicial contracting manual to omit. In a few cases, a change did apply to the judicial branch but consisted of only a slight wording change to an existing provision of law or policy. In such instances we did not believe it was necessary for the Judicial Council to incorporate these minor changes into the judicial contracting manual. However, we identified one change to the SAM that the Judicial We identified one change to the Council and other judicial branch entities should incorporate SAM that the Judicial Council and into their procurement practices, and that does not appear other judicial branch entities should in the judicial contracting manual that generally guides these incorporate into their procurement practices. Specifically, the Department of General Services practices, and that does not appear (General Services) revised the SAM in May 2015 to update the in the judicial contracting manual. minimum fuel economy standards for state vehicle purchases. The minimum fuel economy standards—which state law requires General Services to establish—generally apply to vehicle purchases by all state entities, including the judicial branch. The Legislature enacted this law to achieve its policy objectives of fully evaluating and minimizing the economic and environmental costs of petroleum use by state agencies. The July 2015 update to the judicial contracting manual neither contains nor references these fuel 18 California State Auditor Report 2015-302 December 2015 economy standards. The Judicial Council did not purchase any vehicles between July 2015 (the effective date of the new standards) and September 2015 (the end of our fieldwork); nonetheless, the judicial contracting manual needs to reflect the SAM’s updated fuel economy standards to ensure that vehicles purchased in the future meet the standards. A supervising attorney for the Judicial Council confirmed that Judicial Council staff would propose an amendment to the next revision of the judicial contracting manual to address the minimum fuel economy standards. In addition, on December 1, 2015 the Judicial Council sent a memo to all judicial branch entities describing the new minimum fuel economy standards. The Judicial Council has Finally, the Judicial Council has incorporated information into incorporated into the judicial the judicial contracting manual that was missing during our prior contracting manual necessary audit. Specifically, we reported in our December 2013 audit report information and updates about that the August 2012 version of the judicial contracting manual did the Small Business preference not contain necessary information and updates about the Small and Disabled Veteran Business Business preference and Disabled Veteran Business programs programs found in the California found in the California Public Contract Code. By including this Public Contract Code. information in the judicial contracting manual, the Judicial Council eliminated the inconsistency with the California Public Contract Code and better ensures that the judicial branch has greater awareness of these requirements and how best to follow them. The Judicial Council’s Local Contracting Manual Contains All Required Information The Judicial Council’s local contracting manual (local manual) includes all of the information that the judicial contracting manual states that it must address. The California Judicial Branch Contract Law (judicial contract law) requires that the Judicial Council adopt a local manual. The judicial contracting manual requires the local manual to include certain information that is specific to the Judicial Council’s procurement practices and that does not appear in the judicial contracting manual. For example, the judicial contracting manual requires that local manuals identify the individuals with the responsibility and authority for procurement and contracting activities. The Judicial Council has not updated the original local manual that it created in 2011. However, we determined that the 2011 local manual includes all of the requirements that the latest judicial contracting manual—the version updated in July 2015— states that the local manual must contain. Thus, although it has been more than four years since the Judicial Council created its local manual, we did not find a pressing need for it to update the local manual at this time. California State Auditor Report 2015-302 19 December 2015 In addition, the Judicial Council corrected a previous inconsistency between its local manual and the judicial contracting manual. As we reported in our December 2013 audit report, the Judicial Council’s local manual does not include a discussion of construction activities for non‑trial court facilities, such as appellate courthouses. We expected the local manual to include such a discussion because the 2012 version of the judicial contracting manual indicated that the Judicial Council’s local manual would incorporate information on design, construction, acquisition, and other activities for non‑trial court facilities. However, in January 2014, the Judicial Council eliminated the text from the judicial contracting manual that states that this information will appear in the local manual. We agree that this was an appropriate way to resolve the discrepancy between the two manuals. Maintaining consistency between the local manual and the judicial contracting manual better enables users of these procurement resources to locate and understand information regarding procurement and contracting requirements. Although Its Procurement Information Is Now Available in a Useful Electronic Format, the Judicial Council Still Needs to Strengthen Controls Over Its Information Systems The Judicial Council continues to have weak controls over its information systems. In our December 2013 audit report we found that the Judicial Council and superior courts did not have well‑developed plans, policies, and procedures related to information systems controls. Consequently, we recommended that the Judicial Council implement improvements to its information system controls and ensure the superior courts improve their general and business process application controls, as described in Table 3 on the following page. Although the Judicial Although the Judicial Council Council adopted a framework of information systems controls in adopted a framework of June 2014 and provided this framework to the superior courts, information system controls fundamental weaknesses in the Judicial Council and superior in June 2014 and provided this courts’ information system controls remain. However, the Judicial framework to the superior courts, Council has implemented our recommendation to improve the fundamental weaknesses in the usefulness of its semiannual reports by providing data in an Judicial Council and superior electronic format that end users can filter or sort according to their courts’ information system needs. Specifically, the report’s users can sort or filter entries by controls remain. vendor name, type of commodity, or value of the procurement, among other attributes. 20 California State Auditor Report 2015-302 December 2015 Table 3 Status of Recommendations on the Judicial Council of California and Superior Courts’ Information System Controls and the Semiannual Reports RECOMMENDATION CURRENT STATUS The Judicial Council of California (Judicial Council) should implement best practices related to general and business application controls as outlined in the U.S. Government Accountability Office’s Federal Information System Controls Audit Manual and immediately begin implementing improvements to its Not fully controls over access to its information systems. It should provide guidance and routinely follow up with implemented the superior courts to ensure that they make the necessary improvements to their general and business process application controls. The Judicial Council should provide the semiannual reports in an electronic format that can be read by Fully implemented common database and spreadsheet software products that allow users to readily sort and filter the data. Source: California State Auditor’s recommendations in report 2013‑302 & 2013‑303: Judicial Branch Procurement: Semiannual Reports to the Legislature Are of Limited Usefulness, Information Systems Have Weak Controls, and Certain Improvements in Procurement Practices Are Needed, and our analysis of the Judicial Council’s corrective actions. Although the Judicial Council Has Made Some Progress, Weaknesses Persist in the Controls Over Its Information Systems After nearly two years, the Judicial Council still has not fully implemented the controls required to address the pervasive weaknesses in its information systems, and it could not provide a projected date for full implementation. During our 2013 audit of the Judicial Council and other judicial branch entities, such as the courts of appeal, we found that the Judicial Council and superior courts did not have well‑developed plans, policies, and procedures related to information system controls. Further, some of the Judicial Council’s plans related to information system controls were nonexistent, and in one case the Judicial Council had not updated a particular plan since 1997. Although the Judicial Council adopted a framework of information system controls in June 2014, fundamental weaknesses in its general controls remain. Further, the Judicial Council continues to identify weaknesses in the information system controls at the superior courts. The results of our review indicate that there is an unacceptably high risk that data from the applications the Judicial Council and superior courts currently use to perform their day‑to‑day operations could lead to an incorrect or inappropriate conclusion. Therefore, we determined that the Oracle Financial System and the Phoenix Financial System data were not sufficiently reliable for the purposes of reporting procurement activities to the Legislature or to the state auditor. Moreover, the weaknesses identified—which we do not divulge because of their sensitive nature—continue to compromise the security and availability of these information systems, which contain confidential or sensitive information, such as court case management records, human resources data, and financial data. California State Auditor Report 2015-302 21 December 2015 The Judicial Council uses procurement data from the Oracle Financial System and the Phoenix Financial System to generate the semiannual reports it provides to the Legislature and state auditor. The Judicial Council further uses the Oracle Financial System to issue purchase orders and record certain procurement activity, whereas the superior courts use the Phoenix Financial System to perform these same two functions. In December 2013 we found that the Judicial Council had pervasive weaknesses in the controls over its information systems, and we consequently recommended that it implement all of the best practices related to general and business process application controls outlined in the U.S. Government Accountability Office’s Federal Information System Controls Audit Manual no later than December 31, 2014. As the Introduction explains, general controls are the policies and procedures that apply to all or a large segment of the Judicial Council’s information systems and help ensure their proper operation. In response to our recommendation the Judicial Council Although the Judicial Council adopted a framework of information system controls in 2014 and adopted a framework of information asserted that it has since been working to implement this framework. system controls in 2014, it However, the Judicial Council identified that fundamental gaps identified fundamental gaps in its exist in its implementation of this framework in key general control implementation of this framework categories. Examples of these categories include security management, in key categories. which is a reflection of senior management’s commitment to addressing security risks and developing security policies; and access controls, which are logical and physical controls that limit or detect inappropriate access to computer resources, such as data, programs, equipment, and facilities. To further address our recommendation from 2013, the Judicial Council, in a February 2015 public meeting, approved the submission of a budget change proposal to the California Department of Finance seeking additional funding for information system control enhancements. Despite this request, the Judicial Council did not receive additional funding for this purpose in the 2015–16 annual budget act. The Judicial Council voted again in August 2015 to approve the submission of a budget change proposal to fund enhancements of its information systems. The Judicial Council’s chief administrative officer stated that without additional funding, its implementation of the 2013 audit report recommendations related to general and business process application controls will remain at the same priority level and continue to receive the same level of resources. Further, he stated that without additional funding, he could not determine when the Judicial Council will fully implement the general and business process application controls. Nonetheless, we question whether other available resources could be used for this purpose. The Judicial Council’s prolonged implementation of information system controls and the pervasive weaknesses in the existing controls continues to expose the security and availability of its information systems to compromise. These information systems contain confidential or sensitive information such as court case management records, human resources data, and financial data. 22 California State Auditor Report 2015-302 December 2015 We also reviewed information system controls over the Judicial Council’s Phoenix Financial System. As previously discussed, the superior courts use the Phoenix Financial System to issue purchase orders and record certain procurement activity. Between December 2013 and June 2015 the Judicial Council published audit reports of nine superior courts—each of which had issues related to information system controls. In response to our December 2013 report recommendation that the Judicial Council provide guidance and routinely follow up with the superior courts to ensure that they make the necessary improvements to their general and business process application controls, the Judicial Council provided its framework of information system controls to superior courts and is developing guidance on how to use the framework. Further, the Judicial Council established an annual process to follow up on outstanding audit issues. According to the Senior Manager of Audit Services, the Judicial Council categorizes outstanding audit issues based on level of risk and The Judicial Council continues to exposure to assist the courts in allocating resources and addressing areas identify pervasive weaknesses in of risk, and to identify the areas in which the courts need guidance or the superior courts’ information may need additional resources. Although the Judicial Council has made system controls—which may some progress in providing guidance to superior courts, it has continued expose the security and availability to identify pervasive weaknesses in the superior courts’ information of superior courts’ information system controls—which may expose the security and availability of systems to compromise. superior courts’ information systems to compromise. The Judicial Council Now Provides Reports on Its Procurements and Contracts in a Sortable Electronic Format The Judicial Council implemented our recommendation to provide semiannual reports in an electronic format that allows users to readily sort and filter the data, thus increasing the effectiveness of these reports as an oversight tool. The judicial contract law requires the Judicial Council to provide a report to the Joint Legislative Budget Committee and the California State Auditor twice each year that lists all vendors or contractors receiving payments from any judicial branch entities for the previous six‑month reporting period. Our December 2013 audit report recommended that the Judicial Council provide these reports in an electronic format that can be read by common database and spreadsheet software products that allow users to readily sort and filter data. Subsequently, in February 2014, the Judicial Council began posting the semiannual reports in such a format on its website. We downloaded and reviewed these reports and found them to be easily opened, read, sorted, and filtered with commercial spreadsheet software. As a result, users can now readily identify information of interest to them. For example, someone interested in the amount the Judicial Council has recently spent on consulting contracts could tally up the total payments made to all consultants under contract to the Judicial Council during the most recent reporting period. He or she could also track this type of spending over time to determine whether the Judicial Council is increasing or decreasing its reliance on consultants. California State Auditor Report 2015-302 23 December 2015 Recommendations The Judicial Council should update its judicial contracting manual to include the required minimum fuel economy standards for the judicial branch’s vehicle purchases. The Judicial Council should develop a corrective action plan by February 29, 2016, to address the recommendation from our December 2013 audit report related to the controls over its information systems. The corrective action plan should include prioritizing the tasks, resources, primary and alternative funding sources, and milestones for all of the actions required to fully implement its framework of information system controls by June 2016. Further, the Judicial Council should continue to provide guidance and routinely follow up with the superior courts to assist with their effort to make the necessary improvements to their information system controls. We conducted this audit under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives specified in the Scope and Methodology section of the report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor Date: December 10, 2015 Staff: Benjamin M. Belnap, CIA, Deputy State Auditor Whitney M. Smith Oswin Chan, MPP, CIA Taylor William Kayatta, JD, MBA IT Audit Support: Michelle J. Baur, CISA, Audit Principal Lindsay Harris, MBA Ben Ward, CISA, ACDA Legal Counsel: Amanda Saxton, Senior Staff Counsel For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. 24 California State Auditor Report 2015-302 December 2015 Blank page inserted for reproduction purposes only. California State Auditor Report 2015-302 25 December 2015 * * California State Auditor’s comment appears on page 29. 26 California State Auditor Report 2015-302 December 2015 1 California State Auditor Report 2015-302 27 December 2015 28 California State Auditor Report 2015-302 December 2015 1 California State Auditor Report 2015-302 29 December 2015 Comment CALIFORNIA STATE AUDITOR’S COMMENT ON THE RESPONSE FROM THE JUDICIAL COUNCIL OF CALIFORNIA To provide clarity and perspective, we are commenting on the response to our audit report from the Judicial Council of California (Judicial Council). The number below corresponds to the number we placed in the margin of the Judicial Council’s response. We question the lack of urgency with which the Judicial Council 1 is approaching this problem. The Judicial Council has continued to expose its confidential or sensitive information to compromise for nearly two years since we first reported on the pervasive weaknesses in its information system controls and it estimates that, without additional funding, it will not fully implement its framework of information system controls for at least another two years. By recommending that the Judicial Council implement its framework of information system controls by June 2016 we are essentially rejecting the notion that timely completion of these critical activities be contingent on receiving additional funding. Rather, the goal date we established is based on what we would consider to be a reasonable response time to resolve this problem.