California Department of Transportation Cal-Card Program Audit

CALIFORNIA DEPARTMENT OF TRANSPORTATION Audit Report CAL-CARD PROGRAM AUDIT July 1, 2018, through June 30, 2019 BETTY T. YEE California State Controller June 2021 BETTY T. YEE California State Controller June 1, 2021 David Prizmich, Chief Division of Procurement and Contracts California Department of Transportation 1727 30th Street Sacramento, CA 95816 Dear Mr. Prizmich: The State Controller’s Office audited the CAL-Card Program of the California Department of Transportation (Caltrans) for the period of July 1, 2018, through June 30, 2019. The purpose of the audit was to determine whether Caltrans complied with CAL-Card Program policies and maintained adequate internal controls over the CAL-Card Program. Our audit found that Caltrans did not comply with CAL-Card Program policies and did not maintain adequate internal controls over the CAL-Card Program. Specifically, Caltrans:  Did not complete Caltrans purchase orders in a timely manner;  Paid for contractor work outside of service agreement dates;  Did not comply with emergency purchase procedures;  Did not comply with Caltrans purchase order procedures; and  Lacks documented procedures to identify split purchases. In addition, Caltrans’ Independent Office of Audits and Investigations did not perform a review of the CAL-Card Program’s internal controls and transactions for fiscal year 2017-18, as required by the memorandum of understanding between State Controller’s Office and Caltrans. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audit Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits KT/as David Prizmich, Chief -2- June 1, 2021 cc: Toks Omishakin, Director California Department of Transportation Aaron Ochoco, Deputy Director of Administration California Department of Transportation Tracy Gentry, Assistant Division Chief Division of Procurement and Contracts California Department of Transportation Rajit Sharma, Assistant Division Chief Division of Procurement and Contracts California Department of Transportation Charles Gray, Office Chief Division of Procurement and Contracts California Department of Transportation Mari Jo Snider, Office Chief Division of Procurement and Contracts California Department of Transportation Jonathan Phillips, Branch Chief Division of Procurement and Contracts California Department of Transportation Kimberly Fox, Branch Chief Division of Procurement and Contracts California Department of Transportation Lien Huynh, Associate Policy Analyst Division of Procurement and Contracts California Department of Transportation California Department of Transportation CAL-Card Program Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority .................................................................................................................. 2 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Review Findings ............................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Findings and Recommendations ........................................................................................... 5 Attachment—California Department of Transportation’s Response to Draft Audit Report California Department of Transportation CAL-Card Program Audit Audit Report Summary The State Controller’s Office (SCO) audited the CAL-Card Program of the California Department of Transportation (Caltrans) for the period of July 1, 2018, through June 30, 2019. The purpose of the audit was to determine whether Caltrans complied with CAL-Card Program policies and maintained adequate internal controls over the CAL-Card Program. Our audit determined that Caltrans did not comply with CAL-Card Program policies and did not maintain adequate internal controls over the CAL-Card Program. In addition, Caltrans’ Independent Office of Audits and Investigations (IOAI) did not perform a review of the CAL-Card Program’s internal controls and transactions, as required by the memorandum of understanding (MOU) between SCO and Caltrans. Background Caltrans uses the CAL-Card to purchase business items necessary to carry out its daily activities. On March 1, 2013, Caltrans revised an MOU with SCO regarding the CAL-Card Program, which was originally established in December 1997. The MOU defines the terms that Caltrans accepts as a condition of receiving the delegated responsibility from SCO for the review and retention of CAL-Card Program purchasing documentation. Overview of the Caltrans CAL-Card Program Caltrans’ Division of Procurement and Contracts (DPAC) provides administrative oversight of the CAL-Card Program to ensure departmental compliance. DPAC’s responsibilities include:  Developing and distributing written policies, procedures, and control measures to ensure that Caltrans complies with program requirements;  Administering the bank database by processing applications and account adjustments from CAL-Card holders and managers;  Serving as the liaison between CAL-Card holders and US Bank;  Providing CAL-Card training for CAL-Card holders, managers, and liaisons;  Monitoring CAL-Card activity to ensure compliance; and  Managing account/level number assignments. The CAL-Card Payments Section and the Shop Payments Section of the Division of Accounting (DofA) are responsible for auditing and preparing purchasing documents into claim schedules and sending them to the SCO for payment. DofA’s responsibilities include:  Receiving Statement of Account (SOA) packages sent by CAL-Card Program managers, reviewing submitted documents for accuracy and completeness, and following up on missing documentation; -1- California Department of Transportation CAL-Card Program Audit  Assisting DPAC with training CAL-Card holders, managers, and liaisons;  Partnering with the DPAC CAL-Card Branch to provide customer service to Caltrans CAL-Card users; and  Providing copies of documentation for questionable purchases and Late Submittal Reports of potential CAL-Card holder violations to DPAC. We conducted this audit pursuant to Government Code section 12410, Audit which states, in part: Authority The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. In addition, SCO and Caltrans entered into Interagency Agreement Number 22A1015, wherein SCO has agreed to audit Caltrans’ CAL-Card Program for the period of July 1, 2018, through June 30, 2019. Objectives, Scope, The objectives of the audit were to determine whether Caltrans: and Methodology  Complied with the terms and conditions specified within the MOU between Caltrans and SCO, effective March 1, 2013;  Maintained adequate internal controls to ensure that purchases were legal, proper, and in accordance with CAL-Card Program guidelines;  Performed CAL-Card Program transactions in compliance with all applicable rules and regulations pertinent to the State of California procurement and disbursement activities, as appropriate, reasonable and legal and proper use of the state funds; and  Maintained adequate documentation to support CAL-Card purchases and claims submitted to the SCO. The audit period was July 1, 2018, through June 30, 2019. To achieve our audit objectives, we:  Reviewed Caltrans’ policies and procedures for the CAL-Card Program, including the California Department of Transportation Division of Procurement and Contracts Acquisitions Manual, August 2019 (Caltrans Acquisitions Manual);  Reviewed the MOU between Caltrans and SCO;  Reviewed prior audit reports by SCO and Caltrans’ IOAI;  Interviewed Caltrans management and supervisory staff to gain an understanding of the operations and activities related to the administration and monitoring of its CAL-Card Program; and -2- California Department of Transportation CAL-Card Program Audit  Reviewed 329 CAL-Card transactions with a value of $1,612,259 (out of 32,214 total transactions with a value of $41,962,452) and related supporting documentation. Due to the large volume of transactions, we used various methodologies to select CAL-Card transactions, and tested them for allowability, compliance with Caltrans CAL-Card Program policies, and adequacy of supporting documentation: o Judgmentally selected 30 transactions over $10,000, totaling $401,628 (out of 34 total transactions over $10,000 totaling $476,640);1 o Judgmentally selected 167 possible split purchase transactions totaling $984,642 (out of 639 transactions with a value of $3,603,829); 2 and o For testing of transactions under $10,000, we judgmentally selected 32 transactions totaling $23,623, and haphazardly selected 100 transactions, totaling $202,366, (out of 31,541 transactions with a value of $37,881,983), that were not selected for split purchase testing.3 We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We limited our review of internal control to gain an understanding of Caltrans’ CAL-Card Program. We did not audit Caltrans’ financial statements. Conclusion Our audit determined that Caltrans:  Did not complete Caltrans purchase orders (CPOs) in a timely manner (Finding 1);  Paid for contractor work outside of service agreement dates (Finding 2);  Did not comply with emergency purchase procedures (Finding 3);  Did not comply with CPO procedures (Finding 4); and  Lacks documented procedures to identify split purchases (Finding 5). In addition, Caltrans IOAI did not perform a review of the CAL-Card Program’s internal controls and transactions for fiscal year (FY) 2017-18, as required by the MOU between SCO and Caltrans (Finding 6). 1 We judgmentally selected 30 transactions based on cardholder, dollar amount, date, and vendor. 2 We selected possible split purchase transactions based on the following criteria: a single cardholder who conducted two or more transactions, totaling over $10,000, on the same day, with the same vendor. 3 We judgmentally selected 32 transactions based on cardholder, dollar amount, date, and vendor. -3- California Department of Transportation CAL-Card Program Audit These instances are described in the Findings and Recommendations section of this report. Follow-up on Caltrans has satisfactorily resolved the findings noted in our prior review report for the period of July 1, 2015, through June 30, 2017, issued on Prior Review December 12, 2018, with the exception of Finding 4 of this audit report. Findings Views of We issued a draft audit report on February 18, 2021. David L. Prizmich, Chief, responded by Memorandum dated February 25, 2021 (Attachment), Responsible agreeing with the audit results, and indicating that Caltrans has taken steps Officials to correct the noted deficiencies. This final report includes Caltrans’ response. Restricted Use This report is solely for the information and use of Caltrans and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits June 1, 2021 -4- California Department of Transportation CAL-Card Program Audit Findings and Recommendations FINDING 1— In our testing for split purchases, we selected 167 CAL-Card transactions with a value of $984,642 out of 639 total transactions with a value of Caltrans did not $3,603,829. Of these, we identified 28 transactions, totaling $148,133, in complete CAL- which the CPOs were created more than five days after vendors had Card purchase already performed services, or purchased items had already been shipped orders in a timely to or received by Caltrans. Fifty percent of these 28 CPOs were completed manner 133 days or more after services were rendered or goods were received. One CPO was prepared 504 days after the work was completed. Caltrans’ Acquisitions Manual, Chapter 12, section 12.3.2, part D, states, in part: The CPO shall be prepared prior to making the purchase. If an emergency has occurred, the CPO should be done within five working days of the transaction to allow the purchaser to validate that the Payee Data Record, STD.204 is on file in Advantage for the vendor. CPOs include important information about a purchase, such as supplier details, procurement method, terms and conditions, and purchase description and justification. Cardholders submit the CPOs for managerial review and approval of purchases. The Caltrans Acquisitions Manual requires that CPOs be created prior to making purchases; for emergency purchases, CPOs may be created no more than five days after the purchase. However, we identified 28 instances in which CPOs were completed more than five days after services and goods had already been ordered and received. Based on discussions with Caltrans representatives, they consider the actual swipe or physical use of the CAL-Card as the occurrence of a purchase. However, at the time of the physical use of the CAL-Card, cardholders are paying an invoice to a vendor. In many cases, the vendor has already completed the work, or Caltrans has already received the ordered goods. In some cases, goods or services were rendered months before the card transaction. CPOs should be created and approved prior to ordering goods or services to ensure that purchases are appropriate and comply with purchase policies and service agreements. Recommendation We recommend that Caltrans ensure that non-emergency CPOs are completed prior to ordering goods or services; and that emergency CPOs are completed within five working days of the transaction. Caltrans’ Response Caltrans agreed with this finding, and stated that it has implemented corrective actions. We will follow up on the implementation of corrective actions during the next Cal-Card Program audit. -5- California Department of Transportation CAL-Card Program Audit In our testing for split purchases, we selected 167 CAL-Card transactions FINDING 2— with a value of $984,642, out of 639 total transactions with a value of Caltrans paid for $3,603,829. Of these, we identified 11 transactions in which vendors were contractor work paid $14,538 for work on days that were not specified in their service outside of service agreements. agreement dates State of California Department of Transportation Service Agreements Under $10,000, Revised October 2019, Special Terms and Conditions (STC: 01-2019) 1B, states in part: Neither the pendency of a dispute nor its consideration by the Caltrans Contract Officer will excuse the Contractor from full and timely performance in accordance with the terms of the Agreement. Caltrans’ Acquisitions Manual, Chapter 1, section 1.11, states in part: A Statement of Work (SOW) is a description of work that includes the location where the work is to be performed. Service contracts include a brief but clear statement of services to be performed in an introductory paragraph called the “Statement of Work”. Purchases, in which services will be provided, either wholly or in part with the goods, must include a description of the services to ensure clear expectations of the contractor’s performance are documented. The extent of detail included in the SOW is entirely dependent on the complexity of services, risk associated with the work, and the type of deliverables. The SOW may be limited to short narrative on the PAPO [Purchasing Authority Purchase Order] or it may be a separate detailed attachment to the PAPO, depending upon the extent of the documentation necessary to adequately communicate expectations. A SOW must include, at minimum, the following information:  What work is to be done? (Details of the specific services to be performed or provided, problems to be solved or the goals and objectives to be met should be included. It will also identify any special requirements, restrictions and/or limitations.)  When, where and how is the work to be done (Date(s), time(s), frequency of service).  Which resources will be provided by the Department and by the contractor?  Any specialized equipment required.  A description of items, products or results to be delivered. During our review of the invoices and service agreements for these transactions, we noted that the invoices included work that was billed by vendors and paid for by Caltrans outside of service agreement dates. For these service agreements between Caltrans and various vendors, the vendors agreed to carry out clean-up and waste disposal for road spills, homeless encampments, and other road hazards. The service agreement terms were typically for one day or two consecutive days. For the 11 transactions noted above, we found that waste disposal occurred outside of the specified service agreement dates, but Caltrans paid the vendors for this work. Per discussion with Caltrans representatives, they did not include disposal dates in the service agreements because they believe disposal is a separate activity from the clean-up service. Caltrans -6- California Department of Transportation CAL-Card Program Audit representatives stated that including disposal dates in the service agreements presents an inaccurate picture of the length of time it takes to perform road clean-up. However, disposal activities and their applicable costs were listed on the vendor invoices. Although we did not identify any vendors that were paid amounts that exceeded their contracts, all work listed on invoices should be consistent with dates documented in the service agreements. Recommendation We recommend that Caltrans ensure that its service agreement terms include the entire length of time for vendors to complete services. For road clean-up contracts, this includes the amount of time it takes to clean up and dispose of the collected waste. Caltrans’ Response Caltrans agrees with this finding, and stated that it has implemented corrective actions. We will follow up on the implementation of corrective actions during the next Cal-Card Program audit. Caltrans did not comply with the emergency purchase procedures noted in FINDING 3— the Caltrans Acquisitions Manual. Noncompliance with established Caltrans did not emergency purchase procedures could result in fraud, waste, or abuse comply with of state resources. emergency purchase Caltrans Acquisitions Manual, Chapter 9, section 9.2.1, part B, states, in procedures part: Per SCM [State Contracting Manual], Vol. 2, Section 2.B5.2: Regardless of the classification of the emergency departments must provide documentation of the following: 1. A description of the emergency 2. Explanation of why the situation warranted the emergency purchase 3. Explanation of the consequences of making the purchase through normal procurement processes 4. A description of the goods and price 5. The names and quotations of suppliers contacted Caltrans Acquisitions Manual, Chapter 12, section 12.3.2, part D, states, in part: The CPO shall be prepared prior to making the purchase. If an emergency has occurred, the CPO should be done within five working days of the transaction to allow the purchaser to validate that the Payee Data Record, STD.204 is on file in Advantage for the vendor. We tested 132 CAL-Card transactions between $400 and $10,000, with a cumulative value of $225,989 (out of 31,541 total transactions with a cumulative value of $37,881,983). We tested these 132 transactions to verify that purchases were allowable, complied with CAL-Card policies, -7- California Department of Transportation CAL-Card Program Audit and were supported with adequate documentation, including receipts or invoices, and CPOs. Of these 132 tested, we noted the following:  For six emergency goods purchases, totaling $1,167, the CPOs lacked detailed descriptions of the emergency, explanations of why the situations warranted the emergency purchases, and the benefits to the State; and  For six emergency food purchases, totaling $1,059, supervisory approvals were not obtained within five days of the purchase. On August 28, 2020, DPAC issued CAL-Card Program E-Blast #20-4, providing additional guidance for meals, food, and beverages purchased during declared emergencies for Caltrans staff. Recommendation We recommend that Caltrans ensure that CAL-Card holders and managers comply with emergency purchase policies and procedures as set forth in the Caltrans Acquisitions Manual and other Caltrans policies. Caltrans’ Response Caltrans agrees with this finding, and stated that it has implemented corrective actions. We will follow up on the implementation of corrective actions during the next Cal-Card Program audit. Caltrans did not comply with CPO procedures described in the Caltrans FINDING 4— Acquisitions Manual. During our testing of CAL-Card transactions over Caltrans did not $10,000, we found 11 instances of noncompliance; and during our testing comply with CAL- of CAL-Card transactions between $400 and $10,000, we found another Card purchase three instances of noncompliance. Caltrans’ noncompliance with order procedures established purchase order procedures could result in the misuse of state resources. We tested 30 CAL-Card transactions over $10,000, with a cumulative value of $401,628 (out of 34 total transactions over $10,000 with a cumulative value of $476,640). We tested these 30 transactions to verify that purchases were allowable, complied with CAL-Card policies, and were supported with adequate documentation, including receipts, invoices, statements of account, and CPOs. Eleven of these transactions, totaling $137,401, lacked descriptions of the benefits to the State in the CPO. We also tested 132 CAL-Card transactions under $10,000, with a cumulative value of $225,989 (out of 31,541 total transactions with a cumulative value of $37,881,983). We tested these 132 transactions to verify that purchases were allowable, complied with CAL-Card policies, and were supported with adequate documentation, including receipts or invoices, and CPOs. We found that:  In two transactions, totaling $3,976, purchases were made prior to CPO approval; and  In one transaction, totaling $319, the CPO lacked a description of the benefit to the State. -8- California Department of Transportation CAL-Card Program Audit Caltrans Acquisitions Manual, Chapter 12, section 12.3.2, part C, states, in part: All purchases must be for official State business and in accordance with this Acquisition Manual. Approval is necessary before making any purchase, and it must be documented in the CAL-Card procurement file. Despite the dollar amount under your authorized limit, the CPO STD.65 must be completed with justified purchase. Justifications should specify the benefit to the State in the body of the CPO… Recommendation We recommend that Caltrans ensure that CAL-Card holders and managers comply with purchase order policies and procedures as set forth in the Caltrans Acquisitions Manual. Caltrans’ Response Caltrans agrees with this finding, and stated that it has implemented corrective actions. We will follow up on the implementation of corrective actions during the next Cal-Card Program audit. Caltrans does not have documented procedures in place to identify FINDING 5— potential split purchase transactions. The Caltrans Acquisitions Manual Caltrans lacks prohibits splitting purchases in order to circumvent single-transaction documented purchase limits. Without sufficiently detailed, documented procedures and procedures to guidance on how DofA and DPAC staff should identify and investigate identify split split purchase transactions, there is an increased risk of noncompliance purchases with state purchasing policies and improper purchases by cardholders. Caltrans Acquisitions Manual, Chapter 12, section 12.5.2, part A, states, in part: Public Contract Code (PCC) 10329 states that “No person shall willfully split a single transaction into a series of transactions for the purpose of evading the bidding requirements of this article.” Caltrans Acquisitions Manual, Chapter 12, section 12.5.2, part B, states, in part: Orders shall not be split to circumvent competitive bidding, advertising, or the single purchase limit of the card. Examples of splitting include, but are not limited to, the following: 1. Splitting one purchase transaction into two or more card swipes because the purchase total exceeds the $10,000 single purchase limit… 4. Using multiple CAL-Card Holders to obtain the same goods or services needed by a program from the same vendor… 5. Acquiring the same goods or services for different locations by the CAL-Card Holder on separate transactions… 8. CAL-Card Holder splits a series of related services that would normally be combined and bid as one job cannot be split into -9- California Department of Transportation CAL-Card Program Audit separate tasks, steps, phases, locations, or delivery times in order to avoid adhering to state law, policy, or departmental procedure. When we requested a copy of Caltrans’ documented procedures for identifying potential split transactions, Caltrans representatives referred us to the Caltrans Acquisitions Manual and DofA’s SOA checklist. However, the manual and SOA checklist do not provide any procedures for identifying or processing potential split transactions. The SOA checklist states only “Splitting Purchases – Cursory”; it does not provide step-by- step instructions or guidance on how DofA staff should determine which transactions are potentially split purchases that should be investigated further. Caltrans representatives stated that DPAC receives automatic monthly reports generated by US Bank of any transactions that are $9,000 or more. Caltrans representatives also stated that all reported purchases by US Bank are investigated to determine whether a split purchase occurred. However, DPAC does not have documented procedures for identifying situations in which split purchase transactions are less than $9,000 but add up to more than the single purchase limit of $10,000. In addition, DPAC does not have desk procedures, checklists, step-by-step instructions, or guidance on what specific steps should be taken for any flagged transactions by either DofA or US Bank, or for DPAC’s processes for independently identifying potential split purchase transactions. Government Code, section 13402, states: Agency heads are responsible for the establishment and maintenance of a system or systems of internal control, and effective and objective ongoing monitoring of the internal controls within their state agencies. This responsibility includes documenting the system, communicating system requirements to employees, and ensuring that the system is functioning as prescribed and is modified, as appropriate, for changes in conditions. Government Code, section 13403, states in part, The elements of a satisfactory system of internal control, shall include, but are not limited to, the following… (4) An established system of practices to be followed in performance of duties and functions in each of the state agencies… (6) An effective system of internal review… (f) Agency heads shall implement systems and processes to ensure the objectivity of the monitoring of internal control as an ongoing activity in carrying out the requirements of Section 13402. Recommendation We recommend that Caltrans develop detailed, documented procedures for Accounting and DPAC to identify, investigate, and process split transactions. -10- California Department of Transportation CAL-Card Program Audit Caltrans’ Response Caltrans agrees with this finding, and stated that it has implemented corrective actions. We will follow up on the implementation of corrective actions during the next Cal-Card Program audit. Caltrans IOAI did not perform a review of the CAL-Card Program’s FINDING 6— internal controls and transactions for FY 2017-18, as required by the MOU Caltrans Independent between SCO and Caltrans. Office of Audits and Investigations did not Section E., part 2, of the MOU between SCO and Caltrans states, in part: review the CAL-Card Program for fiscal Caltrans Audits and Investigations will perform a review of Caltrans’ year 2017-18 internal controls and transaction testing relative to the CAL-Card Program, in accordance with guidelines prescribed by SCO and applicable standards on a biennial basis. A copy of the report or management letter shall be provided to the SCO by June 30, 2013, and every two years thereafter. The purpose of the MOU is to define the terms and conditions that Caltrans accepts as a condition of receiving delegated responsibility from the SCO for the review and retention of its CAL-Card Program purchasing documentation. The MOU requires that IOAI conduct a review of the Caltrans CAL-Card Program every two years to determine whether the Program is in compliance with established policies. According to IOAI representatives, IOAI did not have the staff resources to perform the FY 2017-18 review. Nonperformance of reviews of the CAL-Card Program by IOAI, not only violates the MOU, but also increases the likelihood of improper purchases by cardholders and noncompliance with CAL-Card policies and procedures. Recommendation We recommend that Caltrans comply with the terms of the MOU between Caltrans and the SCO, which require IOAI to perform a review of Caltrans’ CAL-Card Program every two years. Caltrans has indicated that they do not have the resources to perform the required reviews, therefore, the SCO will perform annual audits/reviews of the Caltrans CAL-Card Program. Caltrans’ Response Caltrans agrees with this finding, and acknowledges the SCO’s recommendation that Caltrans comply with the terms of the MOU, which would require IOAI to perform a review of Caltrans CAL-Card Program biennially (every two years). Caltrans indicated that it does not have the resources to perform the required reviews on this schedule. Therefore, Caltrans is requesting that SCO perform biennial audits of the CAL-Card Program. -11- California Department of Transportation CAL-Card Program Audit SCO Comments The finding and recommendation remain unchanged. As a condition of Caltrans receiving delegated responsibility from SCO for the review and retention of its CAL-Card Program documentation, Caltrans and the SCO agreed that IOAI would perform a review of the CAL-Card Program every two years. These reviews are essential in reducing the likelihood of improper purchases by cardholders and noncompliance with CAL-Card policies and procedures. Until IOAI can perform the reviews biennially as required by the MOU, the SCO will conduct annual audits and/or reviews of the CAL-Card Program. -12- California Department of Transportation CAL-Card Program Audit Attachment— California Department of Transportation’s Response to Draft Audit Report -13- State Controller's Office (SCO) - Response to Draft Report Audit Name: CAL-Card Program Audit Auditee: California Department of Transportation (Caltrans), Division of Procurement and Contracts (DPAC) Audit No. S20-DOT-0001 Audit Report Finding #1 Caltrans did not complete CAL-Card purchase orders in a timely manner Estimated SCO Recommendation Auditee Response to Draft Report Staff Responsible Completion Date Department of Caltrans should ensure that non-emergency The Division of Procurement and Contracts (DPAC) will Transportation, Division CPOs are completed prior to ordering goods issue a policy E-Blast to program participants, reinforce 30 to 60 Days of Final of Procurement and or services; and that emergency CPOs are policy in the monthly CAL-Card educational meeting, Audit Report Contracts CAL-Card completed within five working days of the and post the meeting notes on the CAL-Card website. Administration and transaction. Compliance Branch Audit Report Finding #2 Caltrans paid for contractor work outside of service agreement dates Caltrans should ensure that its service Department of agreement terms include the entire length of DPAC will collaborate with the Caltrans Maintenance Transportation, Division time for vendors to complete services. For Hazmat Program to ensure both cleaning and disposal 30 to 60 Days of Final of Procurement and road clean-up contracts, this includes the service dates are within the contract term. Policy Audit Report Contracts CAL-Card amount of time it takes to clean up and correspondence will be sent to all Hazmat Coordinators. Administration and dispose of the collected waste. Compliance Branch Audit Report Finding #3 Caltrans did not comply with emergency purchase procedures Department of Caltrans should ensure that CAL-Card holders DPAC CAL-Card E-Blast #20-4, provided guidance for Transportation, Division and managers comply with emergency meals, food, and beverages purchased during declared 30 to 60 Days of Final of Procurement and purchase policies and procedures as set forth emergencies. DPAC will also issue a new policy E-Blast to Audit Report Contracts CAL-Card in the Caltrans Acquisitions Manual and other cover all emergency purchases and will be sent to all CAL- Administration and Caltrans policies. Card participants. Compliance Branch Audit Report Finding #4 Caltrans did not comply with CAL-Card purchase order procedures Department of Caltrans should ensure that CAL-Card holders Transportation, Division DPAC will reinforce existing CAL-Card justification policy and managers comply with purchase order 30 to 60 Days of Final of Procurement and in the monthly CAL-Card educational meeting and post policies and procedures as set forth in the Audit Report Contracts CAL-Card the meeting notes on the CAL-Card website. Caltrans Acquisitions Manual. Administration and Compliance Branch Audit Report Finding #5 Caltrans lacks documented procedures to identify split purchases Department of Caltrans should develop detailed, DPAC will collaborate with the Division of Accounting to Transportation, Division documented procedures for Accounting and update existing procedures to identify split purchases. 30 to 60 Days of Final of Procurement and DPAC to identify, investigate, and process DPAC will also enhance existing CAL-Card split purchase Audit Report Contracts CAL-Card split transactions. procedures to include written internal processes. Administration and Compliance Branch Audit Report Finding #6 Caltrans Independent Office of Audits and Investigations (IOAI) did not review the CAL-Card Program for Fiscal Year 2017-18 Caltrans should comply with the terms of the MOU between Caltrans and the SCO, which require IOAI to perform a review of Caltrans’ Department of CAL-Card Program every two years. Caltrans DPAC recommends SCO Audit be conducted every two Transportation, Division has indicated that they do not have the N/A years. of Procurement and resources to perform the required reviews, Contracts therefore, the SCO will perform annual audits/reviews of the Caltrans CAL-Card Program. State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S20-CCP-0001